Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 210 of 1013.
- CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
- CVE-2026-98297 Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained
- CVE-2026-98296 Bluetooth: btintel_pcie: validate TX skb length in send_sync
- CVE-2026-98295 Bluetooth: coredump: Quiesce dump work on unregister
- CVE-2026-98294 Bluetooth: hci_qca: Do not write to the serial port after it is closed
- CVE-2026-98293 Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()
- CVE-2026-98292 Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access
- CVE-2026-98291 Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit
- CVE-2026-98290 Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
- CVE-2026-9829 SQL injection in Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2026-98289 af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().
- CVE-2026-98288 net: stmmac: fix TSO header length truncation
- CVE-2026-98287 pppoatm: ensure a writable skb header and linear data
- CVE-2026-98286 drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown
- CVE-2026-98285 net: bridge: vlan: fix bugs caused by switchdev deletion errors
- CVE-2026-98284 netlink: do not free nlk->groups while lockless readers can use it
- CVE-2026-98283 KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
- CVE-2026-98282 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
- CVE-2026-98281 futex: Also allocate private hash on vfork()
- CVE-2026-98280 drm/xe/i2c: Disable IRQ on unbind
- CVE-2026-9828 Logback deserialization whitelist bypass for java.lang and java.util
- CVE-2026-98279 btrfs: handle lack of space when cleaning up verity items
- CVE-2026-98278 net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check
- CVE-2026-98277 eth: fbnic: ring the doorbell if a burst ends in a drop
- CVE-2026-98276 net: lock the socket in sock_gettstamp()
- CVE-2026-98275 net: ethernet: cortina: Ack RX overrun interrupt correctly
- CVE-2026-98274 net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()
- CVE-2026-98273 x86/kprobes: Fix crash when probing CS CALL instructions
- CVE-2026-98272 net: mvpp2: prevent buffer overflow in page_pool allocation
- CVE-2026-98271 net: skbuff: do not leave stale header offsets after pskb_carve()
- CVE-2026-98270 drm/amdgpu: check ras and obj before dereference
- CVE-2026-9827 Path traversal in Totolink
- CVE-2026-98269 btrfs: abort transaction on failure to update inode for hole punching and reflinking
- CVE-2026-98268 perf: Fix null pointer access in is_include_guest_event()
- CVE-2026-98267 9p: Fix v9fs_issue_write() to update i_size and remote_i_size
- CVE-2026-98266 ALSA: core: Fix potential UAF after asynchronous card release
- CVE-2026-98265 ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity
- CVE-2026-98264 ALSA: virtio: reset device before deleting virtqueues
- CVE-2026-98263 ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type
- CVE-2026-98262 ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
- CVE-2026-98261 cifs: Fix server use-after-free in cifs_chan_skip_or_disable()
- CVE-2026-98260 exec: Cleanup POSIX timers right after de_thread()
- CVE-2026-98259 fs/dax: check zero or empty entry before converting xarray entry
- CVE-2026-98258 posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list
- CVE-2026-98257 rds: ib: use rds_conn_drop() on protocol version mismatch
- CVE-2026-98256 signal: Prevent exec() race
- CVE-2026-98255 tcp: exclude old ACKs from tcp fast path
- CVE-2026-98254 swiotlb: use the adjusted address for the highmem page lookup
- CVE-2026-98253 RDMA/ucma: Serialize join and leave on copy_to_user failure
- CVE-2026-98252 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
- CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels
- CVE-2026-98250 nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
- CVE-2026-9825 IBM Cyber Fraud Reachable Assertion
- CVE-2026-98249 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc
- CVE-2026-98248 arm64: percpu: Fix LSE operations on {8,16}-bit types
- CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length
- CVE-2026-98246 Bluetooth: hci_sync: Serialize local codec list cleanup
- CVE-2026-98245 btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()
- CVE-2026-98244 btrfs: clear free space tree creation state on rebuild failure
- CVE-2026-98243 dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3
- CVE-2026-98242 dma-buf: Fix silent overflow for phys vec to sgt
- CVE-2026-98241 ipv6: xfrm: use full sockets in local error paths
- CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options
- CVE-2026-9824 Remote cluster metadata enumeration via /share-channel autocomplete
- CVE-2026-98239 net: lan743x: fix RX checksum use-after-free
- CVE-2026-98238 net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
- CVE-2026-98237 net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
- CVE-2026-98236 net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
- CVE-2026-98235 net/sched: act_api: release tail references on DELACTION failure
- CVE-2026-98234 net/sched: hhf: cap hh_flows_limit at change time
- CVE-2026-98233 net/packet: clear RX owner on VNET header error
- CVE-2026-98232 scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()
- CVE-2026-98231 xfrm: serialize state GC with device state flush
- CVE-2026-98230 xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
- CVE-2026-98229 xfrm: save input state data before secpath resets
- CVE-2026-98228 mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ
- CVE-2026-98227 memstick: ms_block: destroy io_queue workqueue on removal
- CVE-2026-98226 mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count
- CVE-2026-98225 mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem
- CVE-2026-98224 mm/vma: correctly unaccount on mmap_prepare() failure
- CVE-2026-98223 mm: filemap: retain mapped dropbehind folios
- CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len
- CVE-2026-98221 KEYS: trusted: Fix tpm2_load_cmd() boundary check
- CVE-2026-98220 sched_ext: Fix NULL sched deref in kfunc sub-sched error paths
- CVE-2026-9822 WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers
- CVE-2026-98219 sched_ext: Close the pre-enable ops error claim window
- CVE-2026-98218 i2c: atr: fix dangling adapter pointer on add failure
- CVE-2026-98217 IB/mlx4: Fix use-after-free on pkey sysfs registration failure
- CVE-2026-98216 IB/hfi1: Fix the PIO_CRED credit-return mmap
- CVE-2026-98215 selinux: preserve user SID across nested backing files
- CVE-2026-98214 selinux: recheck intermediate backing files on mprotect()
- CVE-2026-98213 mmc: core: Cancel SDIO IRQ work before freeing host
- CVE-2026-98212 mmc: hsq: Fix use-after-free in retry work
- CVE-2026-98211 mmc: mmci: Fix use-after-free in busy-timeout work
- CVE-2026-98210 mmc: mxcmmc: cancel data work and watchdog on remove
- CVE-2026-98209 mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
- CVE-2026-98208 mmc: sdio_uart: fix xmit_fifo leak when the port table is full
- CVE-2026-98207 mmc: spi: reset bytes_xfered before retrying CRC failures
- CVE-2026-98206 Input: cyttsp5 - clamp the HID report size before memcpy
- CVE-2026-98205 Input: evdev - zero absinfo before partial copy in EVIOCSABS