Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 274 of 1013.
- CVE-2026-89610 ntfs: verify run length exceeding volume boundary
- CVE-2026-8961 Spoofing issue in the Form Autofill component
- CVE-2026-89609 ecryptfs: hold msg ctx list lock when cleaning daemon queue
- CVE-2026-89608 ecryptfs: pass packet set buffer size to parser
- CVE-2026-89607 ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet
- CVE-2026-89606 ecryptfs: reject too-small tag 70 packets
- CVE-2026-89605 ecryptfs: release message context on send failure
- CVE-2026-89604 efivarfs: Rate limit statfs() handler
- CVE-2026-89602 erofs: skip sufficiently large global buffers when resizing
- CVE-2026-89601 ext2: Fix lost inode updates for IS_SYNC inodes
- CVE-2026-89600 fanotify: fix use-after-free of file range info
- CVE-2026-8960 Spoofing issue in WebExtensions
- CVE-2026-89599 fbdev: omapfb: panel-dsi-cm: initialize lock before registering display
- CVE-2026-89598 fbdev: ssd1307fb: defer I2C transfers from damage callbacks
- CVE-2026-89597 fbdev: uvesafb: unregister connector callback on init failure
- CVE-2026-89596 forcedeth: fix off-by-one when saving/restoring non-PCI config space
- CVE-2026-89595 fsnotify: Fix stale object mask after concurrent mark updates
- CVE-2026-89594 hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device
- CVE-2026-89593 hugetlb: only adjust reservation during unmapping if mapcount is 0
- CVE-2026-89592 accel/rocket: fix NULL dereference and integer overflow in rocket_job_push()
- CVE-2026-89591 accel/rocket: initialize job domain before cleanup paths
- CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()
- CVE-2026-8959 Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
- CVE-2026-89589 acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks
- CVE-2026-89588 ACPI: APEI: GHES: fix ARM section length accounting after header
- CVE-2026-89587 ACPI: pfr_update: fix stack buffer overflow in query_capability()
- CVE-2026-89586 ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes
- CVE-2026-89585 auxdisplay: charlcd: cancel backlight work on registration failure
- CVE-2026-89584 block: validate user space vectors during extraction
- CVE-2026-89583 Bluetooth: eir: Fix OOB read in eir_get_service_data()
- CVE-2026-89582 bnx2x: fix double free in bnx2x_init_firmware() error path
- CVE-2026-89581 bpf, x86: Fix per-CPU address resolution into an extended register
- CVE-2026-89580 bpf: Disable preemption in __bpf_get_stack
- CVE-2026-8958 Information disclosure, sandbox escape in the Security: Process Sandboxing component
- CVE-2026-89579 bpf: Harden bloom filter sizing and indexing on 32-bit kernels
- CVE-2026-89578 dm-io: clone the source bio instead of copying its biovec
- CVE-2026-89577 dm-io: report non-retryable errors separatedly
- CVE-2026-89576 dm-era: fix shadowed superblock leak on take-snap failure
- CVE-2026-89575 dm raid1: reserve space for NUL-terminator in build_constructor_string()
- CVE-2026-89574 dm array: validate array block headers on read
- CVE-2026-89573 dm array: reject an array block whose value size is not the caller's
- CVE-2026-89572 cpufreq: apple-soc: Fix OPP table cleanup
- CVE-2026-89571 cxl/features: bound fwctl command payload to the input buffer
- CVE-2026-89570 cxl/mce: Make the MCE notifier per-region
- CVE-2026-8957 Privilege escalation in the Enterprise Policies component
- CVE-2026-89569 Bluetooth: RFCOMM: serialize security confirmation handling
- CVE-2026-89568 kho: fix size calculation in kho_preserved_memory_reserve()
- CVE-2026-89567 jbd2: bound shrinker scans by examined checkpoint buffers
- CVE-2026-89566 jbd2: check need_resched() when skipping busy checkpoint buffers
- CVE-2026-89565 ipip: fix skb leak in collect_md mode when metadata_dst allocation fails
- CVE-2026-89564 ip: orphan prefetched skbs before multicast forwarding
- CVE-2026-89563 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
- CVE-2026-89562 ip6_gre: fix hardware header length for NBMA tunnels
- CVE-2026-89561 ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()
- CVE-2026-89560 landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation
- CVE-2026-8956 Integer overflow in the Networking: JAR component
- CVE-2026-89559 libnvdimm/labels: Prevent integer overflow in __nd_label_validate()
- CVE-2026-89558 md/raid10: fix still_degraded being inverted in raid10_sync_request()
- CVE-2026-89557 md: do overflow check for sb->bblog_shift in super_1_load()
- CVE-2026-89556 module: validate string table section types
- CVE-2026-89555 mpls: reload header after pskb_may_pull()
- CVE-2026-89554 mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
- CVE-2026-89553 nouveau/gem: reserve the bo in the info ioctl around the vma lookup
- CVE-2026-89552 params: fix charp corruption on allocation failure
- CVE-2026-89551 SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow
- CVE-2026-89550 SUNRPC: svcauth_gss: enforce krb5 token minimum length
- CVE-2026-8955 Privilege escalation in the DOM: Workers component
- CVE-2026-89549 sunrpc: route to a populated pool in svc_pool_for_cpu()
- CVE-2026-89548 SUNRPC: always drain cache_cleaner before destroying a cache_detail
- CVE-2026-89547 SUNRPC: Check svc pool percpu counter allocation
- CVE-2026-89546 SUNRPC: close backchannel before destroying callback service
- CVE-2026-89545 sunrpc: defer rq_argp and rq_resp free until after RCU grace period
- CVE-2026-89544 SUNRPC: fix gssx_dec_option_array error path bugs
- CVE-2026-89543 sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir
- CVE-2026-89542 SUNRPC: harden gss_krb5_unwrap_v2 against short tokens
- CVE-2026-89541 SUNRPC: harden gss_unwrap_resp_priv length checks
- CVE-2026-89540 sunrpc: init gssp_lock before publishing proc entry
- CVE-2026-8954 Incorrect boundary conditions, integer overflow in the Audio/Video component
- CVE-2026-89539 SUNRPC: reject duplicate CREDS_VALUE options
- CVE-2026-89538 SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field
- CVE-2026-89537 SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2
- CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback
- CVE-2026-89535 svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id
- CVE-2026-89534 svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails
- CVE-2026-89533 svcrdma: Fix offset arithmetic in read_chunk_range
- CVE-2026-89532 svcrdma: Fix pcl_for_each_segment for empty chunks
- CVE-2026-89531 svcrdma: Reject connection when transport allocation fails
- CVE-2026-89530 svcrdma: Reject inline replies that overflow the pull-up buffer
- CVE-2026-8953 Sandbox escape due to use-after-free in the Disability Access APIs component
- CVE-2026-89529 svcrdma: Reject oversized Read segments at decode time
- CVE-2026-89528 svcrdma: Reject Read lists that exceed the page budget
- CVE-2026-89527 svcrdma: Use svc_xprt_put to free listener on create failure
- CVE-2026-89526 svcrdma: Validate Read chunk positions before reconstruction
- CVE-2026-89525 udf: reject VAT indexes equal to the entry count
- CVE-2026-89524 wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets
- CVE-2026-89523 wifi: mt76: mt7925: cancel pending mlo_pm_work
- CVE-2026-89522 media: staging/ipu7: fix async notifier UAF on probe error path
- CVE-2026-89521 sched/core: Handle pick_task() releasing the rq lock
- CVE-2026-89520 sched/core: Make core-sched flips wait for in-flight selections
- CVE-2026-8952 Privilege escalation in the Application Update component