Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 211 of 1013.
- CVE-2026-98204 Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
- CVE-2026-98203 Input: soc_button_array - check btns_desc->package.count
- CVE-2026-98202 Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
- CVE-2026-98201 Input: zero ff_effect before compat copy in input_ff_effect_from_user
- CVE-2026-98200 hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()
- CVE-2026-9820 Mattermost schemes teams endpoint exposes private team invite IDs
- CVE-2026-98199 hwmon: (pmbus/core) increase number of phases and add new mask
- CVE-2026-98198 hwmon: (pwm-fan) Stop RPM timer before freeing tach data
- CVE-2026-98197 hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
- CVE-2026-98196 wifi: brcmsmac: fix UAF in brcms_free_timer()
- CVE-2026-98195 wifi: iwlegacy: fix broadcast stations deallocation
- CVE-2026-98194 wifi: libertas_tf: fix UAF in lbtf_free_adapter()
- CVE-2026-98193 wifi: libipw: reject TKIP frames without a full MIC
- CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown
- CVE-2026-98191 wifi: wlcore: release runtime PM ref on regdomain config failure
- CVE-2026-98190 wifi: wilc1000: fix out-of-bounds read in P2P public action frames
- CVE-2026-98189 wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
- CVE-2026-98188 wifi: p54: validate curve data length in the calibration curve converters
- CVE-2026-98187 wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
- CVE-2026-98186 wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
- CVE-2026-98185 wifi: mwifiex: validate scan response extents
- CVE-2026-98184 wifi: mwifiex: prevent authentication frame length truncation
- CVE-2026-98183 wifi: mac80211: avoid out-of-bounds read for empty PREQ elements
- CVE-2026-98182 wifi: mac80211: refuse to make a monitor active when it has no queue
- CVE-2026-98181 drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
- CVE-2026-98180 drm/msm: RCU-free the scheduler-containing ring and VM objects
- CVE-2026-98179 drm/amdgpu: fix rmmio iounmap skipped on device removal
- CVE-2026-98178 drm/amdgpu: Skip KFD mapping clear before initialization
- CVE-2026-98177 drm/amdkfd: Avoid integer underflow in EOP ring size calculation.
- CVE-2026-98176 drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc
- CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()
- CVE-2026-98174 smb: client: fix rlist race and missing initialization
- CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()
- CVE-2026-98172 smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
- CVE-2026-98171 smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
- CVE-2026-98170 smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs()
- CVE-2026-9817 Memory corruption in Totolink
- CVE-2026-98169 smb: client: fix potential OOB read in smb3_enum_snapshots()
- CVE-2026-98168 smb: client: fix reparse buffer bounds in cifs_query_reparse_point()
- CVE-2026-98167 smb: client: fix server->total_read for compound encrypted PDUs
- CVE-2026-98166 drm/ttm: fix swapped-out resources never leaving their bulk_move range
- CVE-2026-98164 KVM: x86/mmu: Check write tracking in all address spaces
- CVE-2026-98163 cgroup: Avoid iteration of dying tasks with zero refcount
- CVE-2026-98162 smb/server: fix tree connection leak in smb2_tree_connect()
- CVE-2026-98161 nvdimm: pmem: keep PREFLUSH before data writes
- CVE-2026-98160 staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
- CVE-2026-9816 Insufficient server-side validation of board member role fields permits privilege escalation
- CVE-2026-98159 wifi: mt76: mt7921: validate CLC firmware records
- CVE-2026-98158 ppp_async: drop the errored frame instead of resetting its headroom
- CVE-2026-98157 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation
- CVE-2026-98156 drm/virtio: use the DMA API for resource backing on Xen
- CVE-2026-98155 accel/qaic: Address potential out-of-bounds read in resp_worker()
- CVE-2026-98154 nvme-rdma: fix -EIO cleanup order in queue_rq
- CVE-2026-98153 nvme: fix racy access to FDP placement id array
- CVE-2026-98152 nvmet-rdma: fix queue leak when connect backlog is exceeded
- CVE-2026-98151 bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic
- CVE-2026-98150 bpf: Fix BPF_F_CPU validation for sparse CPU IDs
- CVE-2026-9815 MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE
- CVE-2026-98149 bpf: Fix percpu map update indexing with sparse CPU IDs
- CVE-2026-98148 drm/gud: validate GUD_ROTATION_0 is present in supported rotations
- CVE-2026-98147 printk: Don't WARN on kthread_run failure.
- CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
- CVE-2026-98145 accel/amdxdna: reject a command chain that carries no commands
- CVE-2026-98144 accel/amdxdna: put the chained BO when its mapping fails
- CVE-2026-98143 accel: ethosu: Don't read the U65 rounding mode as a storage mode
- CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe
- CVE-2026-98141 ntfs: propagate reparse index insertion failure
- CVE-2026-98140 ntfs: fix kmap_local leak in write_mft_record_nolock() error paths
- CVE-2026-9814 Command injection in Totolink
- CVE-2026-98139 ntfs: only count successfully cleared runs when freeing clusters
- CVE-2026-98138 ntfs: do not mark the volume clean in sync_fs when errors were recorded
- CVE-2026-98137 ntfs: treat any nonzero dio zero-range return as an error
- CVE-2026-98136 ntfs: bound $AttrDef table walk to the loaded table size
- CVE-2026-98135 ntfs: reject invalid sectors_per_cluster in the boot sector
- CVE-2026-98134 bpf: check_cond_jmp_op(): properly infer if register is null
- CVE-2026-98133 ntfs: leave HasEA flag untouched on setxattr failure
- CVE-2026-98132 bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO
- CVE-2026-98131 net: stmmac: fix dma mapping leak in stmmac_tso_xmit()
- CVE-2026-98130 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
- CVE-2026-9813 FlowIntel external reference URL probe allows server-side request forgery
- CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()
- CVE-2026-98128 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()
- CVE-2026-98127 smb/client: validate new EOF for insert range
- CVE-2026-98126 smb/client: validate new EOF for zero range
- CVE-2026-98125 smb/client: fix stale page cache in insert/collapse range
- CVE-2026-98124 smb/client: invalidate fscache for fallocate range operations
- CVE-2026-98123 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration
- CVE-2026-98122 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
- CVE-2026-98121 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks
- CVE-2026-98120 netfs: Fix subreq ref leak
- CVE-2026-9812 Missing property field ownership validation in Playbooks run property update endpoint
- CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails
- CVE-2026-98118 netfs: Fix readahead synchronisation issues by loading all folios upfront
- CVE-2026-98117 cachefiles: Fix potential UAF/KASAN warning
- CVE-2026-98116 ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
- CVE-2026-98115 ksmbd: safely drain sessions during logoff
- CVE-2026-98114 ksmbd: propagate DACL parsing errors
- CVE-2026-98113 ksmbd: rate limit unmapped SID errors
- CVE-2026-98112 ksmbd: fix listener task lifetime on netdev events
- CVE-2026-98111 Bluetooth: btintel: validate version TLV value lengths