# Vulnerabilities published in 2026


- [CVE-2026-98487](https://insights.sbomify.com/CVE-2026-98487/): net: bridge: mdb: restart port group walk after deletion (high 7.8)
- [CVE-2026-98486](https://insights.sbomify.com/CVE-2026-98486/): net: ena: fix MMIO read buffer leak on probe failure (not scored)
- [CVE-2026-98485](https://insights.sbomify.com/CVE-2026-98485/): netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (high 7.1)
- [CVE-2026-98484](https://insights.sbomify.com/CVE-2026-98484/): netfilter: nf_tables: skip expired catchall elements on insert and delete (not scored)
- [CVE-2026-98483](https://insights.sbomify.com/CVE-2026-98483/): nfc: fix use-after-free in nfc_get_local_general_bytes (not scored)
- [CVE-2026-98482](https://insights.sbomify.com/CVE-2026-98482/): nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (not scored)
- [CVE-2026-98481](https://insights.sbomify.com/CVE-2026-98481/): nfc: port100: reject frames whose declared length exceeds the received data (not scored)
- [CVE-2026-98480](https://insights.sbomify.com/CVE-2026-98480/): nfc: trf7970a: power down on startup RX gain failure (not scored)
- [CVE-2026-9848](https://insights.sbomify.com/CVE-2026-9848/): WP Ticket <= 6.0.4 - Unauthenticated SQL Injection via WordPress Search 's' Parameter (high 7.5)
- [CVE-2026-98479](https://insights.sbomify.com/CVE-2026-98479/): scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (high 7.5)
- [CVE-2026-98478](https://insights.sbomify.com/CVE-2026-98478/): scsi: ufs: core: Keep internal commands dispatchable during error handling (not scored)
- [CVE-2026-98477](https://insights.sbomify.com/CVE-2026-98477/): perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() (not scored)
- [CVE-2026-98476](https://insights.sbomify.com/CVE-2026-98476/): s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (not scored)
- [CVE-2026-98475](https://insights.sbomify.com/CVE-2026-98475/): s390/cmf: Fix virtual vs physical address confusion (not scored)
- [CVE-2026-98474](https://insights.sbomify.com/CVE-2026-98474/): s390/pci: Fix missing device lock in zpci_report_status() (not scored)
- [CVE-2026-98473](https://insights.sbomify.com/CVE-2026-98473/): s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (not scored)
- [CVE-2026-98472](https://insights.sbomify.com/CVE-2026-98472/): KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV (not scored)
- [CVE-2026-98471](https://insights.sbomify.com/CVE-2026-98471/): KVM: SEV: Do cache maintenance on the source VM during intra-host migration (high 7.1)
- [CVE-2026-98470](https://insights.sbomify.com/CVE-2026-98470/): KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode (not scored)
- [CVE-2026-98469](https://insights.sbomify.com/CVE-2026-98469/): KVM: arm64: Fix AArch32 DBGBXVR<n> handling (high 7.1)
- [CVE-2026-98468](https://insights.sbomify.com/CVE-2026-98468/): KVM: arm64: Fix spurious warning for benign stage 2 teardown race (not scored)
- [CVE-2026-98467](https://insights.sbomify.com/CVE-2026-98467/): KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race (not scored)
- [CVE-2026-98466](https://insights.sbomify.com/CVE-2026-98466/): KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (high 8.2)
- [CVE-2026-98465](https://insights.sbomify.com/CVE-2026-98465/): RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (high 7.0)
- [CVE-2026-98464](https://insights.sbomify.com/CVE-2026-98464/): RISC-V: KVM: Synchronize hrtimer callback during teardown (critical 9.3)
- [CVE-2026-98463](https://insights.sbomify.com/CVE-2026-98463/): sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags (not scored)
- [CVE-2026-98462](https://insights.sbomify.com/CVE-2026-98462/): Bluetooth: hci_conn: fix CIS hold ownership on reuse (not scored)
- [CVE-2026-98461](https://insights.sbomify.com/CVE-2026-98461/): Bluetooth: hci_sock: validate event length before filtering (not scored)
- [CVE-2026-98460](https://insights.sbomify.com/CVE-2026-98460/): Bluetooth: hci_sock: reject out-of-range OCF values (not scored)
- [CVE-2026-98459](https://insights.sbomify.com/CVE-2026-98459/): Bluetooth: ISO: balance the parent hold in hci_bind_bis() (not scored)
- [CVE-2026-98458](https://insights.sbomify.com/CVE-2026-98458/): Bluetooth: ISO: release unused CIS holds after channel attach (not scored)
- [CVE-2026-98457](https://insights.sbomify.com/CVE-2026-98457/): Bluetooth: L2CAP: validate frame length before control and FCS access (not scored)
- [CVE-2026-98456](https://insights.sbomify.com/CVE-2026-98456/): Bluetooth: mgmt: fix race in read_unconf_index_list() (high 7.0)
- [CVE-2026-98455](https://insights.sbomify.com/CVE-2026-98455/): Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO (not scored)
- [CVE-2026-98454](https://insights.sbomify.com/CVE-2026-98454/): smb: client: fix create context out-of-bounds reads (high 8.1)
- [CVE-2026-98453](https://insights.sbomify.com/CVE-2026-98453/): smb: client: close handle after create-context parsing failure (not scored)
- [CVE-2026-98452](https://insights.sbomify.com/CVE-2026-98452/): smb: client: clean up failed cached directory opens (not scored)
- [CVE-2026-98451](https://insights.sbomify.com/CVE-2026-98451/): smb: client: use finish_no_open() for non-regular inodes (high 8.8)
- [CVE-2026-98450](https://insights.sbomify.com/CVE-2026-98450/): smb: client: close completed creates on compound wait errors (not scored)
- [CVE-2026-98449](https://insights.sbomify.com/CVE-2026-98449/): smb: client: delete compound mids on send failure before unlock (not scored)
- [CVE-2026-98448](https://insights.sbomify.com/CVE-2026-98448/): xfs: release orphanage dir inode if chown fails (not scored)
- [CVE-2026-98447](https://insights.sbomify.com/CVE-2026-98447/): xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots (not scored)
- [CVE-2026-98446](https://insights.sbomify.com/CVE-2026-98446/): xfs: don't let hidden_space go negative in xfs_metafile_resv_init (not scored)
- [CVE-2026-98445](https://insights.sbomify.com/CVE-2026-98445/): xfs: don't let memory failures leak blocks and kill repairs (not scored)
- [CVE-2026-98444](https://insights.sbomify.com/CVE-2026-98444/): xfs: drop dquot flush lock when we can't find a buffer to flush (not scored)
- [CVE-2026-98443](https://insights.sbomify.com/CVE-2026-98443/): xfs: fix cursor and pointer handling when recovering iunlink buckets (high 7.8)
- [CVE-2026-98442](https://insights.sbomify.com/CVE-2026-98442/): net/sched: act_ct: fix helper UAF due to extensions realloc (high 7.8)
- [CVE-2026-98441](https://insights.sbomify.com/CVE-2026-98441/): net/sched: act_ct: avoid modifying shared unconfirmed ct entry (high 7.8)
- [CVE-2026-98440](https://insights.sbomify.com/CVE-2026-98440/): KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (high 7.0)
- [CVE-2026-9844](https://insights.sbomify.com/CVE-2026-9844/): Vulnerability in navify® Digital Pathology (high 8.8)
- [CVE-2026-98439](https://insights.sbomify.com/CVE-2026-98439/): smb/server: cancel async requests when closing connection (not scored)
- [CVE-2026-98438](https://insights.sbomify.com/CVE-2026-98438/): mptcp: options: fix uninit-value in mptcp_write_data_fin (not scored)
- [CVE-2026-98437](https://insights.sbomify.com/CVE-2026-98437/): media: qcom: iris: fix runtime PM reference leaks (not scored)
- [CVE-2026-98436](https://insights.sbomify.com/CVE-2026-98436/): accel/amdxdna: Disable device buffer exporting (high 7.8)
- [CVE-2026-98435](https://insights.sbomify.com/CVE-2026-98435/): EDAC/altera: Use parent device for devres in altr_portb_setup() (not scored)
- [CVE-2026-98434](https://insights.sbomify.com/CVE-2026-98434/): sysctl: Check range in proc_dointvec_ms_jiffies_minmax (not scored)
- [CVE-2026-98433](https://insights.sbomify.com/CVE-2026-98433/): KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (not scored)
- [CVE-2026-98432](https://insights.sbomify.com/CVE-2026-98432/): ipv4: free inet_opt and ireq_opt after an RCU grace period (critical 9.8)
- [CVE-2026-98431](https://insights.sbomify.com/CVE-2026-98431/): RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency (not scored)
- [CVE-2026-98430](https://insights.sbomify.com/CVE-2026-98430/): RDMA/efa: Keep admin queues alive while IRQ is registered (not scored)
- [CVE-2026-9843](https://insights.sbomify.com/CVE-2026-9843/): Path traversal in Database for Contact Form 7, WPforms, Elementor forms (high 8.1)
- [CVE-2026-98429](https://insights.sbomify.com/CVE-2026-98429/): RDMA/efa: Keep EQ resources alive while IRQ is registered (not scored)
- [CVE-2026-98428](https://insights.sbomify.com/CVE-2026-98428/): ALSA: usb: 6fire: Avoid embedded URBs (not scored)
- [CVE-2026-98427](https://insights.sbomify.com/CVE-2026-98427/): net/sched: codel: bound the dropping loop per dequeue call (not scored)
- [CVE-2026-98426](https://insights.sbomify.com/CVE-2026-98426/): wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path (not scored)
- [CVE-2026-98425](https://insights.sbomify.com/CVE-2026-98425/): wifi: mac80211: don't warn when an IBSS has no channel to scan (not scored)
- [CVE-2026-98424](https://insights.sbomify.com/CVE-2026-98424/): wifi: cfg80211: undo netns switch if renaming the wiphy fails (not scored)
- [CVE-2026-98423](https://insights.sbomify.com/CVE-2026-98423/): wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping (not scored)
- [CVE-2026-98422](https://insights.sbomify.com/CVE-2026-98422/): wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown (not scored)
- [CVE-2026-98421](https://insights.sbomify.com/CVE-2026-98421/): wifi: mac80211: require a peer station for TDLS setup confirm (not scored)
- [CVE-2026-98420](https://insights.sbomify.com/CVE-2026-98420/): ksmbd: follow SMB2 session expiration semantics (not scored)
- [CVE-2026-9842](https://insights.sbomify.com/CVE-2026-9842/): Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities (high 7.5)
- [CVE-2026-98419](https://insights.sbomify.com/CVE-2026-98419/): drop_monitor: fix out-of-bounds write in reset_per_cpu_data() (high 7.0)
- [CVE-2026-98418](https://insights.sbomify.com/CVE-2026-98418/): sched/core: Avoid false migration warning for proxy donors (not scored)
- [CVE-2026-98417](https://insights.sbomify.com/CVE-2026-98417/): net: xfrm: reject unrepresentable espintcp transport headers (not scored)
- [CVE-2026-98416](https://insights.sbomify.com/CVE-2026-98416/): dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() (not scored)
- [CVE-2026-98415](https://insights.sbomify.com/CVE-2026-98415/): soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node (not scored)
- [CVE-2026-98414](https://insights.sbomify.com/CVE-2026-98414/): memcg: avoid charging the root memcg from obj_cgroup_charge_pages() (not scored)
- [CVE-2026-98413](https://insights.sbomify.com/CVE-2026-98413/): selinux: always fill AVC decision in avc_has_perm_noaudit() (not scored)
- [CVE-2026-98412](https://insights.sbomify.com/CVE-2026-98412/): power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new() (not scored)
- [CVE-2026-98411](https://insights.sbomify.com/CVE-2026-98411/): power: sequencing: fix NULL-pointer dereference in pwrseq_device_register() (not scored)
- [CVE-2026-98410](https://insights.sbomify.com/CVE-2026-98410/): watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog (not scored)
- [CVE-2026-98409](https://insights.sbomify.com/CVE-2026-98409/): watchdog: rtd119x: Avoid division by zero (not scored)
- [CVE-2026-98408](https://insights.sbomify.com/CVE-2026-98408/): watchdog: rzv2h: Avoid division by zero (not scored)
- [CVE-2026-98407](https://insights.sbomify.com/CVE-2026-98407/): wifi: rsi: fix heap OOB write on key removal (not scored)
- [CVE-2026-98406](https://insights.sbomify.com/CVE-2026-98406/): wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver (not scored)
- [CVE-2026-98405](https://insights.sbomify.com/CVE-2026-98405/): smb: client: fix missing iov bounds check in parse_posix_sids() (high 8.1)
- [CVE-2026-98404](https://insights.sbomify.com/CVE-2026-98404/): drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create() (not scored)
- [CVE-2026-98403](https://insights.sbomify.com/CVE-2026-98403/): s390/boot: Avoid IPL parameter append past command line (not scored)
- [CVE-2026-98402](https://insights.sbomify.com/CVE-2026-98402/): net: icmp: avoid invalid transport header access in icmp_send tracepoint (not scored)
- [CVE-2026-98401](https://insights.sbomify.com/CVE-2026-98401/): net: iptunnel: fix stale transport header during tunnel decapsulation (high 7.5)
- [CVE-2026-98400](https://insights.sbomify.com/CVE-2026-98400/): s390/ipl: Fix NULL deref in kdump without re-IPL parm block (not scored)
- [CVE-2026-98399](https://insights.sbomify.com/CVE-2026-98399/): s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block (not scored)
- [CVE-2026-98398](https://insights.sbomify.com/CVE-2026-98398/): locking/lockdep: Invalidate stale class_cache entries for zapped classes (not scored)
- [CVE-2026-98397](https://insights.sbomify.com/CVE-2026-98397/): platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown (not scored)
- [CVE-2026-98396](https://insights.sbomify.com/CVE-2026-98396/): powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare() (not scored)
- [CVE-2026-98395](https://insights.sbomify.com/CVE-2026-98395/): powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit (not scored)
- [CVE-2026-98394](https://insights.sbomify.com/CVE-2026-98394/): af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. (not scored)
- [CVE-2026-98393](https://insights.sbomify.com/CVE-2026-98393/): net: ipv4: Fix UDP length overflow with PMTU discover and big MTU (not scored)
- [CVE-2026-98392](https://insights.sbomify.com/CVE-2026-98392/): Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/208/