Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 790 of 1013.
- CVE-2026-23359 bpf: Fix stack-out-of-bounds write in devmap
- CVE-2026-23358 drm/amdgpu: Fix error handling in slot reset
- CVE-2026-23357 can: mcp251x: fix deadlock in error path of mcp251x_open
- CVE-2026-23356 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
- CVE-2026-23355 ata: libata: cancel pending work after clearing deferred_qc
- CVE-2026-23354 x86/fred: Correct speculative safety in fred_extint()
- CVE-2026-23353 ice: fix crash in ethtool offline loopback test
- CVE-2026-23352 x86/efi: defer freeing of boot services memory
- CVE-2026-23351 netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
- CVE-2026-23350 drm/xe/queue: Call fini on exec queue creation fail
- CVE-2026-23349 HID: pidff: Fix condition effect bit clearing
- CVE-2026-23348 cxl: Fix race of nvdimm_bus object when creating nvdimm objects
- CVE-2026-23347 can: usb: f81604: correctly anchor the urb in the read bulk callback
- CVE-2026-23346 arm64: io: Extract user memory type in ioremap_prot()
- CVE-2026-23345 arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled
- CVE-2026-23344 crypto: ccp - Fix use-after-free on error path
- CVE-2026-23343 xdp: produce a warning when calculated tailroom is negative
- CVE-2026-23342 bpf: Fix race in cpumap on PREEMPT_RT
- CVE-2026-23341 accel/amdxdna: Fix crash when destroying a suspended hardware context
- CVE-2026-23340 net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
- CVE-2026-2334 ) Missing Server-Side File Extension Validation in vsDesk
- CVE-2026-23339 nfc: nci: free skb on nci_transceive early error paths
- CVE-2026-23338 drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings
- CVE-2026-23337 pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()
- CVE-2026-23336 wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
- CVE-2026-23335 RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
- CVE-2026-23334 can: usb: f81604: handle short interrupt urb messages properly
- CVE-2026-23332 cpufreq: intel_pstate: Fix crash during turbo disable
- CVE-2026-23331 udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.
- CVE-2026-23330 nfc: nci: complete pending data exchange on device close
- CVE-2026-2333 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds
- CVE-2026-23329 libie: don't unroll if fwlog isn't supported
- CVE-2026-23328 accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
- CVE-2026-23327 cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()
- CVE-2026-23326 xsk: Fix fragment node deletion to prevent buffer leak
- CVE-2026-23325 wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()
- CVE-2026-23324 can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
- CVE-2026-23323 hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver
- CVE-2026-23322 ipmi: Fix use-after-free and list corruption on sender error
- CVE-2026-23321 mptcp: pm: in-kernel: always mark signal+subflow endp as used
- CVE-2026-2332 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
- CVE-2026-23319 bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim
- CVE-2026-23318 ALSA: usb-audio: Use correct version for UAC3 header validation
- CVE-2026-23317 drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
- CVE-2026-23316 net: ipv4: fix ARM64 alignment fault in multipath hash seed
- CVE-2026-23315 wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()
- CVE-2026-23314 regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio()
- CVE-2026-23313 i40e: Fix preempt count leak in napi poll tracepoint
- CVE-2026-23312 net: usb: kaweth: validate USB endpoints
- CVE-2026-23311 perf/core: Fix invalid wait context in ctx_sched_in()
- CVE-2026-23310 bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
- CVE-2026-2331 CVE-2026-2331
- CVE-2026-23309 tracing: Add NULL pointer check to trigger_data_free()
- CVE-2026-23308 pinctrl: equilibrium: fix warning trace on load
- CVE-2026-23307 can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
- CVE-2026-23306 scsi: pm8001: Fix use-after-free in pm8001_queue_command()
- CVE-2026-23305 accel/rocket: fix unwinding in error path in rocket_probe
- CVE-2026-23304 ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
- CVE-2026-23303 smb: client: Don't log plaintext credentials in cifs_set_cifscreds
- CVE-2026-23302 net: annotate data-races around sk->sk_{data_ready,write_space}
- CVE-2026-23301 ASoC: SDCA: Add allocation failure check for Entity name
- CVE-2026-23300 net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop
- CVE-2026-2330 CVE-2026-2330
- CVE-2026-23299 Bluetooth: purge error queues in socket destructors
- CVE-2026-23298 can: ucan: Fix infinite loop from zero-length messages
- CVE-2026-23297 nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit().
- CVE-2026-23296 scsi: core: Fix refcount leak for tagset_refcnt
- CVE-2026-23295 accel/amdxdna: Fix dead lock for suspend and resume
- CVE-2026-23294 bpf: Fix race in devmap on PREEMPT_RT
- CVE-2026-23293 net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
- CVE-2026-23292 scsi: target: Fix recursive locking in __configfs_open_file()
- CVE-2026-23291 nfc: pn533: properly drop the usb interface reference on disconnect
- CVE-2026-23290 net: usb: pegasus: validate USB endpoints
- CVE-2026-2329 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
- CVE-2026-23289 IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()
- CVE-2026-23288 accel/amdxdna: Fix out-of-bounds memset in command slot handling
- CVE-2026-23287 irqchip/sifive-plic: Fix frozen interrupt due to affinity setting
- CVE-2026-23286 atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
- CVE-2026-23285 drbd: fix null-pointer dereference on local read error
- CVE-2026-23284 net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup()
- CVE-2026-23283 regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read()
- CVE-2026-23282 smb: client: fix oops due to uninitialised var in smb2_unlink()
- CVE-2026-23281 wifi: libertas: fix use-after-free in lbs_free_adapter()
- CVE-2026-23280 accel/amdxdna: Prevent ubuf size overflow
- CVE-2026-2328 Backend Access Due to Insufficient Input Validation
- CVE-2026-23279 wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
- CVE-2026-23278 netfilter: nf_tables: always walk all pending catchall elements
- CVE-2026-23277 net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
- CVE-2026-23276 net: add xmit recursion limit to tunnel xmit functions
- CVE-2026-23275 io_uring: ensure ctx->rings is stable for task work flags manipulation
- CVE-2026-23274 netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
- CVE-2026-23273 macvlan: observe an RCU grace period in macvlan_common_newlink() error path
- CVE-2026-23272 netfilter: nf_tables: unconditionally bump set->nelems before insertion
- CVE-2026-23271 perf: Fix __perf_event_overflow() vs perf_remove_from_context() race
- CVE-2026-23270 net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
- CVE-2026-2327 markdown-it is has a Regular Expression Denial of Service (ReDoS)
- CVE-2026-23269 apparmor: validate DFA start states are in bounds in unpack_pdb
- CVE-2026-23268 apparmor: fix unprivileged local user can do privileged policy management
- CVE-2026-23267 f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
- CVE-2026-23266 fbdev: rivafb: fix divide error in nv3_arb()