Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 213 of 1013.
- CVE-2026-98019 bpf: mark a NULL call argument precise
- CVE-2026-98018 net: mctp: i3c: serialize probe with bus removal
- CVE-2026-98017 net/sched: defer qdisc freeing after failed creation
- CVE-2026-98016 net/mlx5e: Fix use-after-free race in sample_restore_put()
- CVE-2026-98015 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put
- CVE-2026-98014 net/mlx5: E-Switch, prevent mc_list repopulation during vport disable
- CVE-2026-98013 net/sched: fq_pie: clamp quantum in change path
- CVE-2026-98012 net/sched: sfq: clamp quantum in change path
- CVE-2026-98011 net/sched: hhf: clamp quantum in change and init paths
- CVE-2026-98010 net/sched: drr: clamp quantum in change class
- CVE-2026-9801 Keycloak: keycloak: denial of service via malformed ldap password policy response
- CVE-2026-98009 net/sched: ets: clamp quantum in parse and fallback paths
- CVE-2026-98008 net: macb: fix NULL pointer dereference on unbind with fixed-link
- CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts
- CVE-2026-98006 ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
- CVE-2026-98005 erofs: delimit inode_share cache key components
- CVE-2026-98004 iommu/riscv: Serialize command queue publishing
- CVE-2026-98003 iommu/amd: Do not reallocate GA log buffers on resume
- CVE-2026-98002 iommu/amd: Fix ineffective error check in nested domain allocation
- CVE-2026-98001 hwmon: (ltc4282) Make sure clk_init_data is fully initialized
- CVE-2026-98000 hwmon: Fix potential UAF in pec_store
- CVE-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison
- CVE-2026-97998 netfilter: nfnetlink_log: cope with concurrent instance destruction
- CVE-2026-97997 virtio_ring: fix stale descriptor flags after a failed packed add
- CVE-2026-97996 virtio: fix use-after-free in unregister_virtio_device()
- CVE-2026-97995 virtio_console: do not free control-out buffers on remove
- CVE-2026-97994 vhost/vdpa: reject VRING_NUM larger than device max
- CVE-2026-97993 vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx
- CVE-2026-97992 vhost-vdpa: protect config_ctx from being freed under the config callback
- CVE-2026-97991 vdpa_sim_blk: reject out-of-range sector starts
- CVE-2026-97990 vdpa_sim_net: check TX pull result before RX copy
- CVE-2026-9799 Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass
- CVE-2026-97989 vduse: validate virtqueue alignment
- CVE-2026-97988 vhost: invalidate vring access on IOTLB transitions
- CVE-2026-97987 virtio_input: reset device if input_register_device() fails
- CVE-2026-97986 virtio_input: stop callbacks before unregistering input device
- CVE-2026-97985 af_unix: Update last skb marker in manage_oob().
- CVE-2026-97984 net: ipv6: Fix UDP length overflow with PMTU discover and big MTU
- CVE-2026-97983 vduse: return compat ioctl results directly
- CVE-2026-97982 net: ethernet: cortina: Fix budget accounting
- CVE-2026-97981 net: ethernet: cortina: Count dropped frames as NAPI work
- CVE-2026-97980 s390/debug: Fix NULL pointer dereference in debug_set_level()
- CVE-2026-9798 Keycloak: keycloak: brute-force protection bypass in ciba flow
- CVE-2026-97979 ice: add missing xa_destroy for sched_node_ids
- CVE-2026-97978 eth: ice: don't dereference pointers from TP_printk()
- CVE-2026-97977 Bluetooth: btusb: Fix UAF of btusb_data by rx_work
- CVE-2026-97976 Bluetooth: btintel_pcie: validate packet_len before skb_put_data
- CVE-2026-97975 Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()
- CVE-2026-97974 ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()
- CVE-2026-97973 net: macb: destroy the phylink instance on the probe error path
- CVE-2026-97972 net: macb: put the "mdio" child node reference on success
- CVE-2026-97971 nstree: check listing permission before taking a namespace reference
- CVE-2026-97970 watchdog: msc313e: Avoid division by zero
- CVE-2026-97969 watchdog: msc313e: Fix clock leak and spurious timer in settimeout()
- CVE-2026-97968 hwmon: (corsair-cpro) Create debugfs entries after hwmon registration
- CVE-2026-97967 hwmon: (corsair-cpro) Remove debugfs entries when probe fails
- CVE-2026-97966 octeontx2-pf: reset HTB scheduler topology before freeing queues
- CVE-2026-97965 vxlan: initialize _md in vxlan_xmit_one()
- CVE-2026-97964 ppp_synctty: ensure a writeable skb header
- CVE-2026-97963 net: stmmac: initialize ptp_lock at probe time
- CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port
- CVE-2026-97961 perf/core: Allow list_del during perf_event_overflow()
- CVE-2026-97960 perf/x86/intel: Prevent drain_pebs() reentry
- CVE-2026-9796 Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability
- CVE-2026-97959 net/sched: cls_route: free emptied bucket on filter move
- CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().
- CVE-2026-97957 net: hinic: fix mailbox segment buffer overflow
- CVE-2026-97956 net: net_failover: Fix the deadlock in net_failover_slave_name_change()
- CVE-2026-97955 net: mana: restore the XDP program pointer when pre-allocation fails
- CVE-2026-97954 net/rds: fix tcp stream corruption with large pages
- CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic
- CVE-2026-97952 sunvdc: unmap LDC cookies when the descriptor send fails
- CVE-2026-97951 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands
- CVE-2026-97950 configfs: pin the symlink target's dirent instead of chasing ->ci_dentry
- CVE-2026-9795 Keycloak: keycloak: privilege escalation via improper scope mapping enforcement
- CVE-2026-97949 configfs: unhash the dentry before dropping the item in rmdir
- CVE-2026-97948 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver
- CVE-2026-97947 x86/amd_node: Fix potential NULL pointer dereference
- CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()
- CVE-2026-97945 x86/mm: Fix user-space data loss with MADV_FREE and THP
- CVE-2026-97944 x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
- CVE-2026-97943 x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF
- CVE-2026-97942 x86/alternatives: Exclude text poking against change_page_attr()
- CVE-2026-97941 mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
- CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop
- CVE-2026-9794 Keycloak: keycloak: information disclosure via saml ecp endpoint
- CVE-2026-97939 ipmr: account multicast table and route memory
- CVE-2026-97938 reboot: fix cad_pid use-after-free race
- CVE-2026-97937 ftrace: fork: Initialize function graph state before copy_exec_state()
- CVE-2026-97936 tracing: Fix memory corruption from the histogram stacktrace modifier
- CVE-2026-97935 tracing: Set the trace clock before registering the histogram trigger
- CVE-2026-97934 tracing: Fix memory corruption from a "STACKTRACE" histogram key
- CVE-2026-97933 tracing: Take trace_array reference when opening a tracer options file
- CVE-2026-97932 tracing: Don't dereference trace_event_file in deferred trigger free
- CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings
- CVE-2026-97930 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf
- CVE-2026-9793 Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing
- CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback
- CVE-2026-97928 drm/amdgpu: skip the VMID 0 flush for VRAM
- CVE-2026-97927 ufs: create the root dentry after loading cylinder metadata