# Vulnerabilities published in 2026


- [CVE-2026-97567](https://insights.sbomify.com/CVE-2026-97567/): mptcp: prevent race between disconnect() and rtx (not scored)
- [CVE-2026-97566](https://insights.sbomify.com/CVE-2026-97566/): mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0 (not scored)
- [CVE-2026-97565](https://insights.sbomify.com/CVE-2026-97565/): smb: client: reject short READ responses in CIFSSMBRead() (not scored)
- [CVE-2026-97564](https://insights.sbomify.com/CVE-2026-97564/): smb: client: reject userspace cifs.idmap descriptions (not scored)
- [CVE-2026-97563](https://insights.sbomify.com/CVE-2026-97563/): smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() (not scored)
- [CVE-2026-97562](https://insights.sbomify.com/CVE-2026-97562/): smb: client: pin DFS superblock in iterator callback (high 7.5)
- [CVE-2026-97561](https://insights.sbomify.com/CVE-2026-97561/): smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid (not scored)
- [CVE-2026-97560](https://insights.sbomify.com/CVE-2026-97560/): smb: client: fix one-byte OOB read in smb2_parse_native_symlink() (not scored)
- [CVE-2026-9756](https://insights.sbomify.com/CVE-2026-9756/): Cross-site scripting in GenerateBlocks (medium 6.4)
- [CVE-2026-97559](https://insights.sbomify.com/CVE-2026-97559/): smb: client: fail DACL rewrite when the new DACL exceeds 64K (not scored)
- [CVE-2026-97558](https://insights.sbomify.com/CVE-2026-97558/): smb: client: fix cifsFileInfo reference leak in deferred close (not scored)
- [CVE-2026-97557](https://insights.sbomify.com/CVE-2026-97557/): smb: client: avoid leaking refcount in cifs_queue_oplock_break() (high 7.5)
- [CVE-2026-97556](https://insights.sbomify.com/CVE-2026-97556/): smb: client: avoid leaking refcount when cifs_sb_tlink() fails (not scored)
- [CVE-2026-97555](https://insights.sbomify.com/CVE-2026-97555/): smb: client: fix heap overflow in DACL owner/group rewrite (high 8.8)
- [CVE-2026-97554](https://insights.sbomify.com/CVE-2026-97554/): smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() (not scored)
- [CVE-2026-97553](https://insights.sbomify.com/CVE-2026-97553/): xfs: lock the healthmon when inserting unmount event (not scored)
- [CVE-2026-97552](https://insights.sbomify.com/CVE-2026-97552/): xfs: initialise error in xfs_defer_finish_one() (not scored)
- [CVE-2026-97551](https://insights.sbomify.com/CVE-2026-97551/): xfs: initialise args->total for parent pointer updates (not scored)
- [CVE-2026-97550](https://insights.sbomify.com/CVE-2026-97550/): xfs: fix unit conversions in per_binval computation (not scored)
- [CVE-2026-97549](https://insights.sbomify.com/CVE-2026-97549/): xfs: fix under-reservation of blocks when repairing sf directories (not scored)
- [CVE-2026-97548](https://insights.sbomify.com/CVE-2026-97548/): xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions (high 7.8)
- [CVE-2026-97547](https://insights.sbomify.com/CVE-2026-97547/): xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (not scored)
- [CVE-2026-97546](https://insights.sbomify.com/CVE-2026-97546/): xfs: don't spin forever on zero-length dirents when salvaging them (not scored)
- [CVE-2026-97545](https://insights.sbomify.com/CVE-2026-97545/): xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails (not scored)
- [CVE-2026-97544](https://insights.sbomify.com/CVE-2026-97544/): xfs: don't leak dqacct if rhashtable insertion fails (not scored)
- [CVE-2026-97543](https://insights.sbomify.com/CVE-2026-97543/): xfs: destroy seen inode bitmap when we fail to add a dirpath (not scored)
- [CVE-2026-97542](https://insights.sbomify.com/CVE-2026-97542/): xfs: bail out on bitmap errors in xrep_agfl_fill (not scored)
- [CVE-2026-97541](https://insights.sbomify.com/CVE-2026-97541/): wifi: ath9k_htc: don't store usb_device_id (not scored)
- [CVE-2026-97540](https://insights.sbomify.com/CVE-2026-97540/): net: usb: pegasus: don't rely on id table pointer arithmetic (not scored)
- [CVE-2026-9754](https://insights.sbomify.com/CVE-2026-9754/): Stack memory disclosure in filemd5 command (high 7.1)
- [CVE-2026-97539](https://insights.sbomify.com/CVE-2026-97539/): usb: xusbatm: don't rely on id table pointer arithmetic (not scored)
- [CVE-2026-97538](https://insights.sbomify.com/CVE-2026-97538/): hwmon: (asus_rog_ryujin) Validate HID report lengths (not scored)
- [CVE-2026-97537](https://insights.sbomify.com/CVE-2026-97537/): scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking (not scored)
- [CVE-2026-97536](https://insights.sbomify.com/CVE-2026-97536/): scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown (high 7.5)
- [CVE-2026-97535](https://insights.sbomify.com/CVE-2026-97535/): scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size (not scored)
- [CVE-2026-97534](https://insights.sbomify.com/CVE-2026-97534/): f2fs: accurately adjust free_sections during free_segment_range (not scored)
- [CVE-2026-97533](https://insights.sbomify.com/CVE-2026-97533/): x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF (not scored)
- [CVE-2026-97532](https://insights.sbomify.com/CVE-2026-97532/): scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path (not scored)
- [CVE-2026-97531](https://insights.sbomify.com/CVE-2026-97531/): scsi: qla2xxx: Skip vport under deletion in report ID acquisition (high 7.5)
- [CVE-2026-97530](https://insights.sbomify.com/CVE-2026-97530/): scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature (not scored)
- [CVE-2026-9753](https://insights.sbomify.com/CVE-2026-9753/): Server crash via malformed binary diff passed to $_internalApplyOplogUpdate. (high 7.2)
- [CVE-2026-97529](https://insights.sbomify.com/CVE-2026-97529/): scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] (not scored)
- [CVE-2026-97528](https://insights.sbomify.com/CVE-2026-97528/): scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error (high 8.8)
- [CVE-2026-97527](https://insights.sbomify.com/CVE-2026-97527/): scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock (high 8.8)
- [CVE-2026-97526](https://insights.sbomify.com/CVE-2026-97526/): s390/pai: Support CPU hotplug for PMU PAI (not scored)
- [CVE-2026-97525](https://insights.sbomify.com/CVE-2026-97525/): x86/mm/pat: Allocate split page tables as kernel page tables (high 8.2)
- [CVE-2026-97524](https://insights.sbomify.com/CVE-2026-97524/): mptcp: avoid unneeded actions on subflow reset (high 7.5)
- [CVE-2026-97523](https://insights.sbomify.com/CVE-2026-97523/): mptcp: close race between scheduler and state change (high 7.5)
- [CVE-2026-97522](https://insights.sbomify.com/CVE-2026-97522/): mptcp: fix bad accounting in __mptcp_subflow_push_pending() (not scored)
- [CVE-2026-97521](https://insights.sbomify.com/CVE-2026-97521/): gfs2: fix quota init duplicate scan (not scored)
- [CVE-2026-97520](https://insights.sbomify.com/CVE-2026-97520/): gfs2: move quota_init qc iterator increment (high 7.1)
- [CVE-2026-9752](https://insights.sbomify.com/CVE-2026-9752/): GeometryCollection with strict-winding polygon causes server crash during 2dsphere index key generation (high 7.1)
- [CVE-2026-97519](https://insights.sbomify.com/CVE-2026-97519/): drm/xe: Fix null pointer dereference in devcoredump cleanup (not scored)
- [CVE-2026-97518](https://insights.sbomify.com/CVE-2026-97518/): wifi: cfg80211: reject duplicate wiphy cipher suite entries (not scored)
- [CVE-2026-97517](https://insights.sbomify.com/CVE-2026-97517/): wifi: nl80211: reject beacons with bad HE operation (not scored)
- [CVE-2026-97516](https://insights.sbomify.com/CVE-2026-97516/): wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (not scored)
- [CVE-2026-97515](https://insights.sbomify.com/CVE-2026-97515/): i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845 (not scored)
- [CVE-2026-97514](https://insights.sbomify.com/CVE-2026-97514/): media: chips-media: wave5: Fix Reports from Kernel Lock Validator (not scored)
- [CVE-2026-97513](https://insights.sbomify.com/CVE-2026-97513/): media: chips-media: wave5: Release m2m_ctx after Instance Removed from List (high 7.8)
- [CVE-2026-97512](https://insights.sbomify.com/CVE-2026-97512/): spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM (not scored)
- [CVE-2026-97511](https://insights.sbomify.com/CVE-2026-97511/): wifi: mac80211: avoid out-of-bounds access in monitor (not scored)
- [CVE-2026-97510](https://insights.sbomify.com/CVE-2026-97510/): thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (not scored)
- [CVE-2026-9751](https://insights.sbomify.com/CVE-2026-9751/): Sensitive data could be written to mongod.log (medium 6.8)
- [CVE-2026-97509](https://insights.sbomify.com/CVE-2026-97509/): thunderbolt: Keep XDomain reference during the lifetime of a service (high 8.8)
- [CVE-2026-97508](https://insights.sbomify.com/CVE-2026-97508/): thunderbolt: Set tb->root_switch to NULL when domain is stopped (high 7.5)
- [CVE-2026-97507](https://insights.sbomify.com/CVE-2026-97507/): media: dm1105: fix missing error check for dma_alloc_coherent (not scored)
- [CVE-2026-97506](https://insights.sbomify.com/CVE-2026-97506/): crypto: ixp4xx - fix buffer chain unwind on allocation failure (not scored)
- [CVE-2026-97505](https://insights.sbomify.com/CVE-2026-97505/): PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store() (not scored)
- [CVE-2026-97504](https://insights.sbomify.com/CVE-2026-97504/): watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk (not scored)
- [CVE-2026-97503](https://insights.sbomify.com/CVE-2026-97503/): genirq/proc: Size interrupt directory names for 10-digit interrupt numbers (not scored)
- [CVE-2026-97502](https://insights.sbomify.com/CVE-2026-97502/): mmc: davinci: avoid NULL deref of host->data in IRQ handler (not scored)
- [CVE-2026-97501](https://insights.sbomify.com/CVE-2026-97501/): pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction (not scored)
- [CVE-2026-97500](https://insights.sbomify.com/CVE-2026-97500/): wifi: rtw89: phy: check length before parsing PHY status IE (not scored)
- [CVE-2026-9750](https://insights.sbomify.com/CVE-2026-9750/): Metadata name collision on $-prefixed fields causes post-auth server crash (high 7.1)
- [CVE-2026-97499](https://insights.sbomify.com/CVE-2026-97499/): coresight: perf: Retrieve path and source from event data (not scored)
- [CVE-2026-97498](https://insights.sbomify.com/CVE-2026-97498/): drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction (not scored)
- [CVE-2026-97497](https://insights.sbomify.com/CVE-2026-97497/): drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (high 7.8)
- [CVE-2026-97496](https://insights.sbomify.com/CVE-2026-97496/): drm/amdkfd: Fix OOB memory exposure in get_wave_state() (high 7.1)
- [CVE-2026-97495](https://insights.sbomify.com/CVE-2026-97495/): drm/amdkfd: Check bounds on allocate_doorbell (not scored)
- [CVE-2026-97494](https://insights.sbomify.com/CVE-2026-97494/): drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (not scored)
- [CVE-2026-97493](https://insights.sbomify.com/CVE-2026-97493/): drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (not scored)
- [CVE-2026-97492](https://insights.sbomify.com/CVE-2026-97492/): wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (not scored)
- [CVE-2026-97491](https://insights.sbomify.com/CVE-2026-97491/): net/rds: Don't sleep inside rds_ib_conn_path_shutdown (not scored)
- [CVE-2026-97490](https://insights.sbomify.com/CVE-2026-97490/): affs: handle set_blocksize failures (not scored)
- [CVE-2026-9749](https://insights.sbomify.com/CVE-2026-9749/): Using MaxKey() may crash the server (high 7.1)
- [CVE-2026-97489](https://insights.sbomify.com/CVE-2026-97489/): bfs: handle set_blocksize failures (not scored)
- [CVE-2026-97488](https://insights.sbomify.com/CVE-2026-97488/): qnx4: handle set_blocksize failures (not scored)
- [CVE-2026-97487](https://insights.sbomify.com/CVE-2026-97487/): jfs: handle set_blocksize failures (not scored)
- [CVE-2026-97486](https://insights.sbomify.com/CVE-2026-97486/): hpfs: handle set_blocksize failures (not scored)
- [CVE-2026-97485](https://insights.sbomify.com/CVE-2026-97485/): omfs: handle set_blocksize failures (not scored)
- [CVE-2026-97484](https://insights.sbomify.com/CVE-2026-97484/): usbip: vhci_hcd: fix NULL deref in status_show_vhci (not scored)
- [CVE-2026-97483](https://insights.sbomify.com/CVE-2026-97483/): usb: core: hcd: fix possible deadlock in rh control transfers (not scored)
- [CVE-2026-97482](https://insights.sbomify.com/CVE-2026-97482/): usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (not scored)
- [CVE-2026-97481](https://insights.sbomify.com/CVE-2026-97481/): serial: 8250: fix possible ISR soft lockup (not scored)
- [CVE-2026-97480](https://insights.sbomify.com/CVE-2026-97480/): tty: serial: 8250: protect against NULL uart->port.dev in register (not scored)
- [CVE-2026-9748](https://insights.sbomify.com/CVE-2026-9748/): $_internalConvertBucketIndexStats may crash the mongod server when working on no timeseries input (high 7.1)
- [CVE-2026-97479](https://insights.sbomify.com/CVE-2026-97479/): driver core: Avoid warning when removing a device while its supplier is unbinding (not scored)
- [CVE-2026-97478](https://insights.sbomify.com/CVE-2026-97478/): virt: acrn: Fix irqfd use-after-free during eventfd shutdown (high 7.8)
- [CVE-2026-97477](https://insights.sbomify.com/CVE-2026-97477/): RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind() (not scored)
- [CVE-2026-97476](https://insights.sbomify.com/CVE-2026-97476/): rds: filter RDS_INFO_* getsockopt by caller's netns (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/217/