# Vulnerabilities published in 2026


- [CVE-2026-98298](https://insights.sbomify.com/CVE-2026-98298/): dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg() (not scored)
- [CVE-2026-98297](https://insights.sbomify.com/CVE-2026-98297/): Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (not scored)
- [CVE-2026-98296](https://insights.sbomify.com/CVE-2026-98296/): Bluetooth: btintel_pcie: validate TX skb length in send_sync (not scored)
- [CVE-2026-98295](https://insights.sbomify.com/CVE-2026-98295/): Bluetooth: coredump: Quiesce dump work on unregister (not scored)
- [CVE-2026-98294](https://insights.sbomify.com/CVE-2026-98294/): Bluetooth: hci_qca: Do not write to the serial port after it is closed (not scored)
- [CVE-2026-98293](https://insights.sbomify.com/CVE-2026-98293/): Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() (not scored)
- [CVE-2026-98292](https://insights.sbomify.com/CVE-2026-98292/): Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access (not scored)
- [CVE-2026-98291](https://insights.sbomify.com/CVE-2026-98291/): Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit (not scored)
- [CVE-2026-98290](https://insights.sbomify.com/CVE-2026-98290/): Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup (high 7.5)
- [CVE-2026-9829](https://insights.sbomify.com/CVE-2026-9829/): SQL injection in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 6.5)
- [CVE-2026-98289](https://insights.sbomify.com/CVE-2026-98289/): af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). (not scored)
- [CVE-2026-98288](https://insights.sbomify.com/CVE-2026-98288/): net: stmmac: fix TSO header length truncation (not scored)
- [CVE-2026-98287](https://insights.sbomify.com/CVE-2026-98287/): pppoatm: ensure a writable skb header and linear data (not scored)
- [CVE-2026-98286](https://insights.sbomify.com/CVE-2026-98286/): drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown (not scored)
- [CVE-2026-98285](https://insights.sbomify.com/CVE-2026-98285/): net: bridge: vlan: fix bugs caused by switchdev deletion errors (not scored)
- [CVE-2026-98284](https://insights.sbomify.com/CVE-2026-98284/): netlink: do not free nlk->groups while lockless readers can use it (not scored)
- [CVE-2026-98283](https://insights.sbomify.com/CVE-2026-98283/): KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid() (high 8.8)
- [CVE-2026-98282](https://insights.sbomify.com/CVE-2026-98282/): powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba (high 8.8)
- [CVE-2026-98281](https://insights.sbomify.com/CVE-2026-98281/): futex: Also allocate private hash on vfork() (high 7.8)
- [CVE-2026-98280](https://insights.sbomify.com/CVE-2026-98280/): drm/xe/i2c: Disable IRQ on unbind (not scored)
- [CVE-2026-9828](https://insights.sbomify.com/CVE-2026-9828/): Logback deserialization whitelist bypass for java.lang and java.util (low 2.9)
- [CVE-2026-98279](https://insights.sbomify.com/CVE-2026-98279/): btrfs: handle lack of space when cleaning up verity items (not scored)
- [CVE-2026-98278](https://insights.sbomify.com/CVE-2026-98278/): net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check (not scored)
- [CVE-2026-98277](https://insights.sbomify.com/CVE-2026-98277/): eth: fbnic: ring the doorbell if a burst ends in a drop (not scored)
- [CVE-2026-98276](https://insights.sbomify.com/CVE-2026-98276/): net: lock the socket in sock_gettstamp() (high 7.8)
- [CVE-2026-98275](https://insights.sbomify.com/CVE-2026-98275/): net: ethernet: cortina: Ack RX overrun interrupt correctly (not scored)
- [CVE-2026-98274](https://insights.sbomify.com/CVE-2026-98274/): net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() (not scored)
- [CVE-2026-98273](https://insights.sbomify.com/CVE-2026-98273/): x86/kprobes: Fix crash when probing CS CALL instructions (not scored)
- [CVE-2026-98272](https://insights.sbomify.com/CVE-2026-98272/): net: mvpp2: prevent buffer overflow in page_pool allocation (not scored)
- [CVE-2026-98271](https://insights.sbomify.com/CVE-2026-98271/): net: skbuff: do not leave stale header offsets after pskb_carve() (not scored)
- [CVE-2026-98270](https://insights.sbomify.com/CVE-2026-98270/): drm/amdgpu: check ras and obj before dereference (not scored)
- [CVE-2026-9827](https://insights.sbomify.com/CVE-2026-9827/): Path traversal in Totolink (critical 9.1)
- [CVE-2026-98269](https://insights.sbomify.com/CVE-2026-98269/): btrfs: abort transaction on failure to update inode for hole punching and reflinking (not scored)
- [CVE-2026-98268](https://insights.sbomify.com/CVE-2026-98268/): perf: Fix null pointer access in is_include_guest_event() (not scored)
- [CVE-2026-98267](https://insights.sbomify.com/CVE-2026-98267/): 9p: Fix v9fs_issue_write() to update i_size and remote_i_size (not scored)
- [CVE-2026-98266](https://insights.sbomify.com/CVE-2026-98266/): ALSA: core: Fix potential UAF after asynchronous card release (not scored)
- [CVE-2026-98265](https://insights.sbomify.com/CVE-2026-98265/): ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity (not scored)
- [CVE-2026-98264](https://insights.sbomify.com/CVE-2026-98264/): ALSA: virtio: reset device before deleting virtqueues (not scored)
- [CVE-2026-98263](https://insights.sbomify.com/CVE-2026-98263/): ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type (not scored)
- [CVE-2026-98262](https://insights.sbomify.com/CVE-2026-98262/): ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY (not scored)
- [CVE-2026-98261](https://insights.sbomify.com/CVE-2026-98261/): cifs: Fix server use-after-free in cifs_chan_skip_or_disable() (high 8.1)
- [CVE-2026-98260](https://insights.sbomify.com/CVE-2026-98260/): exec: Cleanup POSIX timers right after de_thread() (high 7.8)
- [CVE-2026-98259](https://insights.sbomify.com/CVE-2026-98259/): fs/dax: check zero or empty entry before converting xarray entry (not scored)
- [CVE-2026-98258](https://insights.sbomify.com/CVE-2026-98258/): posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list (high 7.8)
- [CVE-2026-98257](https://insights.sbomify.com/CVE-2026-98257/): rds: ib: use rds_conn_drop() on protocol version mismatch (high 7.5)
- [CVE-2026-98256](https://insights.sbomify.com/CVE-2026-98256/): signal: Prevent exec() race (high 7.8)
- [CVE-2026-98255](https://insights.sbomify.com/CVE-2026-98255/): tcp: exclude old ACKs from tcp fast path (not scored)
- [CVE-2026-98254](https://insights.sbomify.com/CVE-2026-98254/): swiotlb: use the adjusted address for the highmem page lookup (high 7.8)
- [CVE-2026-98253](https://insights.sbomify.com/CVE-2026-98253/): RDMA/ucma: Serialize join and leave on copy_to_user failure (high 7.8)
- [CVE-2026-98252](https://insights.sbomify.com/CVE-2026-98252/): RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() (high 7.0)
- [CVE-2026-98251](https://insights.sbomify.com/CVE-2026-98251/): openvswitch: avoid reallocating confirmed conntrack labels (high 7.8)
- [CVE-2026-98250](https://insights.sbomify.com/CVE-2026-98250/): nfsd: fix handling of NFSEXP_PNFS in the netlink codepath (not scored)
- [CVE-2026-9825](https://insights.sbomify.com/CVE-2026-9825/): IBM Cyber Fraud Reachable Assertion (low 3.7)
- [CVE-2026-98249](https://insights.sbomify.com/CVE-2026-98249/): arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc (not scored)
- [CVE-2026-98248](https://insights.sbomify.com/CVE-2026-98248/): arm64: percpu: Fix LSE operations on {8,16}-bit types (not scored)
- [CVE-2026-98247](https://insights.sbomify.com/CVE-2026-98247/): Bluetooth: hci_codec: validate vendor codec count length (not scored)
- [CVE-2026-98246](https://insights.sbomify.com/CVE-2026-98246/): Bluetooth: hci_sync: Serialize local codec list cleanup (not scored)
- [CVE-2026-98245](https://insights.sbomify.com/CVE-2026-98245/): btrfs: take commit root semaphore when iterating in mark_block_group_to_copy() (not scored)
- [CVE-2026-98244](https://insights.sbomify.com/CVE-2026-98244/): btrfs: clear free space tree creation state on rebuild failure (not scored)
- [CVE-2026-98243](https://insights.sbomify.com/CVE-2026-98243/): dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 (high 7.1)
- [CVE-2026-98242](https://insights.sbomify.com/CVE-2026-98242/): dma-buf: Fix silent overflow for phys vec to sgt (not scored)
- [CVE-2026-98241](https://insights.sbomify.com/CVE-2026-98241/): ipv6: xfrm: use full sockets in local error paths (high 7.8)
- [CVE-2026-98240](https://insights.sbomify.com/CVE-2026-98240/): net: ip_tunnel: initialize `options_len` before referencing options (not scored)
- [CVE-2026-9824](https://insights.sbomify.com/CVE-2026-9824/): Remote cluster metadata enumeration via /share-channel autocomplete (medium 4.3)
- [CVE-2026-98239](https://insights.sbomify.com/CVE-2026-98239/): net: lan743x: fix RX checksum use-after-free (high 8.1)
- [CVE-2026-98238](https://insights.sbomify.com/CVE-2026-98238/): net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb() (not scored)
- [CVE-2026-98237](https://insights.sbomify.com/CVE-2026-98237/): net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain (not scored)
- [CVE-2026-98236](https://insights.sbomify.com/CVE-2026-98236/): net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value (not scored)
- [CVE-2026-98235](https://insights.sbomify.com/CVE-2026-98235/): net/sched: act_api: release tail references on DELACTION failure (not scored)
- [CVE-2026-98234](https://insights.sbomify.com/CVE-2026-98234/): net/sched: hhf: cap hh_flows_limit at change time (not scored)
- [CVE-2026-98233](https://insights.sbomify.com/CVE-2026-98233/): net/packet: clear RX owner on VNET header error (not scored)
- [CVE-2026-98232](https://insights.sbomify.com/CVE-2026-98232/): scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable() (not scored)
- [CVE-2026-98231](https://insights.sbomify.com/CVE-2026-98231/): xfrm: serialize state GC with device state flush (not scored)
- [CVE-2026-98230](https://insights.sbomify.com/CVE-2026-98230/): xfrm: use hlist_del_init_rcu for state_cache and state_cache_input (high 7.0)
- [CVE-2026-98229](https://insights.sbomify.com/CVE-2026-98229/): xfrm: save input state data before secpath resets (high 7.8)
- [CVE-2026-98228](https://insights.sbomify.com/CVE-2026-98228/): mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ (high 7.8)
- [CVE-2026-98227](https://insights.sbomify.com/CVE-2026-98227/): memstick: ms_block: destroy io_queue workqueue on removal (not scored)
- [CVE-2026-98226](https://insights.sbomify.com/CVE-2026-98226/): mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count (not scored)
- [CVE-2026-98225](https://insights.sbomify.com/CVE-2026-98225/): mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem (not scored)
- [CVE-2026-98224](https://insights.sbomify.com/CVE-2026-98224/): mm/vma: correctly unaccount on mmap_prepare() failure (not scored)
- [CVE-2026-98223](https://insights.sbomify.com/CVE-2026-98223/): mm: filemap: retain mapped dropbehind folios (not scored)
- [CVE-2026-98222](https://insights.sbomify.com/CVE-2026-98222/): KEYS: encrypted: fix integer overflow of datablob_len (not scored)
- [CVE-2026-98221](https://insights.sbomify.com/CVE-2026-98221/): KEYS: trusted: Fix tpm2_load_cmd() boundary check (not scored)
- [CVE-2026-98220](https://insights.sbomify.com/CVE-2026-98220/): sched_ext: Fix NULL sched deref in kfunc sub-sched error paths (not scored)
- [CVE-2026-9822](https://insights.sbomify.com/CVE-2026-9822/): WP Hotel Booking < 2.3.1 - Subscriber+ Missing Authorization in Multiple AJAX Handlers (medium 6.5)
- [CVE-2026-98219](https://insights.sbomify.com/CVE-2026-98219/): sched_ext: Close the pre-enable ops error claim window (not scored)
- [CVE-2026-98218](https://insights.sbomify.com/CVE-2026-98218/): i2c: atr: fix dangling adapter pointer on add failure (not scored)
- [CVE-2026-98217](https://insights.sbomify.com/CVE-2026-98217/): IB/mlx4: Fix use-after-free on pkey sysfs registration failure (not scored)
- [CVE-2026-98216](https://insights.sbomify.com/CVE-2026-98216/): IB/hfi1: Fix the PIO_CRED credit-return mmap (high 7.1)
- [CVE-2026-98215](https://insights.sbomify.com/CVE-2026-98215/): selinux: preserve user SID across nested backing files (not scored)
- [CVE-2026-98214](https://insights.sbomify.com/CVE-2026-98214/): selinux: recheck intermediate backing files on mprotect() (not scored)
- [CVE-2026-98213](https://insights.sbomify.com/CVE-2026-98213/): mmc: core: Cancel SDIO IRQ work before freeing host (not scored)
- [CVE-2026-98212](https://insights.sbomify.com/CVE-2026-98212/): mmc: hsq: Fix use-after-free in retry work (not scored)
- [CVE-2026-98211](https://insights.sbomify.com/CVE-2026-98211/): mmc: mmci: Fix use-after-free in busy-timeout work (not scored)
- [CVE-2026-98210](https://insights.sbomify.com/CVE-2026-98210/): mmc: mxcmmc: cancel data work and watchdog on remove (not scored)
- [CVE-2026-98209](https://insights.sbomify.com/CVE-2026-98209/): mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (not scored)
- [CVE-2026-98208](https://insights.sbomify.com/CVE-2026-98208/): mmc: sdio_uart: fix xmit_fifo leak when the port table is full (not scored)
- [CVE-2026-98207](https://insights.sbomify.com/CVE-2026-98207/): mmc: spi: reset bytes_xfered before retrying CRC failures (not scored)
- [CVE-2026-98206](https://insights.sbomify.com/CVE-2026-98206/): Input: cyttsp5 - clamp the HID report size before memcpy (not scored)
- [CVE-2026-98205](https://insights.sbomify.com/CVE-2026-98205/): Input: evdev - zero absinfo before partial copy in EVIOCSABS (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/210/