# Vulnerabilities published in 2026


- [CVE-2026-98391](https://insights.sbomify.com/CVE-2026-98391/): drm/xe: Guard page-fault worker with runtime PM check (not scored)
- [CVE-2026-98390](https://insights.sbomify.com/CVE-2026-98390/): x86/amd_node: Avoid divide by zero on virtualized systems (not scored)
- [CVE-2026-98389](https://insights.sbomify.com/CVE-2026-98389/): drm/amdgpu: skip gfx switch_power_profile during GPU reset (not scored)
- [CVE-2026-98388](https://insights.sbomify.com/CVE-2026-98388/): exec: do_close_on_exec() before taking exec_update_lock (not scored)
- [CVE-2026-98387](https://insights.sbomify.com/CVE-2026-98387/): s390/crypto: Fix skcipher_walk return code handling in aes_s390 (not scored)
- [CVE-2026-98386](https://insights.sbomify.com/CVE-2026-98386/): scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot (not scored)
- [CVE-2026-98385](https://insights.sbomify.com/CVE-2026-98385/): sched/cache: Decouple sched_cache_group from mm to fix UAF (high 7.8)
- [CVE-2026-98384](https://insights.sbomify.com/CVE-2026-98384/): bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy() (not scored)
- [CVE-2026-98383](https://insights.sbomify.com/CVE-2026-98383/): bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL (high 7.8)
- [CVE-2026-98382](https://insights.sbomify.com/CVE-2026-98382/): bpf: Reject dev-bound-only programs on other devices (high 7.8)
- [CVE-2026-98381](https://insights.sbomify.com/CVE-2026-98381/): veth: manage XDP program pointers during channel resize (high 7.8)
- [CVE-2026-98380](https://insights.sbomify.com/CVE-2026-98380/): net/sched: reject IDR error pointers when deleting actions (not scored)
- [CVE-2026-9838](https://insights.sbomify.com/CVE-2026-9838/): ICS Calendar <= 12.0.9 - Reflected Cross-Site Scripting via 'htmltagtitle' Parameter (medium 6.1)
- [CVE-2026-98379](https://insights.sbomify.com/CVE-2026-98379/): netfilter: ip6t_rpfilter: reject routes without inet6_dev (not scored)
- [CVE-2026-98378](https://insights.sbomify.com/CVE-2026-98378/): bpf: Skip unsettled links in link iterator (high 7.8)
- [CVE-2026-98377](https://insights.sbomify.com/CVE-2026-98377/): vlan: require the MAC header to be present in __vlan_insert_inner_tag() (not scored)
- [CVE-2026-98376](https://insights.sbomify.com/CVE-2026-98376/): bpf: Use array_map_meta_equal for percpu array inner map replacement (high 7.8)
- [CVE-2026-98375](https://insights.sbomify.com/CVE-2026-98375/): xen/netfront: drop RX packets with a short Ethernet header (not scored)
- [CVE-2026-98374](https://insights.sbomify.com/CVE-2026-98374/): tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() (high 8.8)
- [CVE-2026-98373](https://insights.sbomify.com/CVE-2026-98373/): mm/hugetlb: preserve mremap address delta when skipping page tables (not scored)
- [CVE-2026-98372](https://insights.sbomify.com/CVE-2026-98372/): xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk() (not scored)
- [CVE-2026-98371](https://insights.sbomify.com/CVE-2026-98371/): xfrm: iptfs: fix runt reassembly panic from short inner tot_len (not scored)
- [CVE-2026-98370](https://insights.sbomify.com/CVE-2026-98370/): xfrm: fix compat ALLOCSPI request use-after-free (not scored)
- [CVE-2026-98369](https://insights.sbomify.com/CVE-2026-98369/): xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() (high 7.8)
- [CVE-2026-98368](https://insights.sbomify.com/CVE-2026-98368/): esp: downgrade zerocopy managed frags before mutating skb frags (high 7.8)
- [CVE-2026-98367](https://insights.sbomify.com/CVE-2026-98367/): RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept (high 7.8)
- [CVE-2026-98366](https://insights.sbomify.com/CVE-2026-98366/): RDMA/rxe: validate access flags before swapping the MR's PD (high 7.8)
- [CVE-2026-98365](https://insights.sbomify.com/CVE-2026-98365/): RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access (critical 9.8)
- [CVE-2026-98364](https://insights.sbomify.com/CVE-2026-98364/): xfrm: hold net_device reference under RCU in bundle creation (high 7.8)
- [CVE-2026-98363](https://insights.sbomify.com/CVE-2026-98363/): firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS (not scored)
- [CVE-2026-98362](https://insights.sbomify.com/CVE-2026-98362/): clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate (not scored)
- [CVE-2026-98361](https://insights.sbomify.com/CVE-2026-98361/): RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths (high 7.8)
- [CVE-2026-98360](https://insights.sbomify.com/CVE-2026-98360/): RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds (high 7.0)
- [CVE-2026-9836](https://insights.sbomify.com/CVE-2026-9836/): IBM DataStage Flow Designer application is affected by an information disclosure vulnerability (low 3.5)
- [CVE-2026-98359](https://insights.sbomify.com/CVE-2026-98359/): RDMA/core: Reject unregistering netdevs in ib_get_eth_speed (high 7.0)
- [CVE-2026-98358](https://insights.sbomify.com/CVE-2026-98358/): IB/iser: reject a remote invalidation of an unregistered direction (not scored)
- [CVE-2026-98357](https://insights.sbomify.com/CVE-2026-98357/): IB/isert: wait for deferred control PDU completions before releasing the connection (high 8.1)
- [CVE-2026-98356](https://insights.sbomify.com/CVE-2026-98356/): RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup (not scored)
- [CVE-2026-98355](https://insights.sbomify.com/CVE-2026-98355/): RDMA/rtrs: guard against null kobj name (not scored)
- [CVE-2026-98354](https://insights.sbomify.com/CVE-2026-98354/): RDMA/mad: Fix receive buffer leak when PKey enforcement fails (not scored)
- [CVE-2026-98353](https://insights.sbomify.com/CVE-2026-98353/): RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables (not scored)
- [CVE-2026-98352](https://insights.sbomify.com/CVE-2026-98352/): RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted (not scored)
- [CVE-2026-98351](https://insights.sbomify.com/CVE-2026-98351/): wifi: virt_wifi: free skb when disconnected (not scored)
- [CVE-2026-98350](https://insights.sbomify.com/CVE-2026-98350/): wifi: brcmfmac: cyw: pass PMKID to firmware if present (not scored)
- [CVE-2026-98349](https://insights.sbomify.com/CVE-2026-98349/): wifi: libipw: reject too-short beacon and probe responses (high 7.1)
- [CVE-2026-98348](https://insights.sbomify.com/CVE-2026-98348/): wifi: libipw: reject too-short association responses (high 7.1)
- [CVE-2026-98347](https://insights.sbomify.com/CVE-2026-98347/): IB/IPoIB: Avoid restoring OPER_UP after multicast flush (not scored)
- [CVE-2026-98346](https://insights.sbomify.com/CVE-2026-98346/): wifi: cfg80211: don't get the radio mask for netdev-less wdevs (not scored)
- [CVE-2026-98345](https://insights.sbomify.com/CVE-2026-98345/): wifi: cfg80211: check IP header size in cfg80211_classify8021d() (not scored)
- [CVE-2026-98344](https://insights.sbomify.com/CVE-2026-98344/): dmaengine: Fix device kref underflow in dma_chan_put() (not scored)
- [CVE-2026-98343](https://insights.sbomify.com/CVE-2026-98343/): dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() (not scored)
- [CVE-2026-98342](https://insights.sbomify.com/CVE-2026-98342/): dmaengine: wait for RCU readers before releasing dma_device (not scored)
- [CVE-2026-98341](https://insights.sbomify.com/CVE-2026-98341/): wifi: cfg80211: don't free driver-owned scan requests (high 7.8)
- [CVE-2026-98340](https://insights.sbomify.com/CVE-2026-98340/): wifi: cfg80211: only group hidden BSSes with beacon entries (not scored)
- [CVE-2026-9834](https://insights.sbomify.com/CVE-2026-9834/): WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter (high 7.2)
- [CVE-2026-98339](https://insights.sbomify.com/CVE-2026-98339/): wifi: cfg80211: don't filter by BSS type when removing stale entries (high 8.8)
- [CVE-2026-98338](https://insights.sbomify.com/CVE-2026-98338/): wifi: cfg80211: ibss: ref BSS entry for joined event (not scored)
- [CVE-2026-98337](https://insights.sbomify.com/CVE-2026-98337/): wifi: mac80211: don't start a ROC while scanning (not scored)
- [CVE-2026-98336](https://insights.sbomify.com/CVE-2026-98336/): wifi: mac80211: don't offload TC setup on AP_VLAN interfaces (not scored)
- [CVE-2026-98335](https://insights.sbomify.com/CVE-2026-98335/): wifi: mac80211: abort chanswitch when leaving a mesh (not scored)
- [CVE-2026-98334](https://insights.sbomify.com/CVE-2026-98334/): wifi: mac80211: reset state when starting AP fails (not scored)
- [CVE-2026-98333](https://insights.sbomify.com/CVE-2026-98333/): wifi: mac80211: reset the LED state when ifup fails (not scored)
- [CVE-2026-98332](https://insights.sbomify.com/CVE-2026-98332/): wifi: mac80211: only operate on TDLS peers in the TDLS code (not scored)
- [CVE-2026-98331](https://insights.sbomify.com/CVE-2026-98331/): wifi: mac80211: unlist vifs when their netdev is unregistered (high 7.0)
- [CVE-2026-98330](https://insights.sbomify.com/CVE-2026-98330/): wifi: cfg80211: get the wiphy out of a dying network namespace (high 7.0)
- [CVE-2026-9833](https://insights.sbomify.com/CVE-2026-9833/): Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter (high 7.1)
- [CVE-2026-98329](https://insights.sbomify.com/CVE-2026-98329/): wifi: mac80211: don't allow injecting frames wider than the chanctx (not scored)
- [CVE-2026-98328](https://insights.sbomify.com/CVE-2026-98328/): wifi: mac80211: add HE 6 GHz capability in the scan elems len (not scored)
- [CVE-2026-98327](https://insights.sbomify.com/CVE-2026-98327/): wifi: mac80211: mesh: reset the CSA state when leaving (not scored)
- [CVE-2026-98326](https://insights.sbomify.com/CVE-2026-98326/): wifi: mac80211: mesh: release the channel if start fails (not scored)
- [CVE-2026-98325](https://insights.sbomify.com/CVE-2026-98325/): wifi: mac80211: set up the TX info early to fix failure paths (not scored)
- [CVE-2026-98324](https://insights.sbomify.com/CVE-2026-98324/): dmaengine: pxa: fix double counting of the hw descriptors (high 7.8)
- [CVE-2026-98323](https://insights.sbomify.com/CVE-2026-98323/): RDMA/siw: Bound fragmented header copies by the remaining length (critical 9.8)
- [CVE-2026-98322](https://insights.sbomify.com/CVE-2026-98322/): netfilter: nft_nat: fully initialise new_addr in netmap setup (not scored)
- [CVE-2026-98321](https://insights.sbomify.com/CVE-2026-98321/): netfilter: nf_nat: unregister and release hooks on error (not scored)
- [CVE-2026-98320](https://insights.sbomify.com/CVE-2026-98320/): netfilter: flowtable: hold reference on ct until flow is released (high 7.8)
- [CVE-2026-9832](https://insights.sbomify.com/CVE-2026-9832/): Security feature bypass in Payment Gateway of Stripe for WooCommerce (medium 5.3)
- [CVE-2026-98319](https://insights.sbomify.com/CVE-2026-98319/): drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr (not scored)
- [CVE-2026-98318](https://insights.sbomify.com/CVE-2026-98318/): smb: client: validate absolute native symlink targets before NT fixups (high 7.8)
- [CVE-2026-98317](https://insights.sbomify.com/CVE-2026-98317/): neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS. (not scored)
- [CVE-2026-98316](https://insights.sbomify.com/CVE-2026-98316/): ALSA: bcd2000: Fix race between rawmidi and disconnect (not scored)
- [CVE-2026-98315](https://insights.sbomify.com/CVE-2026-98315/): ntfs: protect runlist updates with the runlist lock (high 7.8)
- [CVE-2026-98314](https://insights.sbomify.com/CVE-2026-98314/): ALSA: pcm: set timer->private_data before registering the PCM timer (not scored)
- [CVE-2026-98313](https://insights.sbomify.com/CVE-2026-98313/): drm/msm/dp: skip PUSH_IDLE when the link was never enabled (not scored)
- [CVE-2026-98312](https://insights.sbomify.com/CVE-2026-98312/): ALSA: 6fire: fix OOB write from device-reported iso length (not scored)
- [CVE-2026-98311](https://insights.sbomify.com/CVE-2026-98311/): wifi: virt_wifi: don't transfer operstate before register (high 7.8)
- [CVE-2026-98310](https://insights.sbomify.com/CVE-2026-98310/): drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory (not scored)
- [CVE-2026-9831](https://insights.sbomify.com/CVE-2026-9831/): ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition (medium 6.3)
- [CVE-2026-98309](https://insights.sbomify.com/CVE-2026-98309/): drm/vc4: Use managed KMS polling to fix UAF on unbind (not scored)
- [CVE-2026-98308](https://insights.sbomify.com/CVE-2026-98308/): ALSA: hda: trace PCM open only after assigning a stream (not scored)
- [CVE-2026-98307](https://insights.sbomify.com/CVE-2026-98307/): wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all() (not scored)
- [CVE-2026-98306](https://insights.sbomify.com/CVE-2026-98306/): seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation (not scored)
- [CVE-2026-98305](https://insights.sbomify.com/CVE-2026-98305/): net: dsa: mxl862xx: disable the stats poll on teardown (high 7.8)
- [CVE-2026-98304](https://insights.sbomify.com/CVE-2026-98304/): net: bcmgenet: restore the hardware filters on open (not scored)
- [CVE-2026-98303](https://insights.sbomify.com/CVE-2026-98303/): ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup (not scored)
- [CVE-2026-98302](https://insights.sbomify.com/CVE-2026-98302/): net: fddi: skfp: fix NULL deref when setting the MAC address while down (not scored)
- [CVE-2026-98301](https://insights.sbomify.com/CVE-2026-98301/): net: bridge: mst: move switchdev call outside rcu (not scored)
- [CVE-2026-98300](https://insights.sbomify.com/CVE-2026-98300/): tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv(). (not scored)
- [CVE-2026-9830](https://insights.sbomify.com/CVE-2026-9830/): BookingPress Pro < 5.7.3 - Unauthenticated Customer PII Disclosure and Booking Tampering via Permission Callback Bug (high 8.2)
- [CVE-2026-98299](https://insights.sbomify.com/CVE-2026-98299/): tcp: do not let tcp_rmem be set below 4096 (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/209/