Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 269 of 1013.
- CVE-2026-90071 net/sched: sch_teql: restore skb->dev on the slave failure path
- CVE-2026-90070 tpm: st33zp24: Return zero on status read failure
- CVE-2026-9007 Reflected XSS in HCL Notes
- CVE-2026-90069 crypto: acomp - allocate async request context when cloning
- CVE-2026-90068 ASoC: dapm: Fix off-by-one check on the second enum channel
- CVE-2026-90067 libceph: validate banner payload length
- CVE-2026-90066 samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
- CVE-2026-90065 net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
- CVE-2026-90064 drm/xe: Reject page faults from non-fault-mode scratch VMs
- CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs
- CVE-2026-90062 netfilter: nf_tables: move hardware offload step after building the chain blob
- CVE-2026-90061 netfilter: nf_tables: skip double clone set expressions on element insert
- CVE-2026-90060 ALSA: control: Don't add invalid kcontrols to LED layer
- CVE-2026-9006 IBM WebSphere Application Server is affected by server-side request forgery
- CVE-2026-90059 net: stmmac: restore NET_IP_ALIGN in the RX DMA offset
- CVE-2026-90058 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup
- CVE-2026-90057 slip: remove slip_hangup() to fix use-after-free in slip_receive_buf()
- CVE-2026-90056 net: fec: only stop PTP if it was initialized
- CVE-2026-90055 usb: atm: usbatm: fix invalid ci_range initialization
- CVE-2026-90054 tcp: fix corruption of urgent data on multi-segment retransmit
- CVE-2026-90053 net/sched: sch_htb: limit htb_classify inner-class filter hops
- CVE-2026-90051 tcp: reject non zerocopy devmem tx
- CVE-2026-90049 net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
- CVE-2026-90048 fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
- CVE-2026-90047 drm/xe: Don't hand out the flat CCS storage as usable VRAM
- CVE-2026-90046 mm/page_alloc: don't spin_trylock() in NMI on UP
- CVE-2026-90045 USB: gadget: ffs: fix mm lifetime handling
- CVE-2026-90044 usb: gadget: f_fs: Fix Use-After-Free in AIO error path
- CVE-2026-90043 zram: fix slot lock bit position on big-endian 64-bit
- CVE-2026-90042 ceph: properly decrypt filenames in vmalloc() buffers
- CVE-2026-90041 HID: sony: clean up device list on probe failure
- CVE-2026-90040 KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped
- CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
- CVE-2026-90039 NFSD: Guard admin state-revocation walks with NFSD_NET_UP
- CVE-2026-90038 NFSD: Prevent client use-after-free during export state revocation
- CVE-2026-90037 NFSD: Prevent client use-after-free during close_lru reaping
- CVE-2026-90036 NFSD: Prevent client use-after-free during blocked-lock reaping
- CVE-2026-90035 drm/amd/display: fix division by zero in get_estimated_bw()
- CVE-2026-90034 usb: image: mdc800: change kmalloc() to kzalloc()
- CVE-2026-90033 ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output()
- CVE-2026-90032 media: usbtv: keep device alive while ALSA card exists
- CVE-2026-90031 usb-storage: ene_ub6250: fix race between scan work and probe
- CVE-2026-90030 usb: dwc3: clear forceRM when issuing EndTransfer
- CVE-2026-9003 TONNET｜E-LAN Hybrid Recording System - SQL Injection
- CVE-2026-90029 usb: storage: realtek_cr: fix use-after-free on disconnect
- CVE-2026-90028 usb: typec: hd3ss3220: track VBUS enable state per consumer
- CVE-2026-90027 usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
- CVE-2026-90026 usb: typec: qcom-pmic: cancel reset_work on stop
- CVE-2026-90025 usb: typec: ucsi: displayport: Fix OOB altmode array index
- CVE-2026-90024 usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs
- CVE-2026-90023 usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers()
- CVE-2026-90022 usb: gadget: f_midi2: fix use-after-free in string attribute show path
- CVE-2026-90021 usb: gadget: f_midi: initialize work in f_midi_alloc()
- CVE-2026-90020 USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl()
- CVE-2026-9002 IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled
- CVE-2026-90019 usb: gadget: fix null pointer dereference in usb_put_function_instance()
- CVE-2026-90018 staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
- CVE-2026-90017 staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
- CVE-2026-90016 staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
- CVE-2026-90015 xhci: fix lost bounce buffers on TDs spanning several ring segments
- CVE-2026-90014 tracing: Have show_event_filters/triggers files take trace array ref
- CVE-2026-90013 tracing: Take trace_array reference when opening options file
- CVE-2026-90012 spi: Fix DMA mapping ownership on partial map failure
- CVE-2026-90011 scsi: target: iscsi: Reserve a terminator byte for the login payload
- CVE-2026-90010 scsi: bsg: Cap io_uring sense copy to max_response_len
- CVE-2026-90009 scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
- CVE-2026-90008 scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
- CVE-2026-90007 scsi: pm8001: Use rollback index when freeing MSI-X vectors
- CVE-2026-90006 samples/damon/mtier: handle damon_stop() failure
- CVE-2026-90005 samples/damon/wsse: handle damon_start() failure
- CVE-2026-90004 mm/damon/core: handle region split failure in apply_min_nr_regions()
- CVE-2026-90003 futex: Prevent rcuwait use-after-free during requeue PI
- CVE-2026-90002 ftrace: Take trace_array reference before accessing its ftrace_ops
- CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path
- CVE-2026-90000 HID: rmi: fix OOB access with undersized RMI reports
- CVE-2026-89999 HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
- CVE-2026-89998 dm: fix race when loading and unloading a table
- CVE-2026-89997 dm: fix resume-vs-remove race
- CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
- CVE-2026-89995 dma-direct: return struct page from dma_direct_alloc_from_pool()
- CVE-2026-89994 dmaengine: fsl-edma: tracing: no ptr dereference during log output
- CVE-2026-89993 dmaengine: dw-edma: Initialize IRQ data before requesting IRQs
- CVE-2026-89992 cpuidle: dt_idle_genpd: kfree() the original name allocation
- CVE-2026-89991 bpf: Fix infinite loop in pcpu_freelist push with one possible CPU
- CVE-2026-89990 ceph: lock mutex in ceph_mds_check_access()
- CVE-2026-89989 ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
- CVE-2026-89988 kprobes: Protect kprobe_blacklist with RCU
- CVE-2026-89987 mm/huge_memory: transfer the pmd dirty bit to the folio on zap
- CVE-2026-89986 mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
- CVE-2026-89985 memcg: keep folio's objcg same as its node
- CVE-2026-89984 perf/x86/intel: Fix kernel address leakages in LBR stack
- CVE-2026-89983 i2c: core: fix debugfs UAF on adapter removal
- CVE-2026-89982 i2c: mux: Fix channel node leak on adapter add failure
- CVE-2026-89981 arm64: Don't read GMID_EL1 when MTE is disabled
- CVE-2026-89980 ALSA: harmony: initialize locks before requesting IRQ
- CVE-2026-89979 ALSA: pcm: Fix race between non-atomic ops and trigger-start
- CVE-2026-89978 accel/amdxdna: return early from a zero-length flush
- CVE-2026-89977 accel/ethosu: check MMIO mapping errors in probe
- CVE-2026-89976 accel/ethosu: fix job completion fence cleanup
- CVE-2026-89975 nvme-fabrics: fix DHCHAP secret leak on parse failure