Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 217 of 1013.
- CVE-2026-97567 mptcp: prevent race between disconnect() and rtx
- CVE-2026-97566 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0
- CVE-2026-97565 smb: client: reject short READ responses in CIFSSMBRead()
- CVE-2026-97564 smb: client: reject userspace cifs.idmap descriptions
- CVE-2026-97563 smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
- CVE-2026-97562 smb: client: pin DFS superblock in iterator callback
- CVE-2026-97561 smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid
- CVE-2026-97560 smb: client: fix one-byte OOB read in smb2_parse_native_symlink()
- CVE-2026-9756 Cross-site scripting in GenerateBlocks
- CVE-2026-97559 smb: client: fail DACL rewrite when the new DACL exceeds 64K
- CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close
- CVE-2026-97557 smb: client: avoid leaking refcount in cifs_queue_oplock_break()
- CVE-2026-97556 smb: client: avoid leaking refcount when cifs_sb_tlink() fails
- CVE-2026-97555 smb: client: fix heap overflow in DACL owner/group rewrite
- CVE-2026-97554 smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
- CVE-2026-97553 xfs: lock the healthmon when inserting unmount event
- CVE-2026-97552 xfs: initialise error in xfs_defer_finish_one()
- CVE-2026-97551 xfs: initialise args->total for parent pointer updates
- CVE-2026-97550 xfs: fix unit conversions in per_binval computation
- CVE-2026-97549 xfs: fix under-reservation of blocks when repairing sf directories
- CVE-2026-97548 xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions
- CVE-2026-97547 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN
- CVE-2026-97546 xfs: don't spin forever on zero-length dirents when salvaging them
- CVE-2026-97545 xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails
- CVE-2026-97544 xfs: don't leak dqacct if rhashtable insertion fails
- CVE-2026-97543 xfs: destroy seen inode bitmap when we fail to add a dirpath
- CVE-2026-97542 xfs: bail out on bitmap errors in xrep_agfl_fill
- CVE-2026-97541 wifi: ath9k_htc: don't store usb_device_id
- CVE-2026-97540 net: usb: pegasus: don't rely on id table pointer arithmetic
- CVE-2026-9754 Stack memory disclosure in filemd5 command
- CVE-2026-97539 usb: xusbatm: don't rely on id table pointer arithmetic
- CVE-2026-97538 hwmon: (asus_rog_ryujin) Validate HID report lengths
- CVE-2026-97537 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
- CVE-2026-97536 scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown
- CVE-2026-97535 scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size
- CVE-2026-97534 f2fs: accurately adjust free_sections during free_segment_range
- CVE-2026-97533 x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
- CVE-2026-97532 scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path
- CVE-2026-97531 scsi: qla2xxx: Skip vport under deletion in report ID acquisition
- CVE-2026-97530 scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature
- CVE-2026-9753 Server crash via malformed binary diff passed to $_internalApplyOplogUpdate.
- CVE-2026-97529 scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]
- CVE-2026-97528 scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error
- CVE-2026-97527 scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock
- CVE-2026-97526 s390/pai: Support CPU hotplug for PMU PAI
- CVE-2026-97525 x86/mm/pat: Allocate split page tables as kernel page tables
- CVE-2026-97524 mptcp: avoid unneeded actions on subflow reset
- CVE-2026-97523 mptcp: close race between scheduler and state change
- CVE-2026-97522 mptcp: fix bad accounting in __mptcp_subflow_push_pending()
- CVE-2026-97521 gfs2: fix quota init duplicate scan
- CVE-2026-97520 gfs2: move quota_init qc iterator increment
- CVE-2026-9752 GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation
- CVE-2026-97519 drm/xe: Fix null pointer dereference in devcoredump cleanup
- CVE-2026-97518 wifi: cfg80211: reject duplicate wiphy cipher suite entries
- CVE-2026-97517 wifi: nl80211: reject beacons with bad HE operation
- CVE-2026-97516 wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()
- CVE-2026-97515 i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845
- CVE-2026-97514 media: chips-media: wave5: Fix Reports from Kernel Lock Validator
- CVE-2026-97513 media: chips-media: wave5: Release m2m_ctx after Instance Removed from List
- CVE-2026-97512 spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM
- CVE-2026-97511 wifi: mac80211: avoid out-of-bounds access in monitor
- CVE-2026-97510 thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()
- CVE-2026-9751 Sensitive data could be written to mongod.log
- CVE-2026-97509 thunderbolt: Keep XDomain reference during the lifetime of a service
- CVE-2026-97508 thunderbolt: Set tb->root_switch to NULL when domain is stopped
- CVE-2026-97507 media: dm1105: fix missing error check for dma_alloc_coherent
- CVE-2026-97506 crypto: ixp4xx - fix buffer chain unwind on allocation failure
- CVE-2026-97505 PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
- CVE-2026-97504 watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk
- CVE-2026-97503 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
- CVE-2026-97502 mmc: davinci: avoid NULL deref of host->data in IRQ handler
- CVE-2026-97501 pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction
- CVE-2026-97500 wifi: rtw89: phy: check length before parsing PHY status IE
- CVE-2026-9750 Metadata name collision on $-prefixed fields causes post-auth server crash
- CVE-2026-97499 coresight: perf: Retrieve path and source from event data
- CVE-2026-97498 drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction
- CVE-2026-97497 drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id
- CVE-2026-97496 drm/amdkfd: Fix OOB memory exposure in get_wave_state()
- CVE-2026-97495 drm/amdkfd: Check bounds on allocate_doorbell
- CVE-2026-97494 drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw
- CVE-2026-97493 drm/amdgpu: Bound GPIO I2C table entry count from VBIOS
- CVE-2026-97492 wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed
- CVE-2026-97491 net/rds: Don't sleep inside rds_ib_conn_path_shutdown
- CVE-2026-97490 affs: handle set_blocksize failures
- CVE-2026-9749 Using MaxKey() may crash the server
- CVE-2026-97489 bfs: handle set_blocksize failures
- CVE-2026-97488 qnx4: handle set_blocksize failures
- CVE-2026-97487 jfs: handle set_blocksize failures
- CVE-2026-97486 hpfs: handle set_blocksize failures
- CVE-2026-97485 omfs: handle set_blocksize failures
- CVE-2026-97484 usbip: vhci_hcd: fix NULL deref in status_show_vhci
- CVE-2026-97483 usb: core: hcd: fix possible deadlock in rh control transfers
- CVE-2026-97482 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log
- CVE-2026-97481 serial: 8250: fix possible ISR soft lockup
- CVE-2026-97480 tty: serial: 8250: protect against NULL uart->port.dev in register
- CVE-2026-9748 $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input
- CVE-2026-97479 driver core: Avoid warning when removing a device while its supplier is unbinding
- CVE-2026-97478 virt: acrn: Fix irqfd use-after-free during eventfd shutdown
- CVE-2026-97477 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()
- CVE-2026-97476 rds: filter RDS_INFO_* getsockopt by caller's netns