# Vulnerabilities published in 2026


- [CVE-2026-93196](https://insights.sbomify.com/CVE-2026-93196/): nvdimm: virtio_pmem: refcount requests for token lifetime (high 8.4)
- [CVE-2026-93195](https://insights.sbomify.com/CVE-2026-93195/): drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel (not scored)
- [CVE-2026-93194](https://insights.sbomify.com/CVE-2026-93194/): drm/rockchip: dw_dp: Release core resources (not scored)
- [CVE-2026-93193](https://insights.sbomify.com/CVE-2026-93193/): drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup (not scored)
- [CVE-2026-93192](https://insights.sbomify.com/CVE-2026-93192/): drm/v3d: Clear queue->active_job when v3d_fence_create() fails (high 7.8)
- [CVE-2026-93191](https://insights.sbomify.com/CVE-2026-93191/): smack: fix incorrect task context in smack_msg_queue_msgrcv (not scored)
- [CVE-2026-93190](https://insights.sbomify.com/CVE-2026-93190/): platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (high 8.4)
- [CVE-2026-9319](https://insights.sbomify.com/CVE-2026-9319/): IBM WebSphere Application Server is affected by a remote code execution vulnerability (critical 9.0)
- [CVE-2026-93189](https://insights.sbomify.com/CVE-2026-93189/): HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (high 8.8)
- [CVE-2026-93188](https://insights.sbomify.com/CVE-2026-93188/): HID: roccat: bound device-supplied profile index (not scored)
- [CVE-2026-93187](https://insights.sbomify.com/CVE-2026-93187/): ASoC: SOF: ipc4-topology: Return error for invalid number of formats (not scored)
- [CVE-2026-93186](https://insights.sbomify.com/CVE-2026-93186/): cxl/mbox: Clamp mailbox output allocation to the payload size (not scored)
- [CVE-2026-93185](https://insights.sbomify.com/CVE-2026-93185/): ASoC: rt700-sdw: always drain jack work on remove (not scored)
- [CVE-2026-93184](https://insights.sbomify.com/CVE-2026-93184/): ASoC: fsl_audmix: rework runtime PM handling in probe (not scored)
- [CVE-2026-93183](https://insights.sbomify.com/CVE-2026-93183/): drm/lima: call drm_mm_init() with a valid allocation range (not scored)
- [CVE-2026-93182](https://insights.sbomify.com/CVE-2026-93182/): sched/fair: Fix overflow in update_tg_cfs_runnable() (not scored)
- [CVE-2026-93181](https://insights.sbomify.com/CVE-2026-93181/): perf/x86/intel/uncore: Fix uncore_box ref/unref ordering (not scored)
- [CVE-2026-93180](https://insights.sbomify.com/CVE-2026-93180/): drm/panthor: Fix NPD issue on partial unmap of an evicted BO (not scored)
- [CVE-2026-9318](https://insights.sbomify.com/CVE-2026-9318/): tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title (medium 4.8)
- [CVE-2026-93179](https://insights.sbomify.com/CVE-2026-93179/): drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read (not scored)
- [CVE-2026-93178](https://insights.sbomify.com/CVE-2026-93178/): drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (high 7.1)
- [CVE-2026-93177](https://insights.sbomify.com/CVE-2026-93177/): drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (high 7.3)
- [CVE-2026-93176](https://insights.sbomify.com/CVE-2026-93176/): drm/amd/display: Fix dangling pointer in plane reset function (high 7.0)
- [CVE-2026-93175](https://insights.sbomify.com/CVE-2026-93175/): drm/amd/display: Fix dangling pointer in CRTC reset function (high 7.8)
- [CVE-2026-93174](https://insights.sbomify.com/CVE-2026-93174/): bpf: Copy per-CPU map value padding in copy_map_value_long() (not scored)
- [CVE-2026-93173](https://insights.sbomify.com/CVE-2026-93173/): bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks (not scored)
- [CVE-2026-93172](https://insights.sbomify.com/CVE-2026-93172/): mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug (not scored)
- [CVE-2026-93171](https://insights.sbomify.com/CVE-2026-93171/): leds: lp5860: Fix a potential double-unlock (not scored)
- [CVE-2026-93170](https://insights.sbomify.com/CVE-2026-93170/): dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (high 7.8)
- [CVE-2026-9317](https://insights.sbomify.com/CVE-2026-9317/): Nango < 0.71.6 Missing Authentication RCE via runner tRPC server (critical 9.2)
- [CVE-2026-93169](https://insights.sbomify.com/CVE-2026-93169/): dmaengine: zynqmp_dma: fix race between runtime PM and device removal (not scored)
- [CVE-2026-93168](https://insights.sbomify.com/CVE-2026-93168/): dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout (not scored)
- [CVE-2026-93167](https://insights.sbomify.com/CVE-2026-93167/): csky: Fix a4/a5 restoration in syscall trace path (not scored)
- [CVE-2026-93166](https://insights.sbomify.com/CVE-2026-93166/): wifi: rtw89: debug: fix off by on in rtw89_ppdu_str() (not scored)
- [CVE-2026-93165](https://insights.sbomify.com/CVE-2026-93165/): platform/chrome: sensorhub: Fix memory overread in ring handler (high 7.7)
- [CVE-2026-93164](https://insights.sbomify.com/CVE-2026-93164/): uprobes/x86: Move optimized uprobe from nop5 to nop10 (not scored)
- [CVE-2026-93163](https://insights.sbomify.com/CVE-2026-93163/): hwrng: core - fix rng list on registration error (not scored)
- [CVE-2026-93162](https://insights.sbomify.com/CVE-2026-93162/): crypto: qat - cancel work on re-enable SR-IOV timeout (not scored)
- [CVE-2026-93161](https://insights.sbomify.com/CVE-2026-93161/): crypto: qat - clear AES key schedule from stack (not scored)
- [CVE-2026-93160](https://insights.sbomify.com/CVE-2026-93160/): crypto: atmel-ecc - reject hardware ECDH without a public key (not scored)
- [CVE-2026-93159](https://insights.sbomify.com/CVE-2026-93159/): crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (not scored)
- [CVE-2026-93158](https://insights.sbomify.com/CVE-2026-93158/): crypto: sa2ul - stop probe if context pool creation fails (not scored)
- [CVE-2026-93157](https://insights.sbomify.com/CVE-2026-93157/): hwrng: xilinx-trng - propagate timeout before any data is read (not scored)
- [CVE-2026-93156](https://insights.sbomify.com/CVE-2026-93156/): crypto: rk3288 - fail ahash requests on HASH idle timeout (not scored)
- [CVE-2026-93155](https://insights.sbomify.com/CVE-2026-93155/): crypto: keembay - Fix AEAD unregister count in error path (not scored)
- [CVE-2026-93154](https://insights.sbomify.com/CVE-2026-93154/): RDMA/irdma: Add refcounting to user ring MRs (high 7.8)
- [CVE-2026-93153](https://insights.sbomify.com/CVE-2026-93153/): RDMA/bng_re: return a timeout when firmware responses stall (not scored)
- [CVE-2026-93152](https://insights.sbomify.com/CVE-2026-93152/): nvme-apple: Use acquire/release for queue enabled state (not scored)
- [CVE-2026-93151](https://insights.sbomify.com/CVE-2026-93151/): nvmet-rdma: fix response resource leak on queue teardown (high 7.5)
- [CVE-2026-93150](https://insights.sbomify.com/CVE-2026-93150/): cgroup/cpuset: Make nr_deadline_tasks an atomic_t (not scored)
- [CVE-2026-93149](https://insights.sbomify.com/CVE-2026-93149/): wifi: mac80211_hwsim: avoid NULL skb in stop queue drain (not scored)
- [CVE-2026-93148](https://insights.sbomify.com/CVE-2026-93148/): bpf: Reject MEM_ALLOC BTF accesses past object bounds (high 7.8)
- [CVE-2026-93147](https://insights.sbomify.com/CVE-2026-93147/): s390/bpf: Replace ly instruction with llgf (high 7.8)
- [CVE-2026-93146](https://insights.sbomify.com/CVE-2026-93146/): time/namespace: Validate nanosecond field in proc_timens_set_offset() (not scored)
- [CVE-2026-93145](https://insights.sbomify.com/CVE-2026-93145/): clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (not scored)
- [CVE-2026-93144](https://insights.sbomify.com/CVE-2026-93144/): bpf: Reject writes through untrusted BTF pointers (high 7.8)
- [CVE-2026-93143](https://insights.sbomify.com/CVE-2026-93143/): staging: media: ipu7: fix pm_runtime refcount leak in ipu7_resume() (not scored)
- [CVE-2026-93142](https://insights.sbomify.com/CVE-2026-93142/): thermal/drivers/rcar: Fix error checking in probe() (not scored)
- [CVE-2026-93141](https://insights.sbomify.com/CVE-2026-93141/): usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (not scored)
- [CVE-2026-93140](https://insights.sbomify.com/CVE-2026-93140/): udf: Mark LVID buffer as uptodate before marking it dirty (not scored)
- [CVE-2026-93139](https://insights.sbomify.com/CVE-2026-93139/): drm/amdgpu/mes: Fix hung_queue_db_array loop limit for multi-XCC (not scored)
- [CVE-2026-93138](https://insights.sbomify.com/CVE-2026-93138/): bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (high 7.8)
- [CVE-2026-93137](https://insights.sbomify.com/CVE-2026-93137/): bpf: Fix use-after-free on mm_struct in bpf_find_vma() (high 7.8)
- [CVE-2026-93136](https://insights.sbomify.com/CVE-2026-93136/): bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (not scored)
- [CVE-2026-93135](https://insights.sbomify.com/CVE-2026-93135/): bpf: Reject programs with inlined helpers if JIT is not available (not scored)
- [CVE-2026-93134](https://insights.sbomify.com/CVE-2026-93134/): printk: Fix possible console use-after-free (not scored)
- [CVE-2026-93133](https://insights.sbomify.com/CVE-2026-93133/): ACPI: RISC-V: Check acpi_get_handle() status in riscv_acpi_add_prt_dep() (not scored)
- [CVE-2026-93132](https://insights.sbomify.com/CVE-2026-93132/): ACPI: RISC-V: Fix riscv_acpi_add_prt_dep() loop handling (not scored)
- [CVE-2026-93131](https://insights.sbomify.com/CVE-2026-93131/): platform/x86: dell-privacy: Fix race condition (not scored)
- [CVE-2026-93130](https://insights.sbomify.com/CVE-2026-93130/): platform/x86: dell-wmi-base: Fix resource leak on module load failure (not scored)
- [CVE-2026-93129](https://insights.sbomify.com/CVE-2026-93129/): platform/x86: dell-wmi-base: Fix handling of ultra performance key (not scored)
- [CVE-2026-93128](https://insights.sbomify.com/CVE-2026-93128/): platform/x86: lg-laptop: Fix LED resource handling (not scored)
- [CVE-2026-93127](https://insights.sbomify.com/CVE-2026-93127/): bpf: Drop scalar id on sign-extending narrowing stack fills (high 7.8)
- [CVE-2026-93126](https://insights.sbomify.com/CVE-2026-93126/): remoteproc: qcom_q6v5_adsp: Fix reference leak for device node (not scored)
- [CVE-2026-93125](https://insights.sbomify.com/CVE-2026-93125/): bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max (high 7.8)
- [CVE-2026-93124](https://insights.sbomify.com/CVE-2026-93124/): platform/x86: asus-wireless: Fail probe when there is no ACPI match (not scored)
- [CVE-2026-93123](https://insights.sbomify.com/CVE-2026-93123/): serial: qcom-geni: do not advance stale DMA completions (not scored)
- [CVE-2026-93122](https://insights.sbomify.com/CVE-2026-93122/): usb: gadget: uac: validate rate list length before storing (high 7.8)
- [CVE-2026-93121](https://insights.sbomify.com/CVE-2026-93121/): usb: gadget: f_fs: Fix fence cleanup in ffs_dmabuf_transfer() error paths (high 7.0)
- [CVE-2026-93120](https://insights.sbomify.com/CVE-2026-93120/): usb: gadget: configfs: fix out-of-bounds read of qw_sign (not scored)
- [CVE-2026-9312](https://insights.sbomify.com/CVE-2026-9312/): Server-side request forgery in Enterprise Server (critical 9.2)
- [CVE-2026-93119](https://insights.sbomify.com/CVE-2026-93119/): usb: ljca: bound bank_num in ljca_enumerate_gpio() (not scored)
- [CVE-2026-93118](https://insights.sbomify.com/CVE-2026-93118/): usb: gadget: aspeed_udc: check endpoint DMA allocation (not scored)
- [CVE-2026-93117](https://insights.sbomify.com/CVE-2026-93117/): usb: fix UAF when probe runs concurrent to dyn ID removal (not scored)
- [CVE-2026-93116](https://insights.sbomify.com/CVE-2026-93116/): platform/x86: asus-wmi: fix resource leaks on probe failure (high 7.0)
- [CVE-2026-93115](https://insights.sbomify.com/CVE-2026-93115/): platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (not scored)
- [CVE-2026-93114](https://insights.sbomify.com/CVE-2026-93114/): platform/surface: acpi-notify: Check ACPI companion before use (not scored)
- [CVE-2026-93113](https://insights.sbomify.com/CVE-2026-93113/): clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK (not scored)
- [CVE-2026-93112](https://insights.sbomify.com/CVE-2026-93112/): bpf: Require a BPF cpumask for bpf_cpumask_populate() (high 7.1)
- [CVE-2026-93111](https://insights.sbomify.com/CVE-2026-93111/): bpf: Mark tracing_multi trampolines as ftrace managed (high 7.8)
- [CVE-2026-93110](https://insights.sbomify.com/CVE-2026-93110/): RDMA/core: Wait for RCU callbacks before unloading ib_core (not scored)
- [CVE-2026-9311](https://insights.sbomify.com/CVE-2026-9311/): IBM WebSphere Application Server is affected by remote code execution (critical 9.0)
- [CVE-2026-93109](https://insights.sbomify.com/CVE-2026-93109/): RDMA/mlx5: Drain RCU callbacks during module teardown (not scored)
- [CVE-2026-93108](https://insights.sbomify.com/CVE-2026-93108/): RDMA/ipoib: Drain RCU callbacks during module teardown (not scored)
- [CVE-2026-93107](https://insights.sbomify.com/CVE-2026-93107/): RDMA/rxe: Avoid reprocessing the current packet after the QP enters the error state (high 8.2)
- [CVE-2026-93106](https://insights.sbomify.com/CVE-2026-93106/): crash_dump: release keyring reference at the correct time (not scored)
- [CVE-2026-93105](https://insights.sbomify.com/CVE-2026-93105/): esp: do not unref managed frag pages in esp_ssg_unref() (high 7.8)
- [CVE-2026-93104](https://insights.sbomify.com/CVE-2026-93104/): RDMA/rvt: Return NULL after port allocation failure (not scored)
- [CVE-2026-93103](https://insights.sbomify.com/CVE-2026-93103/): RDMA/hfi1: Preserve unit 0 on allocation failure (not scored)
- [CVE-2026-93102](https://insights.sbomify.com/CVE-2026-93102/): RDMA/hfi1: Free RX data on late probe failure (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/243/