# Vulnerabilities published in 2026


- [CVE-2026-98675](https://insights.sbomify.com/CVE-2026-98675/): iio: adc: ade9000: handle Phase C dip events in IRQ1 handler (not scored)
- [CVE-2026-98674](https://insights.sbomify.com/CVE-2026-98674/): iio: adc: adi-axi-adc: Initialize state mutex (not scored)
- [CVE-2026-98673](https://insights.sbomify.com/CVE-2026-98673/): iio: adc: pac1934: check ACPI label duplication (not scored)
- [CVE-2026-98672](https://insights.sbomify.com/CVE-2026-98672/): iio: adc: stm32-adc: fix possible division by zero in processed channel (not scored)
- [CVE-2026-98671](https://insights.sbomify.com/CVE-2026-98671/): iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure (not scored)
- [CVE-2026-98670](https://insights.sbomify.com/CVE-2026-98670/): iio: adc: xilinx-xadc: free IRQ before cancelling the unmask worker on unbind (not scored)
- [CVE-2026-98669](https://insights.sbomify.com/CVE-2026-98669/): iio: buffer: serialize buffer teardown with mode claims (not scored)
- [CVE-2026-98668](https://insights.sbomify.com/CVE-2026-98668/): iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. (not scored)
- [CVE-2026-98667](https://insights.sbomify.com/CVE-2026-98667/): iio: frequency: adf4377: Fully initialize clk_init_data and clk_parent_data (not scored)
- [CVE-2026-98666](https://insights.sbomify.com/CVE-2026-98666/): iio: gyro: adis16136: fix unprotected debugfs reads (not scored)
- [CVE-2026-98665](https://insights.sbomify.com/CVE-2026-98665/): iio: health: max30102: fix NULL dereference in interrupt handler (not scored)
- [CVE-2026-98664](https://insights.sbomify.com/CVE-2026-98664/): iio: imu: adis16400: fix unprotected debugfs reads (not scored)
- [CVE-2026-98663](https://insights.sbomify.com/CVE-2026-98663/): iio: imu: adis16480: fix unprotected debugfs reads (not scored)
- [CVE-2026-98662](https://insights.sbomify.com/CVE-2026-98662/): iio: light: gp2ap020a00f: drain irq_work after free_irq (not scored)
- [CVE-2026-98661](https://insights.sbomify.com/CVE-2026-98661/): iio: light: rohm-bu27034: Fix infinite delay on error (not scored)
- [CVE-2026-98660](https://insights.sbomify.com/CVE-2026-98660/): iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup (not scored)
- [CVE-2026-98659](https://insights.sbomify.com/CVE-2026-98659/): iio: pressure: rohm-bm1390: Return error when read fails (not scored)
- [CVE-2026-98658](https://insights.sbomify.com/CVE-2026-98658/): iio: proximity: aw96103: validate firmware data length (not scored)
- [CVE-2026-98657](https://insights.sbomify.com/CVE-2026-98657/): iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure (not scored)
- [CVE-2026-98656](https://insights.sbomify.com/CVE-2026-98656/): iio: trigger: cancel reenable_work before freeing trigger (not scored)
- [CVE-2026-98655](https://insights.sbomify.com/CVE-2026-98655/): perf: Require kernel access for text poke events (not scored)
- [CVE-2026-98653](https://insights.sbomify.com/CVE-2026-98653/): KVM: s390: Fix _gaccess_shadow_fault() (not scored)
- [CVE-2026-98652](https://insights.sbomify.com/CVE-2026-98652/): KVM: s390: Add missing srcu in kvm_s390_set_irq_state() (not scored)
- [CVE-2026-98651](https://insights.sbomify.com/CVE-2026-98651/): KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key() (not scored)
- [CVE-2026-98650](https://insights.sbomify.com/CVE-2026-98650/): KVM: s390: Fix potential races in dat skey functions (not scored)
- [CVE-2026-98649](https://insights.sbomify.com/CVE-2026-98649/): KVM: s390: Fix race in _destroy_pages_crste() (not scored)
- [CVE-2026-98648](https://insights.sbomify.com/CVE-2026-98648/): s390/uv: Prevent potential out-of-bounds read (not scored)
- [CVE-2026-98647](https://insights.sbomify.com/CVE-2026-98647/): bpf: Fix divide-by-zero in btf_struct_walk() (not scored)
- [CVE-2026-98646](https://insights.sbomify.com/CVE-2026-98646/): tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context (not scored)
- [CVE-2026-98645](https://insights.sbomify.com/CVE-2026-98645/): HID: winwing: fix use-after-free in force feedback teardown (not scored)
- [CVE-2026-98644](https://insights.sbomify.com/CVE-2026-98644/): bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch() (not scored)
- [CVE-2026-98643](https://insights.sbomify.com/CVE-2026-98643/): bpf: Fix out-of-bounds read of rtt_min in sock_ops (not scored)
- [CVE-2026-98642](https://insights.sbomify.com/CVE-2026-98642/): bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk (not scored)
- [CVE-2026-98641](https://insights.sbomify.com/CVE-2026-98641/): bpf, arm64: set up the frame pointer for the exception callback (not scored)
- [CVE-2026-98640](https://insights.sbomify.com/CVE-2026-98640/): HID: amd_sfh: Validate PCI BAR size before mapping (not scored)
- [CVE-2026-9864](https://insights.sbomify.com/CVE-2026-9864/): Fortra BoKS Server Agent adjoin machine-account password generation vulnerability (medium 4.8)
- [CVE-2026-98639](https://insights.sbomify.com/CVE-2026-98639/): KVM: riscv: Fix NACL hfence entry update order (not scored)
- [CVE-2026-98638](https://insights.sbomify.com/CVE-2026-98638/): KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve() (not scored)
- [CVE-2026-98637](https://insights.sbomify.com/CVE-2026-98637/): KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure (not scored)
- [CVE-2026-98636](https://insights.sbomify.com/CVE-2026-98636/): squashfs: Add dictionary size range check to prevent shift-out-of-bounds (not scored)
- [CVE-2026-98635](https://insights.sbomify.com/CVE-2026-98635/): scsi: block: Fix zones_cond out-of-bounds write on zone report (not scored)
- [CVE-2026-98634](https://insights.sbomify.com/CVE-2026-98634/): scsi: sd_zbc: Reject disks with too many zones (not scored)
- [CVE-2026-98633](https://insights.sbomify.com/CVE-2026-98633/): Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() (not scored)
- [CVE-2026-98632](https://insights.sbomify.com/CVE-2026-98632/): Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel (not scored)
- [CVE-2026-98631](https://insights.sbomify.com/CVE-2026-98631/): xsk: Use a 32-bit compare in xsk_map_gen_lookup (not scored)
- [CVE-2026-98630](https://insights.sbomify.com/CVE-2026-98630/): eth: fbnic: Fix payload page pool error cleanup (not scored)
- [CVE-2026-9863](https://insights.sbomify.com/CVE-2026-9863/): Core Privileged Access Manager (BoKS) upgrade tooling command injection vulnerability (high 7.5)
- [CVE-2026-98629](https://insights.sbomify.com/CVE-2026-98629/): net/sched: cls_u32: fix manual hash table handle IDR aliasing (not scored)
- [CVE-2026-98628](https://insights.sbomify.com/CVE-2026-98628/): bpf: Make post-verification instruction rewrites killable (not scored)
- [CVE-2026-98627](https://insights.sbomify.com/CVE-2026-98627/): bpf: Preserve packet pointer class displacement in regsafe() (not scored)
- [CVE-2026-98626](https://insights.sbomify.com/CVE-2026-98626/): bpf: Restrict CO-RE poisoning to relocatable instructions (not scored)
- [CVE-2026-98625](https://insights.sbomify.com/CVE-2026-98625/): netfilter: flowtable: publish HW_DEAD after worker is done (not scored)
- [CVE-2026-98624](https://insights.sbomify.com/CVE-2026-98624/): netfilter: nfnetlink_queue: hold nfnl mutex in event notifier (not scored)
- [CVE-2026-98623](https://insights.sbomify.com/CVE-2026-98623/): drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update (not scored)
- [CVE-2026-98622](https://insights.sbomify.com/CVE-2026-98622/): net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure (not scored)
- [CVE-2026-98621](https://insights.sbomify.com/CVE-2026-98621/): net: gue: reject invalid REMCSUM offsets (not scored)
- [CVE-2026-98620](https://insights.sbomify.com/CVE-2026-98620/): net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure (not scored)
- [CVE-2026-9862](https://insights.sbomify.com/CVE-2026-9862/): Core Privileged Access Manager (BoKS) autoregistration service command injection vulnerability (critical 9.8)
- [CVE-2026-98619](https://insights.sbomify.com/CVE-2026-98619/): net: ethtool: keep rtnl_lock for the ioctl self test (not scored)
- [CVE-2026-98618](https://insights.sbomify.com/CVE-2026-98618/): eth: fbnic: Handle maximum standalone channels (not scored)
- [CVE-2026-98617](https://insights.sbomify.com/CVE-2026-98617/): eth: fbnic: use the Rx queue napi pointer to find the napi vector (not scored)
- [CVE-2026-98616](https://insights.sbomify.com/CVE-2026-98616/): eth: fbnic: reset num_napi when the napi vectors are freed (not scored)
- [CVE-2026-98615](https://insights.sbomify.com/CVE-2026-98615/): eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox (not scored)
- [CVE-2026-98614](https://insights.sbomify.com/CVE-2026-98614/): sctp: avoid livelock while updating retransmit path (not scored)
- [CVE-2026-98613](https://insights.sbomify.com/CVE-2026-98613/): bpf: Bound ownership depth through local kptrs and graph roots (not scored)
- [CVE-2026-98612](https://insights.sbomify.com/CVE-2026-98612/): net: usb: catc: bound the RX packet length in catc_rx_done() (not scored)
- [CVE-2026-98611](https://insights.sbomify.com/CVE-2026-98611/): bpf: Check params size before reading reserved fields (not scored)
- [CVE-2026-98610](https://insights.sbomify.com/CVE-2026-98610/): net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget (not scored)
- [CVE-2026-98609](https://insights.sbomify.com/CVE-2026-98609/): drm/virtio: fix object leak when drm_gem_handle_create() fails (not scored)
- [CVE-2026-98608](https://insights.sbomify.com/CVE-2026-98608/): drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() (not scored)
- [CVE-2026-98607](https://insights.sbomify.com/CVE-2026-98607/): drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() (not scored)
- [CVE-2026-98606](https://insights.sbomify.com/CVE-2026-98606/): drm/virtio: release the GEM object on virtio_gpu_vram_create() errors (not scored)
- [CVE-2026-98605](https://insights.sbomify.com/CVE-2026-98605/): drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach (not scored)
- [CVE-2026-98604](https://insights.sbomify.com/CVE-2026-98604/): ovpn: replace bind when learning local endpoint (not scored)
- [CVE-2026-98603](https://insights.sbomify.com/CVE-2026-98603/): ovpn: replace bind when clearing stale local source (not scored)
- [CVE-2026-98602](https://insights.sbomify.com/CVE-2026-98602/): Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough (not scored)
- [CVE-2026-98601](https://insights.sbomify.com/CVE-2026-98601/): Bluetooth: btintel_pcie: validate device-supplied DMA indices (not scored)
- [CVE-2026-98600](https://insights.sbomify.com/CVE-2026-98600/): Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (not scored)
- [CVE-2026-9860](https://insights.sbomify.com/CVE-2026-9860/): Code injection in Offload, AI & Optimize with Cloudflare Images (high 8.8)
- [CVE-2026-98599](https://insights.sbomify.com/CVE-2026-98599/): bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (not scored)
- [CVE-2026-98598](https://insights.sbomify.com/CVE-2026-98598/): ipv6: Prevent rt6_insert_exception() for dying fib6_info. (not scored)
- [CVE-2026-98597](https://insights.sbomify.com/CVE-2026-98597/): net: usb: sr9700: include receive overhead in the length check (not scored)
- [CVE-2026-98596](https://insights.sbomify.com/CVE-2026-98596/): ipv6: Fix dst leak for uncached routes. (not scored)
- [CVE-2026-98595](https://insights.sbomify.com/CVE-2026-98595/): udp: remove a disconnected socket from the 4-tuple hash table (not scored)
- [CVE-2026-98594](https://insights.sbomify.com/CVE-2026-98594/): tg3: clean up PHYLIB resources on probe failure (not scored)
- [CVE-2026-98593](https://insights.sbomify.com/CVE-2026-98593/): s390/debug: Fix NULL pointer dereference in debug_info_copy() (not scored)
- [CVE-2026-98592](https://insights.sbomify.com/CVE-2026-98592/): net: spacemit: clear TX descriptor on fragment mapping failure (not scored)
- [CVE-2026-98591](https://insights.sbomify.com/CVE-2026-98591/): bpf: Fix bounds check for skb-backed dynptrs (not scored)
- [CVE-2026-98590](https://insights.sbomify.com/CVE-2026-98590/): bpf: Fix bpf_sock context code generation (not scored)
- [CVE-2026-9859](https://insights.sbomify.com/CVE-2026-9859/): Missing authorization in Mattermost (medium 6.5)
- [CVE-2026-98589](https://insights.sbomify.com/CVE-2026-98589/): bpf: Reject pkt arguments in mutating subprogs (not scored)
- [CVE-2026-98588](https://insights.sbomify.com/CVE-2026-98588/): bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (not scored)
- [CVE-2026-98587](https://insights.sbomify.com/CVE-2026-98587/): firewire: cdev: fix back-transition for iso_resource_auto client resource (not scored)
- [CVE-2026-98586](https://insights.sbomify.com/CVE-2026-98586/): sctp: hold asoc or transport before mod_timer() in timer handlers (not scored)
- [CVE-2026-98585](https://insights.sbomify.com/CVE-2026-98585/): eth: fbnic: Avoid rounding zero ring sizes (not scored)
- [CVE-2026-98584](https://insights.sbomify.com/CVE-2026-98584/): net/sched: fix potential stack infoleak in em_text_dump() (not scored)
- [CVE-2026-98583](https://insights.sbomify.com/CVE-2026-98583/): nfc: nfcmrvl: validate helper command length before pull (not scored)
- [CVE-2026-98582](https://insights.sbomify.com/CVE-2026-98582/): nfc: st21nfca: validate received frame size (not scored)
- [CVE-2026-98581](https://insights.sbomify.com/CVE-2026-98581/): nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (not scored)
- [CVE-2026-98580](https://insights.sbomify.com/CVE-2026-98580/): nfc: llcp: Fix race condition in accept_queue lifecycle (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/206/