# Vulnerabilities published in 2026


- [CVE-2026-90350](https://insights.sbomify.com/CVE-2026-90350/): wifi: mt76: reject out-of-range link ids in mt76_vif_link() (not scored)
- [CVE-2026-9035](https://insights.sbomify.com/CVE-2026-9035/): Multiple vulnerabilities in Aspera applications. (medium 6.5)
- [CVE-2026-90349](https://insights.sbomify.com/CVE-2026-90349/): wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx() (not scored)
- [CVE-2026-90348](https://insights.sbomify.com/CVE-2026-90348/): wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (not scored)
- [CVE-2026-90347](https://insights.sbomify.com/CVE-2026-90347/): arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry (high 8.4)
- [CVE-2026-90346](https://insights.sbomify.com/CVE-2026-90346/): wifi: nl80211: clean up color-change beacon data on errors (not scored)
- [CVE-2026-90345](https://insights.sbomify.com/CVE-2026-90345/): wifi: brcmfmac: fix P2P action frame handling without device vif (not scored)
- [CVE-2026-90344](https://insights.sbomify.com/CVE-2026-90344/): wifi: mac80211: disconnect on CSA to channel 0 (not scored)
- [CVE-2026-90343](https://insights.sbomify.com/CVE-2026-90343/): wifi: cfg80211: stop PMSR before P2P and NAN teardown (high 7.8)
- [CVE-2026-90342](https://insights.sbomify.com/CVE-2026-90342/): bpf: Fix mmap_lock deadlock on arena lock failure (not scored)
- [CVE-2026-90341](https://insights.sbomify.com/CVE-2026-90341/): firmware: coreboot: Validate table bounds (high 7.7)
- [CVE-2026-90340](https://insights.sbomify.com/CVE-2026-90340/): pinctrl: generic: free maps on pinctrl_generic_to_map() failure (not scored)
- [CVE-2026-9034](https://insights.sbomify.com/CVE-2026-9034/): Mali GPU Userspace Driver allows access to already freed memory (high 7.8)
- [CVE-2026-90339](https://insights.sbomify.com/CVE-2026-90339/): powerpc/syscall: Fix syscall skip handling for seccomp and ptrace (not scored)
- [CVE-2026-90338](https://insights.sbomify.com/CVE-2026-90338/): serial: amba-pl011: keep console clock enabled for atomic writes (not scored)
- [CVE-2026-90337](https://insights.sbomify.com/CVE-2026-90337/): serial: core: do fallible allocations before the console can be registered (not scored)
- [CVE-2026-90336](https://insights.sbomify.com/CVE-2026-90336/): serial: core: clear freed pointers on uart_register_driver() failure (not scored)
- [CVE-2026-90335](https://insights.sbomify.com/CVE-2026-90335/): tty: skip cdev_del() when no cdev is registered (not scored)
- [CVE-2026-90334](https://insights.sbomify.com/CVE-2026-90334/): tty: clear cdev pointer after cdev_add() failure (not scored)
- [CVE-2026-90333](https://insights.sbomify.com/CVE-2026-90333/): dm-integrity: replace forgeable discard filler with a keyed sector marker (not scored)
- [CVE-2026-90332](https://insights.sbomify.com/CVE-2026-90332/): PCI: dwc: ep: Flush cached MSI write before unmapping the iATU (high 8.2)
- [CVE-2026-90331](https://insights.sbomify.com/CVE-2026-90331/): HID: asus: refactor the two workqueues and init sequence (not scored)
- [CVE-2026-90330](https://insights.sbomify.com/CVE-2026-90330/): HID: logitech-hidpp: Fix FF device cleanup on init failure (not scored)
- [CVE-2026-9033](https://insights.sbomify.com/CVE-2026-9033/): Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways (medium 6.0)
- [CVE-2026-90329](https://insights.sbomify.com/CVE-2026-90329/): HID: synchronize input before cleaning up a failed probe (high 8.8)
- [CVE-2026-90328](https://insights.sbomify.com/CVE-2026-90328/): HID: steam: Reject short reads (not scored)
- [CVE-2026-90327](https://insights.sbomify.com/CVE-2026-90327/): phonet: pep: do not write beyond optlen in getsockopt (not scored)
- [CVE-2026-90326](https://insights.sbomify.com/CVE-2026-90326/): blk-cgroup: fix race between policy activation and blkg destruction (high 7.8)
- [CVE-2026-90325](https://insights.sbomify.com/CVE-2026-90325/): blk-cgroup: skip dying blkg in blkcg_activate_policy() (high 7.8)
- [CVE-2026-90324](https://insights.sbomify.com/CVE-2026-90324/): ublk: check import_ubuf() return value (high 7.8)
- [CVE-2026-90323](https://insights.sbomify.com/CVE-2026-90323/): ublk: validate auto buf reg before taking uring_cmd (not scored)
- [CVE-2026-90322](https://insights.sbomify.com/CVE-2026-90322/): ocfs2/cluster: keep heartbeat local node stable (not scored)
- [CVE-2026-90321](https://insights.sbomify.com/CVE-2026-90321/): ocfs2: validate inline xattrs during inode block validation (high 7.8)
- [CVE-2026-90320](https://insights.sbomify.com/CVE-2026-90320/): ocfs2: validate external xattr entries when reading metadata (high 7.8)
- [CVE-2026-9032](https://insights.sbomify.com/CVE-2026-9032/): Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200 (high 7.1)
- [CVE-2026-90319](https://insights.sbomify.com/CVE-2026-90319/): rapidio: clear mport->net when rio_add_net() fails (not scored)
- [CVE-2026-90318](https://insights.sbomify.com/CVE-2026-90318/): fat: release buffer head after rebuilding parent (not scored)
- [CVE-2026-90317](https://insights.sbomify.com/CVE-2026-90317/): bpf: Invalidate RCU pointers after final spin unlock (high 7.8)
- [CVE-2026-90316](https://insights.sbomify.com/CVE-2026-90316/): drm/omap: dsi: Do not copy isr table (high 7.8)
- [CVE-2026-90315](https://insights.sbomify.com/CVE-2026-90315/): PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers (not scored)
- [CVE-2026-90314](https://insights.sbomify.com/CVE-2026-90314/): remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (not scored)
- [CVE-2026-90313](https://insights.sbomify.com/CVE-2026-90313/): bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed (not scored)
- [CVE-2026-90312](https://insights.sbomify.com/CVE-2026-90312/): bpf: Check load-acquire src ptr type before the load (high 7.8)
- [CVE-2026-90311](https://insights.sbomify.com/CVE-2026-90311/): thermal: hwmon: Remove hwmon class device along with its parent (not scored)
- [CVE-2026-9031](https://insights.sbomify.com/CVE-2026-9031/): Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6 (medium 6.8)
- [CVE-2026-90309](https://insights.sbomify.com/CVE-2026-90309/): RDMA/erdma: Hold CQ references when processing EQ events (high 7.8)
- [CVE-2026-90308](https://insights.sbomify.com/CVE-2026-90308/): RDMA/erdma: Hold QP references for AE and CM processing (high 7.8)
- [CVE-2026-90307](https://insights.sbomify.com/CVE-2026-90307/): RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (not scored)
- [CVE-2026-90306](https://insights.sbomify.com/CVE-2026-90306/): ARM: 9481/2: breakpoint: CFI breakpoints only on demand (not scored)
- [CVE-2026-90305](https://insights.sbomify.com/CVE-2026-90305/): ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK (not scored)
- [CVE-2026-90304](https://insights.sbomify.com/CVE-2026-90304/): ARM: 9484/1: enable interrupts when unhandled user faults are triggered (not scored)
- [CVE-2026-90303](https://insights.sbomify.com/CVE-2026-90303/): ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults (not scored)
- [CVE-2026-90302](https://insights.sbomify.com/CVE-2026-90302/): ocfs2: synchronize heartbeat callbacks with o2net teardown (not scored)
- [CVE-2026-90301](https://insights.sbomify.com/CVE-2026-90301/): ocfs2: o2hb: quiesce negotiate handlers and timeout work (high 8.1)
- [CVE-2026-90300](https://insights.sbomify.com/CVE-2026-90300/): bpf: Clear buf on error in __bpf_get_task_stack (not scored)
- [CVE-2026-9030](https://insights.sbomify.com/CVE-2026-9030/): Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6 (medium 6.8)
- [CVE-2026-90299](https://insights.sbomify.com/CVE-2026-90299/): bpf: Fix sleepable check for tracing/lsm prog (not scored)
- [CVE-2026-90298](https://insights.sbomify.com/CVE-2026-90298/): drm/sun4i: tcon: Drop TCON TOP device reference (not scored)
- [CVE-2026-90297](https://insights.sbomify.com/CVE-2026-90297/): drm/sun4i: crtc: Propagate layer initialization error (not scored)
- [CVE-2026-90296](https://insights.sbomify.com/CVE-2026-90296/): cpufreq: imx6q: fix devres accumulation across driver rebind (not scored)
- [CVE-2026-90295](https://insights.sbomify.com/CVE-2026-90295/): cpufreq: imx6q: fix out-of-bounds write when probed more than once (not scored)
- [CVE-2026-90294](https://insights.sbomify.com/CVE-2026-90294/): IB/isert: delay the final Login Response until the session is registered (high 7.5)
- [CVE-2026-90293](https://insights.sbomify.com/CVE-2026-90293/): IB/isert: post the full-feature receive buffers after session registration (high 7.5)
- [CVE-2026-90292](https://insights.sbomify.com/CVE-2026-90292/): RDMA/siw: Fix use-after-free in siw_accept() (high 7.8)
- [CVE-2026-90291](https://insights.sbomify.com/CVE-2026-90291/): module/dups: Fix use-after-free in kmod_dup_req lifetime handling (high 7.8)
- [CVE-2026-90290](https://insights.sbomify.com/CVE-2026-90290/): arm64: hibernate: Restore DAIF state on error (not scored)
- [CVE-2026-9029](https://insights.sbomify.com/CVE-2026-9029/): Stored XSS in the Geomap panel tile-layer attribution (high 7.3)
- [CVE-2026-90289](https://insights.sbomify.com/CVE-2026-90289/): drm/amd/display: Resize MST HDCP per-connector arrays to 32 (high 7.8)
- [CVE-2026-90288](https://insights.sbomify.com/CVE-2026-90288/): phy: renesas: rcar-gen2: Fix double of_node_put on phy creation failure (high 7.4)
- [CVE-2026-90287](https://insights.sbomify.com/CVE-2026-90287/): phy: sunplus: fix error handling in sp_uphy_init() (not scored)
- [CVE-2026-90286](https://insights.sbomify.com/CVE-2026-90286/): drm/amdgpu/gfx6: Use PFP on the compute queues too (high 8.8)
- [CVE-2026-90285](https://insights.sbomify.com/CVE-2026-90285/): scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (not scored)
- [CVE-2026-90284](https://insights.sbomify.com/CVE-2026-90284/): firmware_loader: do not queue completed sysfs fallback requests (not scored)
- [CVE-2026-90283](https://insights.sbomify.com/CVE-2026-90283/): hugetlbfs: release subpool on fill_super failure (not scored)
- [CVE-2026-90282](https://insights.sbomify.com/CVE-2026-90282/): phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend (not scored)
- [CVE-2026-90281](https://insights.sbomify.com/CVE-2026-90281/): phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (not scored)
- [CVE-2026-90280](https://insights.sbomify.com/CVE-2026-90280/): phy: qcom: qmp-usb: Fix possible NULL-deref on early runtime suspend (not scored)
- [CVE-2026-9028](https://insights.sbomify.com/CVE-2026-9028/): Missing authorization in CorvusPay WooCommerce Payment Gateway (medium 5.3)
- [CVE-2026-90279](https://insights.sbomify.com/CVE-2026-90279/): md/raid5: round bitmap stripes with sector division (not scored)
- [CVE-2026-90278](https://insights.sbomify.com/CVE-2026-90278/): md: wait for behind writes before destroying bitmap (not scored)
- [CVE-2026-90277](https://insights.sbomify.com/CVE-2026-90277/): md/md-llbitmap: prevent create failure bitmap UAF (not scored)
- [CVE-2026-90276](https://insights.sbomify.com/CVE-2026-90276/): md/md-llbitmap: stop daemon timer rearm on destroy (not scored)
- [CVE-2026-90275](https://insights.sbomify.com/CVE-2026-90275/): md/raid1: don't set array_frozen in raid1_takeover() (not scored)
- [CVE-2026-90274](https://insights.sbomify.com/CVE-2026-90274/): coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (not scored)
- [CVE-2026-90273](https://insights.sbomify.com/CVE-2026-90273/): coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable (not scored)
- [CVE-2026-90272](https://insights.sbomify.com/CVE-2026-90272/): perf: arm_pmuv3: Zero initialize hw_id branch stack field (not scored)
- [CVE-2026-90271](https://insights.sbomify.com/CVE-2026-90271/): arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt (not scored)
- [CVE-2026-90270](https://insights.sbomify.com/CVE-2026-90270/): arm_mpam: Disable driver unbind to avoid UAF (not scored)
- [CVE-2026-9027](https://insights.sbomify.com/CVE-2026-9027/): Business logic in CorvusPay WooCommerce Payment Gateway (medium 5.3)
- [CVE-2026-90269](https://insights.sbomify.com/CVE-2026-90269/): bpf: Reject load-acquire from pointers requiring fault protection (not scored)
- [CVE-2026-90268](https://insights.sbomify.com/CVE-2026-90268/): scsi: sd: Fix error handling in sd_probe() after large pool creation failure (high 8.1)
- [CVE-2026-90267](https://insights.sbomify.com/CVE-2026-90267/): scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails (not scored)
- [CVE-2026-90266](https://insights.sbomify.com/CVE-2026-90266/): btrfs: zoned: don't force read-only on transient -EAGAIN from reloc merge (not scored)
- [CVE-2026-90265](https://insights.sbomify.com/CVE-2026-90265/): btrfs: defrag: fix deadlock between defrag and delalloc space reservation (not scored)
- [CVE-2026-90264](https://insights.sbomify.com/CVE-2026-90264/): btrfs: always wait for ordered extents to avoid OE races (not scored)
- [CVE-2026-90263](https://insights.sbomify.com/CVE-2026-90263/): btrfs: check if root is readonly when setting posix acl (not scored)
- [CVE-2026-90262](https://insights.sbomify.com/CVE-2026-90262/): btrfs: retry verity reads for not-uptodate Merkle folios (not scored)
- [CVE-2026-90261](https://insights.sbomify.com/CVE-2026-90261/): btrfs: zoned: flush active metadata block group at btree_writepages() start (not scored)
- [CVE-2026-90260](https://insights.sbomify.com/CVE-2026-90260/): btrfs: zoned: don't clobber the extent buffer when zeroing it out (high 7.1)
- [CVE-2026-90259](https://insights.sbomify.com/CVE-2026-90259/): btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/266/