# Vulnerabilities published in 2026


- [CVE-2026-98019](https://insights.sbomify.com/CVE-2026-98019/): bpf: mark a NULL call argument precise (not scored)
- [CVE-2026-98018](https://insights.sbomify.com/CVE-2026-98018/): net: mctp: i3c: serialize probe with bus removal (not scored)
- [CVE-2026-98017](https://insights.sbomify.com/CVE-2026-98017/): net/sched: defer qdisc freeing after failed creation (high 7.8)
- [CVE-2026-98016](https://insights.sbomify.com/CVE-2026-98016/): net/mlx5e: Fix use-after-free race in sample_restore_put() (not scored)
- [CVE-2026-98015](https://insights.sbomify.com/CVE-2026-98015/): net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (not scored)
- [CVE-2026-98014](https://insights.sbomify.com/CVE-2026-98014/): net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (not scored)
- [CVE-2026-98013](https://insights.sbomify.com/CVE-2026-98013/): net/sched: fq_pie: clamp quantum in change path (not scored)
- [CVE-2026-98012](https://insights.sbomify.com/CVE-2026-98012/): net/sched: sfq: clamp quantum in change path (not scored)
- [CVE-2026-98011](https://insights.sbomify.com/CVE-2026-98011/): net/sched: hhf: clamp quantum in change and init paths (not scored)
- [CVE-2026-98010](https://insights.sbomify.com/CVE-2026-98010/): net/sched: drr: clamp quantum in change class (not scored)
- [CVE-2026-9801](https://insights.sbomify.com/CVE-2026-9801/): Keycloak: keycloak: denial of service via malformed ldap password policy response (medium 4.9)
- [CVE-2026-98009](https://insights.sbomify.com/CVE-2026-98009/): net/sched: ets: clamp quantum in parse and fallback paths (not scored)
- [CVE-2026-98008](https://insights.sbomify.com/CVE-2026-98008/): net: macb: fix NULL pointer dereference on unbind with fixed-link (not scored)
- [CVE-2026-98007](https://insights.sbomify.com/CVE-2026-98007/): bpf: Reject non-scalar bpf_loop iteration counts (not scored)
- [CVE-2026-98006](https://insights.sbomify.com/CVE-2026-98006/): ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (not scored)
- [CVE-2026-98005](https://insights.sbomify.com/CVE-2026-98005/): erofs: delimit inode_share cache key components (not scored)
- [CVE-2026-98004](https://insights.sbomify.com/CVE-2026-98004/): iommu/riscv: Serialize command queue publishing (not scored)
- [CVE-2026-98003](https://insights.sbomify.com/CVE-2026-98003/): iommu/amd: Do not reallocate GA log buffers on resume (not scored)
- [CVE-2026-98002](https://insights.sbomify.com/CVE-2026-98002/): iommu/amd: Fix ineffective error check in nested domain allocation (high 7.8)
- [CVE-2026-98001](https://insights.sbomify.com/CVE-2026-98001/): hwmon: (ltc4282) Make sure clk_init_data is fully initialized (not scored)
- [CVE-2026-98000](https://insights.sbomify.com/CVE-2026-98000/): hwmon: Fix potential UAF in pec_store (not scored)
- [CVE-2026-9800](https://insights.sbomify.com/CVE-2026-9800/): Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison (high 8.1)
- [CVE-2026-97998](https://insights.sbomify.com/CVE-2026-97998/): netfilter: nfnetlink_log: cope with concurrent instance destruction (not scored)
- [CVE-2026-97997](https://insights.sbomify.com/CVE-2026-97997/): virtio_ring: fix stale descriptor flags after a failed packed add (not scored)
- [CVE-2026-97996](https://insights.sbomify.com/CVE-2026-97996/): virtio: fix use-after-free in unregister_virtio_device() (not scored)
- [CVE-2026-97995](https://insights.sbomify.com/CVE-2026-97995/): virtio_console: do not free control-out buffers on remove (not scored)
- [CVE-2026-97994](https://insights.sbomify.com/CVE-2026-97994/): vhost/vdpa: reject VRING_NUM larger than device max (not scored)
- [CVE-2026-97993](https://insights.sbomify.com/CVE-2026-97993/): vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (not scored)
- [CVE-2026-97992](https://insights.sbomify.com/CVE-2026-97992/): vhost-vdpa: protect config_ctx from being freed under the config callback (not scored)
- [CVE-2026-97991](https://insights.sbomify.com/CVE-2026-97991/): vdpa_sim_blk: reject out-of-range sector starts (high 7.8)
- [CVE-2026-97990](https://insights.sbomify.com/CVE-2026-97990/): vdpa_sim_net: check TX pull result before RX copy (high 7.5)
- [CVE-2026-9799](https://insights.sbomify.com/CVE-2026-9799/): Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass (medium 4.6)
- [CVE-2026-97989](https://insights.sbomify.com/CVE-2026-97989/): vduse: validate virtqueue alignment (not scored)
- [CVE-2026-97988](https://insights.sbomify.com/CVE-2026-97988/): vhost: invalidate vring access on IOTLB transitions (not scored)
- [CVE-2026-97987](https://insights.sbomify.com/CVE-2026-97987/): virtio_input: reset device if input_register_device() fails (not scored)
- [CVE-2026-97986](https://insights.sbomify.com/CVE-2026-97986/): virtio_input: stop callbacks before unregistering input device (not scored)
- [CVE-2026-97985](https://insights.sbomify.com/CVE-2026-97985/): af_unix: Update last skb marker in manage_oob(). (not scored)
- [CVE-2026-97984](https://insights.sbomify.com/CVE-2026-97984/): net: ipv6: Fix UDP length overflow with PMTU discover and big MTU (not scored)
- [CVE-2026-97983](https://insights.sbomify.com/CVE-2026-97983/): vduse: return compat ioctl results directly (not scored)
- [CVE-2026-97982](https://insights.sbomify.com/CVE-2026-97982/): net: ethernet: cortina: Fix budget accounting (not scored)
- [CVE-2026-97981](https://insights.sbomify.com/CVE-2026-97981/): net: ethernet: cortina: Count dropped frames as NAPI work (not scored)
- [CVE-2026-97980](https://insights.sbomify.com/CVE-2026-97980/): s390/debug: Fix NULL pointer dereference in debug_set_level() (not scored)
- [CVE-2026-9798](https://insights.sbomify.com/CVE-2026-9798/): Keycloak: keycloak: brute-force protection bypass in ciba flow (medium 4.3)
- [CVE-2026-97979](https://insights.sbomify.com/CVE-2026-97979/): ice: add missing xa_destroy for sched_node_ids (not scored)
- [CVE-2026-97978](https://insights.sbomify.com/CVE-2026-97978/): eth: ice: don't dereference pointers from TP_printk() (not scored)
- [CVE-2026-97977](https://insights.sbomify.com/CVE-2026-97977/): Bluetooth: btusb: Fix UAF of btusb_data by rx_work (not scored)
- [CVE-2026-97976](https://insights.sbomify.com/CVE-2026-97976/): Bluetooth: btintel_pcie: validate packet_len before skb_put_data (not scored)
- [CVE-2026-97975](https://insights.sbomify.com/CVE-2026-97975/): Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del() (not scored)
- [CVE-2026-97974](https://insights.sbomify.com/CVE-2026-97974/): ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings() (not scored)
- [CVE-2026-97973](https://insights.sbomify.com/CVE-2026-97973/): net: macb: destroy the phylink instance on the probe error path (not scored)
- [CVE-2026-97972](https://insights.sbomify.com/CVE-2026-97972/): net: macb: put the "mdio" child node reference on success (not scored)
- [CVE-2026-97971](https://insights.sbomify.com/CVE-2026-97971/): nstree: check listing permission before taking a namespace reference (high 7.8)
- [CVE-2026-97970](https://insights.sbomify.com/CVE-2026-97970/): watchdog: msc313e: Avoid division by zero (not scored)
- [CVE-2026-97969](https://insights.sbomify.com/CVE-2026-97969/): watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (not scored)
- [CVE-2026-97968](https://insights.sbomify.com/CVE-2026-97968/): hwmon: (corsair-cpro) Create debugfs entries after hwmon registration (not scored)
- [CVE-2026-97967](https://insights.sbomify.com/CVE-2026-97967/): hwmon: (corsair-cpro) Remove debugfs entries when probe fails (not scored)
- [CVE-2026-97966](https://insights.sbomify.com/CVE-2026-97966/): octeontx2-pf: reset HTB scheduler topology before freeing queues (not scored)
- [CVE-2026-97965](https://insights.sbomify.com/CVE-2026-97965/): vxlan: initialize _md in vxlan_xmit_one() (not scored)
- [CVE-2026-97964](https://insights.sbomify.com/CVE-2026-97964/): ppp_synctty: ensure a writeable skb header (not scored)
- [CVE-2026-97963](https://insights.sbomify.com/CVE-2026-97963/): net: stmmac: initialize ptp_lock at probe time (not scored)
- [CVE-2026-97962](https://insights.sbomify.com/CVE-2026-97962/): net/mlx5e: Move representor vnic reporter to eswitch devlink port (not scored)
- [CVE-2026-97961](https://insights.sbomify.com/CVE-2026-97961/): perf/core: Allow list_del during perf_event_overflow() (not scored)
- [CVE-2026-97960](https://insights.sbomify.com/CVE-2026-97960/): perf/x86/intel: Prevent drain_pebs() reentry (not scored)
- [CVE-2026-9796](https://insights.sbomify.com/CVE-2026-9796/): Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability (medium 6.5)
- [CVE-2026-97959](https://insights.sbomify.com/CVE-2026-97959/): net/sched: cls_route: free emptied bucket on filter move (not scored)
- [CVE-2026-97958](https://insights.sbomify.com/CVE-2026-97958/): net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). (not scored)
- [CVE-2026-97957](https://insights.sbomify.com/CVE-2026-97957/): net: hinic: fix mailbox segment buffer overflow (high 8.8)
- [CVE-2026-97956](https://insights.sbomify.com/CVE-2026-97956/): net: net_failover: Fix the deadlock in net_failover_slave_name_change() (not scored)
- [CVE-2026-97955](https://insights.sbomify.com/CVE-2026-97955/): net: mana: restore the XDP program pointer when pre-allocation fails (not scored)
- [CVE-2026-97954](https://insights.sbomify.com/CVE-2026-97954/): net/rds: fix tcp stream corruption with large pages (not scored)
- [CVE-2026-97953](https://insights.sbomify.com/CVE-2026-97953/): net: stmmac: fix TX descriptor availability check for TSO traffic (high 7.0)
- [CVE-2026-97952](https://insights.sbomify.com/CVE-2026-97952/): sunvdc: unmap LDC cookies when the descriptor send fails (not scored)
- [CVE-2026-97951](https://insights.sbomify.com/CVE-2026-97951/): scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (not scored)
- [CVE-2026-97950](https://insights.sbomify.com/CVE-2026-97950/): configfs: pin the symlink target's dirent instead of chasing ->ci_dentry (not scored)
- [CVE-2026-9795](https://insights.sbomify.com/CVE-2026-9795/): Keycloak: keycloak: privilege escalation via improper scope mapping enforcement (high 7.3)
- [CVE-2026-97949](https://insights.sbomify.com/CVE-2026-97949/): configfs: unhash the dentry before dropping the item in rmdir (not scored)
- [CVE-2026-97948](https://insights.sbomify.com/CVE-2026-97948/): powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver (not scored)
- [CVE-2026-97947](https://insights.sbomify.com/CVE-2026-97947/): x86/amd_node: Fix potential NULL pointer dereference (not scored)
- [CVE-2026-97946](https://insights.sbomify.com/CVE-2026-97946/): x86/amd_node: Fix PCI device reference counting in amd_smn_init() (not scored)
- [CVE-2026-97945](https://insights.sbomify.com/CVE-2026-97945/): x86/mm: Fix user-space data loss with MADV_FREE and THP (not scored)
- [CVE-2026-97944](https://insights.sbomify.com/CVE-2026-97944/): x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash() (not scored)
- [CVE-2026-97943](https://insights.sbomify.com/CVE-2026-97943/): x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF (not scored)
- [CVE-2026-97942](https://insights.sbomify.com/CVE-2026-97942/): x86/alternatives: Exclude text poking against change_page_attr() (not scored)
- [CVE-2026-97941](https://insights.sbomify.com/CVE-2026-97941/): mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race (high 7.8)
- [CVE-2026-97940](https://insights.sbomify.com/CVE-2026-97940/): ipv6: fix fib6 walker UAF on seq stop (high 7.8)
- [CVE-2026-9794](https://insights.sbomify.com/CVE-2026-9794/): Keycloak: keycloak: information disclosure via saml ecp endpoint (medium 5.3)
- [CVE-2026-97939](https://insights.sbomify.com/CVE-2026-97939/): ipmr: account multicast table and route memory (not scored)
- [CVE-2026-97938](https://insights.sbomify.com/CVE-2026-97938/): reboot: fix cad_pid use-after-free race (not scored)
- [CVE-2026-97937](https://insights.sbomify.com/CVE-2026-97937/): ftrace: fork: Initialize function graph state before copy_exec_state() (high 7.8)
- [CVE-2026-97936](https://insights.sbomify.com/CVE-2026-97936/): tracing: Fix memory corruption from the histogram stacktrace modifier (not scored)
- [CVE-2026-97935](https://insights.sbomify.com/CVE-2026-97935/): tracing: Set the trace clock before registering the histogram trigger (not scored)
- [CVE-2026-97934](https://insights.sbomify.com/CVE-2026-97934/): tracing: Fix memory corruption from a "STACKTRACE" histogram key (not scored)
- [CVE-2026-97933](https://insights.sbomify.com/CVE-2026-97933/): tracing: Take trace_array reference when opening a tracer options file (not scored)
- [CVE-2026-97932](https://insights.sbomify.com/CVE-2026-97932/): tracing: Don't dereference trace_event_file in deferred trigger free (not scored)
- [CVE-2026-97931](https://insights.sbomify.com/CVE-2026-97931/): ALSA: us122l: Prevent write upgrades for read mappings (high 7.0)
- [CVE-2026-97930](https://insights.sbomify.com/CVE-2026-97930/): ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (not scored)
- [CVE-2026-9793](https://insights.sbomify.com/CVE-2026-9793/): Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing (medium 5.9)
- [CVE-2026-97929](https://insights.sbomify.com/CVE-2026-97929/): ALSA: usbusx2y: validate URB actual_length in interrupt callback (not scored)
- [CVE-2026-97928](https://insights.sbomify.com/CVE-2026-97928/): drm/amdgpu: skip the VMID 0 flush for VRAM (not scored)
- [CVE-2026-97927](https://insights.sbomify.com/CVE-2026-97927/): ufs: create the root dentry after loading cylinder metadata (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/213/