Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 443 of 1013.
- CVE-2026-68473 powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()
- CVE-2026-68472 wifi: cfg80211: validate EHT MLE before MLD ID read
- CVE-2026-68471 wifi: ieee80211: validate MLE common info length
- CVE-2026-68470 wifi: mac80211: validate extension-frame layout before RX
- CVE-2026-6847 Unauthenticated Remote Code Execution in ThemisNETPanel
- CVE-2026-68469 wifi: mwifiex: fix permanently busy scans after multiple roam iterations
- CVE-2026-68468 mtd: virt-concat: free duplicate generated name
- CVE-2026-68467 mtd: mchp23k256: use SPI match data for chip caps
- CVE-2026-68466 mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
- CVE-2026-68465 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
- CVE-2026-68464 mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt
- CVE-2026-68463 mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend
- CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers
- CVE-2026-68461 device property: initialize the remaining fields of fwnode_handle in fwnode_init()
- CVE-2026-68460 f2fs: fix potential deadlock in f2fs_balance_fs()
- CVE-2026-6846 Binutils: binutils: arbitrary code execution via malformed xcoff object file processing
- CVE-2026-68459 f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs()
- CVE-2026-68458 binder: cache secctx size before release zeroes it
- CVE-2026-68457 ksmbd: use opener credentials for FSCTL mutations
- CVE-2026-68456 usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()
- CVE-2026-68455 liveupdate: validate session type before performing operation
- CVE-2026-68454 KVM: s390: pci: Fix handling of AIF enable without AISB
- CVE-2026-68453 s390/zcrypt: Fix buffer over-read in cca_cipher2protkey
- CVE-2026-68452 s390/zcrypt: Validate length for CCA AES cipher key requests
- CVE-2026-68451 s390/zcrypt: Validate length for CCA ECC private key requests
- CVE-2026-68450 btrfs: free mapping node on duplicate reloc root insert
- CVE-2026-6845 Binutils: binutils: denial of service via crafted elf file
- CVE-2026-68449 ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
- CVE-2026-68448 ovl: check access to copy_file_range source with src mounter creds
- CVE-2026-68447 drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
- CVE-2026-68446 drm/vmwgfx: Validate vmw_surface_metadata::array_size
- CVE-2026-68445 drm/vc4: Prevent shader BO mappings from becoming writable
- CVE-2026-68444 firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
- CVE-2026-68443 hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop
- CVE-2026-68442 btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
- CVE-2026-68441 net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains
- CVE-2026-68440 net: txgbe: fix heap overflow when reading module EEPROM
- CVE-2026-6844 Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files
- CVE-2026-68439 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
- CVE-2026-68438 smp: Make CSD lock acquisition atomic for debug mode
- CVE-2026-68437 drm/imagination: Fit paired fragment job in the correct CCCB
- CVE-2026-68436 drm/amd/display: use kvzalloc to allocate struct dc
- CVE-2026-68435 LoongArch: Fix address space mismatch in kexec command line lookup
- CVE-2026-68434 serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms
- CVE-2026-68433 libceph: bound get_version reply decode to front len
- CVE-2026-68432 vxlan: require CAP_NET_ADMIN in the device netns for changelink
- CVE-2026-68431 ksmbd: validate minimum PDU size for transform requests
- CVE-2026-68430 drm/amdgpu/gfx8: drop unecessary BUG_ON()
- CVE-2026-6843 Nano: nano: format string vulnerability leads to denial of service
- CVE-2026-68429 drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
- CVE-2026-68428 KVM: x86/mmu: Fix use-after-free on vendor module reload
- CVE-2026-68427 gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings
- CVE-2026-68426 xfrm: fix stale skb->prev after async crypto steals a GSO segment
- CVE-2026-68425 IB/mad: Drop unmatched RMPP responses before reassembly
- CVE-2026-68424 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
- CVE-2026-68423 mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
- CVE-2026-68422 btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots()
- CVE-2026-68421 sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
- CVE-2026-68420 xfrm: reject optional IPTFS templates in outbound policies
- CVE-2026-6842 Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions
- CVE-2026-68419 RDMA/irdma: Prevent rereg_mr for non-mem regions
- CVE-2026-68418 RDMA/irdma: Prevent user-triggered null deref on QP create
- CVE-2026-68417 RDMA/siw: publish QP after initialization
- CVE-2026-68416 mtd: fix double free and WARN_ON in add_mtd_device() error paths
- CVE-2026-68415 xfrm: clear mode callbacks after failed mode setup
- CVE-2026-68414 wifi: cfg80211: cancel sched scan results work on unregister
- CVE-2026-68413 wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
- CVE-2026-68412 wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
- CVE-2026-68411 wifi: mac80211_hwsim: clamp virtio RX length before skb_put
- CVE-2026-68410 wifi: libertas: fix memory leak in helper_firmware_cb()
- CVE-2026-6841 Reflected XSS in Request Tracker
- CVE-2026-68409 wifi: mac80211: defer link RX stats percpu free to RCU
- CVE-2026-68408 wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
- CVE-2026-68407 wifi: nl80211: free RNR data on MBSSID mismatch
- CVE-2026-68406 wifi: cfg80211: validate PMSR FTM preamble range
- CVE-2026-68405 wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
- CVE-2026-68404 wifi: cfg80211: use wiphy work for socket owner autodisconnect
- CVE-2026-68403 wifi: brcmfmac: initialize SDIO data work before cleanup
- CVE-2026-68402 wifi: cfg80211: bound element ID read when checking non-inheritance
- CVE-2026-68401 firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit()
- CVE-2026-68400 firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation
- CVE-2026-6840 Memory corruption in ONE
- CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts
- CVE-2026-68398 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
- CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()
- CVE-2026-68396 scsi: core: wake eh reliably when using scsi_schedule_eh
- CVE-2026-68395 ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered
- CVE-2026-68394 Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update
- CVE-2026-68393 Bluetooth: hci_sync: extend conn_hash lookup critical sections
- CVE-2026-68392 Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync
- CVE-2026-68391 Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds
- CVE-2026-68390 Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups
- CVE-2026-6839 Memory corruption in ONE
- CVE-2026-68389 Bluetooth: hci_qca: Clear memdump state on invalid dump size
- CVE-2026-68388 smb/client: handle overlapping allocated ranges in fallocate
- CVE-2026-68387 can: raw: add locking for raw flags bitfield
- CVE-2026-68386 bpf, sockmap: Reject unhashed UDP sockets on sockmap update
- CVE-2026-68385 s390/checksum: Fix csum_partial() without vector facility
- CVE-2026-68384 drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves
- CVE-2026-68383 drm/xe/guc: Keep scheduler timeline name alive