# Vulnerabilities published in 2026


- [CVE-2026-98204](https://insights.sbomify.com/CVE-2026-98204/): Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() (not scored)
- [CVE-2026-98203](https://insights.sbomify.com/CVE-2026-98203/): Input: soc_button_array - check btns_desc->package.count (not scored)
- [CVE-2026-98202](https://insights.sbomify.com/CVE-2026-98202/): Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound (not scored)
- [CVE-2026-98201](https://insights.sbomify.com/CVE-2026-98201/): Input: zero ff_effect before compat copy in input_ff_effect_from_user (not scored)
- [CVE-2026-98200](https://insights.sbomify.com/CVE-2026-98200/): hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() (not scored)
- [CVE-2026-9820](https://insights.sbomify.com/CVE-2026-9820/): Mattermost schemes teams endpoint exposes private team invite IDs (low 3.8)
- [CVE-2026-98199](https://insights.sbomify.com/CVE-2026-98199/): hwmon: (pmbus/core) increase number of phases and add new mask (not scored)
- [CVE-2026-98198](https://insights.sbomify.com/CVE-2026-98198/): hwmon: (pwm-fan) Stop RPM timer before freeing tach data (not scored)
- [CVE-2026-98197](https://insights.sbomify.com/CVE-2026-98197/): hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove (high 7.0)
- [CVE-2026-98196](https://insights.sbomify.com/CVE-2026-98196/): wifi: brcmsmac: fix UAF in brcms_free_timer() (not scored)
- [CVE-2026-98195](https://insights.sbomify.com/CVE-2026-98195/): wifi: iwlegacy: fix broadcast stations deallocation (not scored)
- [CVE-2026-98194](https://insights.sbomify.com/CVE-2026-98194/): wifi: libertas_tf: fix UAF in lbtf_free_adapter() (not scored)
- [CVE-2026-98193](https://insights.sbomify.com/CVE-2026-98193/): wifi: libipw: reject TKIP frames without a full MIC (not scored)
- [CVE-2026-98192](https://insights.sbomify.com/CVE-2026-98192/): wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown (not scored)
- [CVE-2026-98191](https://insights.sbomify.com/CVE-2026-98191/): wifi: wlcore: release runtime PM ref on regdomain config failure (not scored)
- [CVE-2026-98190](https://insights.sbomify.com/CVE-2026-98190/): wifi: wilc1000: fix out-of-bounds read in P2P public action frames (not scored)
- [CVE-2026-98189](https://insights.sbomify.com/CVE-2026-98189/): wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext() (not scored)
- [CVE-2026-98188](https://insights.sbomify.com/CVE-2026-98188/): wifi: p54: validate curve data length in the calibration curve converters (not scored)
- [CVE-2026-98187](https://insights.sbomify.com/CVE-2026-98187/): wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST (not scored)
- [CVE-2026-98186](https://insights.sbomify.com/CVE-2026-98186/): wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length (not scored)
- [CVE-2026-98185](https://insights.sbomify.com/CVE-2026-98185/): wifi: mwifiex: validate scan response extents (not scored)
- [CVE-2026-98184](https://insights.sbomify.com/CVE-2026-98184/): wifi: mwifiex: prevent authentication frame length truncation (not scored)
- [CVE-2026-98183](https://insights.sbomify.com/CVE-2026-98183/): wifi: mac80211: avoid out-of-bounds read for empty PREQ elements (not scored)
- [CVE-2026-98182](https://insights.sbomify.com/CVE-2026-98182/): wifi: mac80211: refuse to make a monitor active when it has no queue (not scored)
- [CVE-2026-98181](https://insights.sbomify.com/CVE-2026-98181/): drm/gud: fix out-of-bounds write in gud_plane_atomic_check() (not scored)
- [CVE-2026-98180](https://insights.sbomify.com/CVE-2026-98180/): drm/msm: RCU-free the scheduler-containing ring and VM objects (high 7.1)
- [CVE-2026-98179](https://insights.sbomify.com/CVE-2026-98179/): drm/amdgpu: fix rmmio iounmap skipped on device removal (not scored)
- [CVE-2026-98178](https://insights.sbomify.com/CVE-2026-98178/): drm/amdgpu: Skip KFD mapping clear before initialization (not scored)
- [CVE-2026-98177](https://insights.sbomify.com/CVE-2026-98177/): drm/amdkfd: Avoid integer underflow in EOP ring size calculation. (not scored)
- [CVE-2026-98176](https://insights.sbomify.com/CVE-2026-98176/): drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc (not scored)
- [CVE-2026-98175](https://insights.sbomify.com/CVE-2026-98175/): smb: client: cancel reconnect work in clean_demultiplex_info() (high 7.5)
- [CVE-2026-98174](https://insights.sbomify.com/CVE-2026-98174/): smb: client: fix rlist race and missing initialization (high 7.5)
- [CVE-2026-98173](https://insights.sbomify.com/CVE-2026-98173/): smb: client: fix use-after-free of iface in cifs_try_adding_channels() (high 7.5)
- [CVE-2026-98172](https://insights.sbomify.com/CVE-2026-98172/): smb: client: fix smbd_connection leak on cifs_get_tcp_session() error (not scored)
- [CVE-2026-98171](https://insights.sbomify.com/CVE-2026-98171/): smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs (high 8.8)
- [CVE-2026-98170](https://insights.sbomify.com/CVE-2026-98170/): smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() (not scored)
- [CVE-2026-9817](https://insights.sbomify.com/CVE-2026-9817/): Memory corruption in Totolink (critical 9.1)
- [CVE-2026-98169](https://insights.sbomify.com/CVE-2026-98169/): smb: client: fix potential OOB read in smb3_enum_snapshots() (high 7.1)
- [CVE-2026-98168](https://insights.sbomify.com/CVE-2026-98168/): smb: client: fix reparse buffer bounds in cifs_query_reparse_point() (not scored)
- [CVE-2026-98167](https://insights.sbomify.com/CVE-2026-98167/): smb: client: fix server->total_read for compound encrypted PDUs (not scored)
- [CVE-2026-98166](https://insights.sbomify.com/CVE-2026-98166/): drm/ttm: fix swapped-out resources never leaving their bulk_move range (high 7.8)
- [CVE-2026-98164](https://insights.sbomify.com/CVE-2026-98164/): KVM: x86/mmu: Check write tracking in all address spaces (high 7.1)
- [CVE-2026-98163](https://insights.sbomify.com/CVE-2026-98163/): cgroup: Avoid iteration of dying tasks with zero refcount (high 7.8)
- [CVE-2026-98162](https://insights.sbomify.com/CVE-2026-98162/): smb/server: fix tree connection leak in smb2_tree_connect() (medium 5.5)
- [CVE-2026-98161](https://insights.sbomify.com/CVE-2026-98161/): nvdimm: pmem: keep PREFLUSH before data writes (medium 5.5)
- [CVE-2026-98160](https://insights.sbomify.com/CVE-2026-98160/): staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() (medium 5.5)
- [CVE-2026-9816](https://insights.sbomify.com/CVE-2026-9816/): Insufficient server-side validation of board member role fields permits privilege escalation (high 8.3)
- [CVE-2026-98159](https://insights.sbomify.com/CVE-2026-98159/): wifi: mt76: mt7921: validate CLC firmware records (medium 5.5)
- [CVE-2026-98158](https://insights.sbomify.com/CVE-2026-98158/): ppp_async: drop the errored frame instead of resetting its headroom (medium 5.5)
- [CVE-2026-98157](https://insights.sbomify.com/CVE-2026-98157/): EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation (medium 5.5)
- [CVE-2026-98156](https://insights.sbomify.com/CVE-2026-98156/): drm/virtio: use the DMA API for resource backing on Xen (high 7.8)
- [CVE-2026-98155](https://insights.sbomify.com/CVE-2026-98155/): accel/qaic: Address potential out-of-bounds read in resp_worker() (high 7.1)
- [CVE-2026-98154](https://insights.sbomify.com/CVE-2026-98154/): nvme-rdma: fix -EIO cleanup order in queue_rq (high 7.0)
- [CVE-2026-98153](https://insights.sbomify.com/CVE-2026-98153/): nvme: fix racy access to FDP placement id array (medium 5.5)
- [CVE-2026-98152](https://insights.sbomify.com/CVE-2026-98152/): nvmet-rdma: fix queue leak when connect backlog is exceeded (medium 5.5)
- [CVE-2026-98151](https://insights.sbomify.com/CVE-2026-98151/): bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic (medium 5.5)
- [CVE-2026-98150](https://insights.sbomify.com/CVE-2026-98150/): bpf: Fix BPF_F_CPU validation for sparse CPU IDs (high 7.0)
- [CVE-2026-9815](https://insights.sbomify.com/CVE-2026-9815/): MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload to RCE (medium 6.5)
- [CVE-2026-98149](https://insights.sbomify.com/CVE-2026-98149/): bpf: Fix percpu map update indexing with sparse CPU IDs (high 7.8)
- [CVE-2026-98148](https://insights.sbomify.com/CVE-2026-98148/): drm/gud: validate GUD_ROTATION_0 is present in supported rotations (medium 5.5)
- [CVE-2026-98147](https://insights.sbomify.com/CVE-2026-98147/): printk: Don't WARN on kthread_run failure. (medium 5.5)
- [CVE-2026-98146](https://insights.sbomify.com/CVE-2026-98146/): accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain (medium 5.5)
- [CVE-2026-98145](https://insights.sbomify.com/CVE-2026-98145/): accel/amdxdna: reject a command chain that carries no commands (medium 5.5)
- [CVE-2026-98144](https://insights.sbomify.com/CVE-2026-98144/): accel/amdxdna: put the chained BO when its mapping fails (medium 5.5)
- [CVE-2026-98143](https://insights.sbomify.com/CVE-2026-98143/): accel: ethosu: Don't read the U65 rounding mode as a storage mode (high 7.8)
- [CVE-2026-98142](https://insights.sbomify.com/CVE-2026-98142/): drm/cirrus-qemu: Validate BAR0 size during probe (medium 5.5)
- [CVE-2026-98141](https://insights.sbomify.com/CVE-2026-98141/): ntfs: propagate reparse index insertion failure (medium 5.5)
- [CVE-2026-98140](https://insights.sbomify.com/CVE-2026-98140/): ntfs: fix kmap_local leak in write_mft_record_nolock() error paths (medium 5.5)
- [CVE-2026-9814](https://insights.sbomify.com/CVE-2026-9814/): Command injection in Totolink (critical 9.1)
- [CVE-2026-98139](https://insights.sbomify.com/CVE-2026-98139/): ntfs: only count successfully cleared runs when freeing clusters (medium 5.5)
- [CVE-2026-98138](https://insights.sbomify.com/CVE-2026-98138/): ntfs: do not mark the volume clean in sync_fs when errors were recorded (medium 5.5)
- [CVE-2026-98137](https://insights.sbomify.com/CVE-2026-98137/): ntfs: treat any nonzero dio zero-range return as an error (medium 5.5)
- [CVE-2026-98136](https://insights.sbomify.com/CVE-2026-98136/): ntfs: bound $AttrDef table walk to the loaded table size (high 7.1)
- [CVE-2026-98135](https://insights.sbomify.com/CVE-2026-98135/): ntfs: reject invalid sectors_per_cluster in the boot sector (medium 5.5)
- [CVE-2026-98134](https://insights.sbomify.com/CVE-2026-98134/): bpf: check_cond_jmp_op(): properly infer if register is null (medium 5.5)
- [CVE-2026-98133](https://insights.sbomify.com/CVE-2026-98133/): ntfs: leave HasEA flag untouched on setxattr failure (medium 5.5)
- [CVE-2026-98132](https://insights.sbomify.com/CVE-2026-98132/): bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO (medium 5.5)
- [CVE-2026-98131](https://insights.sbomify.com/CVE-2026-98131/): net: stmmac: fix dma mapping leak in stmmac_tso_xmit() (medium 5.5)
- [CVE-2026-98130](https://insights.sbomify.com/CVE-2026-98130/): sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (high 8.1)
- [CVE-2026-9813](https://insights.sbomify.com/CVE-2026-9813/): FlowIntel external reference URL probe allows server-side request forgery (medium 6.2)
- [CVE-2026-98129](https://insights.sbomify.com/CVE-2026-98129/): scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() (medium 5.5)
- [CVE-2026-98128](https://insights.sbomify.com/CVE-2026-98128/): scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() (medium 5.5)
- [CVE-2026-98127](https://insights.sbomify.com/CVE-2026-98127/): smb/client: validate new EOF for insert range (medium 5.5)
- [CVE-2026-98126](https://insights.sbomify.com/CVE-2026-98126/): smb/client: validate new EOF for zero range (medium 5.5)
- [CVE-2026-98125](https://insights.sbomify.com/CVE-2026-98125/): smb/client: fix stale page cache in insert/collapse range (medium 5.5)
- [CVE-2026-98124](https://insights.sbomify.com/CVE-2026-98124/): smb/client: invalidate fscache for fallocate range operations (medium 5.5)
- [CVE-2026-98123](https://insights.sbomify.com/CVE-2026-98123/): sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (medium 5.5)
- [CVE-2026-98122](https://insights.sbomify.com/CVE-2026-98122/): vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del() (high 7.8)
- [CVE-2026-98121](https://insights.sbomify.com/CVE-2026-98121/): watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (medium 5.5)
- [CVE-2026-98120](https://insights.sbomify.com/CVE-2026-98120/): netfs: Fix subreq ref leak (medium 5.5)
- [CVE-2026-9812](https://insights.sbomify.com/CVE-2026-9812/): Missing property field ownership validation in Playbooks run property update endpoint (medium 6.5)
- [CVE-2026-98119](https://insights.sbomify.com/CVE-2026-98119/): netfs: break unbuffered write when netfs_alloc_subrequest() fails (medium 5.5)
- [CVE-2026-98118](https://insights.sbomify.com/CVE-2026-98118/): netfs: Fix readahead synchronisation issues by loading all folios upfront (high 7.1)
- [CVE-2026-98117](https://insights.sbomify.com/CVE-2026-98117/): cachefiles: Fix potential UAF/KASAN warning (high 7.8)
- [CVE-2026-98116](https://insights.sbomify.com/CVE-2026-98116/): ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (high 7.8)
- [CVE-2026-98115](https://insights.sbomify.com/CVE-2026-98115/): ksmbd: safely drain sessions during logoff (high 8.8)
- [CVE-2026-98114](https://insights.sbomify.com/CVE-2026-98114/): ksmbd: propagate DACL parsing errors (medium 5.5)
- [CVE-2026-98113](https://insights.sbomify.com/CVE-2026-98113/): ksmbd: rate limit unmapped SID errors (medium 5.5)
- [CVE-2026-98112](https://insights.sbomify.com/CVE-2026-98112/): ksmbd: fix listener task lifetime on netdev events (high 7.8)
- [CVE-2026-98111](https://insights.sbomify.com/CVE-2026-98111/): Bluetooth: btintel: validate version TLV value lengths (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/211/