Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 273 of 1013.
- CVE-2026-89701 nfsd: validate nseconds in TIME_DELEG decode paths
- CVE-2026-89700 nfsd: validate sockaddr length per family in listener_set
- CVE-2026-8970 Privilege escalation in the Security component
- CVE-2026-89699 nfsd: validate symlink target length in NFSv4 CREATE
- CVE-2026-89698 nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage
- CVE-2026-89697 nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr()
- CVE-2026-89696 nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref
- CVE-2026-89695 nfsd: cap decoded POSIX ACL count to bound sort cost
- CVE-2026-89694 nfsd: check client ownership when cancelling a copy-notify stateid
- CVE-2026-89693 nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create()
- CVE-2026-89692 nfsd: clear CALLBACK_RUNNING on failed delegation recall queue
- CVE-2026-89691 nfsd: clear opcnt on compound arg release to prevent OOB read
- CVE-2026-89690 nfsd: defer vfree of compound ops to fix rpc_status UAF
- CVE-2026-8969 Mitigation bypass in the DOM: Security component
- CVE-2026-89689 nfsd: don't free session slots that are still in use
- CVE-2026-89688 nfsd: drop the stateid, not the stateowner, on seqid_op replay retry
- CVE-2026-89687 nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file
- CVE-2026-89686 nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke
- CVE-2026-89685 nfsd: fix clock domain mismatch in clients_still_reclaiming()
- CVE-2026-89684 nfsd: fix cpntf publish race in nfs4_init_cp_state
- CVE-2026-89683 nfsd: fix dentry ref leak on V4ROOT export filehandle lookup
- CVE-2026-89682 nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net
- CVE-2026-89681 nfsd: fix layout fence worker double-reference race
- CVE-2026-89680 nfsd: fix nfsd_file leak on inter-server COPY setup failure
- CVE-2026-8968 Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component
- CVE-2026-89679 nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs
- CVE-2026-89678 nfsd: fix partial-write detection in nfsd_direct_write
- CVE-2026-89677 nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file()
- CVE-2026-89676 nfsd: fix stale s2s_cp_stateids IDR entry for async COPY
- CVE-2026-89675 nfsd: fix UAF in async copy cancel and shutdown
- CVE-2026-89674 nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
- CVE-2026-89673 nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
- CVE-2026-89672 nfsd: gate nfs2 setacl by argp->mask
- CVE-2026-89671 nfsd: gate nfs3 setacl by argp->mask
- CVE-2026-89670 nfsd: hold rcu across localio cmpxchg retry
- CVE-2026-8967 Information disclosure in the Graphics: WebGPU component
- CVE-2026-89669 nfsd: initialize copy-notify stateid before publishing it
- CVE-2026-89668 nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd()
- CVE-2026-89667 nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache
- CVE-2026-89666 nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops
- CVE-2026-89665 nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
- CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release
- CVE-2026-89663 nfsd: revoke copy-notify stateids before dropping their reference
- CVE-2026-89662 NFSD: Prevent lock owner use-after-free during client teardown
- CVE-2026-89661 NFSD: Prevent post-shutdown use-after-free in unlock_filesystem
- CVE-2026-89660 NFSD: Prevent client use-after-free during admin state revocation
- CVE-2026-8966 Information disclosure in the IP Protection component
- CVE-2026-89659 NFSD: Prevent client use-after-free during delegation revoke
- CVE-2026-89658 NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup
- CVE-2026-89657 libceph: validate OSD extent maps before cursor advance
- CVE-2026-89656 libceph: reject buckets with mismatched CRUSH ids
- CVE-2026-89655 ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
- CVE-2026-89654 ceph: fix UAF in check_new_map() on session freed during unlock
- CVE-2026-89653 ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
- CVE-2026-89652 ceph: bound copied dentry name length in NFS export get_name
- CVE-2026-89651 ceph: bound MDSCapAuth path and fs_name decode in handle_session()
- CVE-2026-89650 ceph: bound num_export_targets array for mds info v2/v3
- CVE-2026-8965 Information disclosure in the DOM: Security component
- CVE-2026-89649 ceph: bound xattr value length in __build_xattrs()
- CVE-2026-89648 ceph: cap delegated inode count in ceph_parse_deleg_inos()
- CVE-2026-89647 ceph: do not repeat ceph_trim_dentries() if no progress possible
- CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount
- CVE-2026-89645 btrfs: drop recovered reloc root refs on recovery failure
- CVE-2026-89644 btrfs: fix extent map leak in NOCOW direct I/O write
- CVE-2026-89643 audit: avoid dropping live tree ref on fsnotify rule autoremove
- CVE-2026-89642 cifs: call pagecache_isize_extended() in cifs_setsize() when extending
- CVE-2026-89641 cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size()
- CVE-2026-89640 cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
- CVE-2026-8964 Spoofing issue in the Popup Blocker component
- CVE-2026-89639 cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC
- CVE-2026-89638 smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
- CVE-2026-89637 smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2
- CVE-2026-89636 smb: client: clear ce->tgthint in free_tgts()
- CVE-2026-89635 ksmbd: only rebind the reopened file's own oplock on durable reconnect
- CVE-2026-89634 smb: client: fix ALIGN() overflow in symlink_data() error context loop
- CVE-2026-89633 smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
- CVE-2026-89632 smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()
- CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small
- CVE-2026-89630 smb: client: restore the data_offset bound in is_valid_oplock_break()
- CVE-2026-8963 Spoofing issue in the Web Speech component
- CVE-2026-89629 HID: corsair-void: Check size of status and firmware events before reading them
- CVE-2026-89628 HID: picolcd: clamp eeprom debugfs read to bytes actually received
- CVE-2026-89627 HID: roccat: free buffered reports when destroying device
- CVE-2026-89626 HID: sensor: custom: Fix field sysfs group cleanup on failure
- CVE-2026-89625 HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind
- CVE-2026-89624 HID: universal-pidff: stop the device when force-feedback init fails
- CVE-2026-89623 HID: mcp2221: stop device IO before hid_hw_stop
- CVE-2026-89622 HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes
- CVE-2026-89621 HID: mcp2221: validate report size in mcp2221_raw_event()
- CVE-2026-89620 HID: intel-thc-hid: intel-quickspi: validate report size before copy
- CVE-2026-8962 Mitigation bypass in the DOM: Security component
- CVE-2026-89619 HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer
- CVE-2026-89618 eventfs: Initialize ei->children and ei->list in init_ei()
- CVE-2026-89617 fs/ntfs3: validate dirty page table on log replay
- CVE-2026-89616 fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
- CVE-2026-89615 fs/ntfs3: bound page_lcns[] index by the log record
- CVE-2026-89614 ntfs: bound the free-cluster bitmap scan to the volume
- CVE-2026-89613 ntfs: reject invalid empty mapping pairs
- CVE-2026-89612 ntfs: reject invalid MFT LCNs from boot sector
- CVE-2026-89611 ntfs: validate non-resident attribute offsets