Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 348 of 1013.
- CVE-2026-80626 powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del
- CVE-2026-80625 RDMA/hns: Fix memory leak of bonding resources
- CVE-2026-80624 mfd: cs42l43: Sanity check firmware size
- CVE-2026-80623 coresight: ete: Always save state on power down
- CVE-2026-80622 char: tlclk: fix use-after-free in tlclk_cleanup()
- CVE-2026-80621 PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability
- CVE-2026-80620 Revert "PCI/MSI: Unmap MSI-X region on error"
- CVE-2026-80619 apparmor: fix potential UAF in aa_replace_profiles
- CVE-2026-80618 drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free
- CVE-2026-80617 net: airoha: fix foe_check_time allocation size
- CVE-2026-80616 ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns()
- CVE-2026-80615 net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone
- CVE-2026-80614 net: emac: Fix NULL pointer dereference in emac_probe
- CVE-2026-80613 veth: fix NAPI leak in XDP enable error path
- CVE-2026-80612 net: lwtunnel: Drop skb metadata before LWT encapsulation
- CVE-2026-80611 ACPI: processor_idle: Mark LPI enter functions as __cpuidle
- CVE-2026-80610 net: enetc: fix potential divide-by-zero when num_vsi is zero
- CVE-2026-80609 qede: fix out-of-bounds check for cqe->len_list[]
- CVE-2026-80608 accel/amdxdna: Fix iommu domain lifetime race during device removal
- CVE-2026-80607 tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg
- CVE-2026-80606 drm/xe/userptr: Hold notifier_lock for write on inject test path
- CVE-2026-80605 HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()
- CVE-2026-80604 HID: core: Fix OOB read in hid_get_report for numbered reports
- CVE-2026-80603 netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read
- CVE-2026-80602 perf/x86/amd/lbr: Fix kernel address leakage
- CVE-2026-80601 batman-adv: gw: acquire ethernet header only after skb realloc
- CVE-2026-80600 batman-adv: dat: acquire ARP hw source only after skb realloc
- CVE-2026-80599 batman-adv: dat: ensure accessible eth_hdr proto field
- CVE-2026-80598 ntfs3: fix out-of-bounds read in decompress_lznt
- CVE-2026-80597 mtd: maps: vmu-flash: fix NULL pointer dereference in initialization
- CVE-2026-80596 Input: ims-pcu - only expose sysfs attributes on control interface
- CVE-2026-80595 Input: ims-pcu - add response length checks
- CVE-2026-80594 Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing
- CVE-2026-80593 hwmon: (asus_atk0110) Check package count before accessing element
- CVE-2026-80592 samples/damon/mtier: fail early if address range parameters are invalid
- CVE-2026-80591 f2fs: fix listxattr handling of corrupted xattr entries
- CVE-2026-80590 inet: frags: strip GSO state from fragments before reassembly
- CVE-2026-8059 Multiple Vulnerabilities in IBM Datacap
- CVE-2026-80589 block: stop the timeout timer when releasing a never added disk
- CVE-2026-80588 mptcp: reclaim forward-allocated memory on RX path errors
- CVE-2026-80587 mptcp: avoid combining some incoming suboptions
- CVE-2026-80586 mptcp: options: reset DSS fields in case of unexpected size
- CVE-2026-80585 mptcp: fastopen: only mark MPTFO subflows with SYN data
- CVE-2026-80584 s390/qeth: validate user buffer length in SNMP and ARP query ioctls
- CVE-2026-80583 ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses
- CVE-2026-80582 drm/shmem_helper: Check VMA boundaries for PMD mappings
- CVE-2026-80581 ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout
- CVE-2026-80580 fbdev: bound mode sysfs output to the sysfs buffer
- CVE-2026-8058 This Power System update is being released to address a sensitive information disclosure
- CVE-2026-80579 fbdev: clear fb_info->mode before deleting a videomode
- CVE-2026-80578 fbdev: core: Fix pointer desynchronization in fb_io_read()
- CVE-2026-80577 drm/panthor: skip zero-sized firmware sections
- CVE-2026-80576 drm/amdgpu: reject oversized IBs with per-ring packet limits
- CVE-2026-80575 Input: cs40l50-vibra - validate custom data from user space
- CVE-2026-80574 Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
- CVE-2026-80573 Input: iforce - validate input packet lengths
- CVE-2026-80572 Input: byd - synchronize timer deletion before freeing private data
- CVE-2026-80571 powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
- CVE-2026-80570 Input: synaptics-rmi4 - zero report size on F54 work error
- CVE-2026-80569 Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
- CVE-2026-80568 Input: synaptics-rmi4 - block s_input when F54 queue is busy
- CVE-2026-80567 Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
- CVE-2026-80566 Input: hynitron_cstxxx - validate touch count and finger IDs
- CVE-2026-80565 crypto: qce - fix error path in devm_qce_register_algs
- CVE-2026-80564 gve: fix NULL dereference due to missing ptp adjfine
- CVE-2026-80563 gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind
- CVE-2026-80562 gpio: ml-ioh: use raw_spinlock_t for the register lock
- CVE-2026-80561 libceph: fix multiple unsafe decodes in decode_locker()
- CVE-2026-80560 openrisc: signal: do not restore privileged SR bits on sigreturn
- CVE-2026-8056 Parameter Injection Vulnerability in API Graph Execution Engine
- CVE-2026-80559 Input: sur40 - fix input device registration ordering
- CVE-2026-80558 libceph: Avoid using invalid osd indices from primary_temp
- CVE-2026-80557 libceph: fix OOB read in decode_watchers() via missing bounds check
- CVE-2026-80556 mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition
- CVE-2026-80555 s390/vfio_ccw: Free all memory if cp_init() fails
- CVE-2026-80554 s390/vfio_ccw: Limit the number of channel program segments
- CVE-2026-80553 s390/vfio_ccw: Cancel existing workqueues
- CVE-2026-80552 s390/vfio_ccw: Ensure index for read/write regions are within range
- CVE-2026-80551 s390/vfio_ccw: Ensure first IDAW remains constant
- CVE-2026-80550 s390/vfio_ccw: Fix out of bounds check on CCW array
- CVE-2026-80549 s390/vfio_ccw: Move cp cleanup out of not operational
- CVE-2026-80548 s390/vfio_ccw: Selectively expand io_mutex
- CVE-2026-80547 s390/vfio_ccw: Implement a crw lock
- CVE-2026-80546 s390/zcrypt: Improve CCA CPRB length and overflow checks
- CVE-2026-80545 s390/zcrypt: Improve EP11 CPRB length and overflow checks
- CVE-2026-80544 s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
- CVE-2026-80543 s390/zcrypt: Pad trailing CCA or EP11 message with zeros
- CVE-2026-80542 drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()
- CVE-2026-80541 drm/amdgpu: validate GEM_CREATE domain combinations
- CVE-2026-80540 drm/amdgpu: Fix UVD decode image min size calculation
- CVE-2026-8054 Unauthenticated SQL Injection in dotCMS Publish Audit API
- CVE-2026-80539 drm/amdgpu: disallow multiple FENCE chunks in one submit
- CVE-2026-80538 xfs: propagate errors from xfs_rtginode_load
- CVE-2026-80537 xfs: fix off-by-one in rtrefcount btree root level validation
- CVE-2026-80536 xfs: bounds-check buffer log item's dirty bitmap
- CVE-2026-80535 xfs: don't double-lock when deleting a self-referential directory
- CVE-2026-80534 xfs: fix ilock leak on error in xfs_dq_get_next_id
- CVE-2026-80533 xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair
- CVE-2026-80532 xfs: fix another iunlink infinite loop bug in online fsck
- CVE-2026-80531 xfs: avoid UAF on sc->tempip in xrep_tempfile_create