# Vulnerabilities published in 2026


- [CVE-2026-90258](https://insights.sbomify.com/CVE-2026-90258/): pinctrl: airoha: add missed IRQ resource helpers (not scored)
- [CVE-2026-90257](https://insights.sbomify.com/CVE-2026-90257/): Bluetooth: virtio_bt: avoid OOB read of build info string (not scored)
- [CVE-2026-90256](https://insights.sbomify.com/CVE-2026-90256/): Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind (high 8.8)
- [CVE-2026-90255](https://insights.sbomify.com/CVE-2026-90255/): Bluetooth: hci_conn: fix the SCO setup context lifetime (high 8.8)
- [CVE-2026-90254](https://insights.sbomify.com/CVE-2026-90254/): Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (not scored)
- [CVE-2026-90253](https://insights.sbomify.com/CVE-2026-90253/): Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (not scored)
- [CVE-2026-90252](https://insights.sbomify.com/CVE-2026-90252/): Bluetooth: MGMT: free the HCI command when it is cancelled (not scored)
- [CVE-2026-90251](https://insights.sbomify.com/CVE-2026-90251/): Bluetooth: MSFT: validate evt_prefix_len against the response length (not scored)
- [CVE-2026-90250](https://insights.sbomify.com/CVE-2026-90250/): bpf, cgroup: Fix storage null-ptr-deref after replacing prog (not scored)
- [CVE-2026-90249](https://insights.sbomify.com/CVE-2026-90249/): iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (not scored)
- [CVE-2026-90248](https://insights.sbomify.com/CVE-2026-90248/): net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (not scored)
- [CVE-2026-90247](https://insights.sbomify.com/CVE-2026-90247/): bpf: Fix mmap_lock leak in irq_work path (not scored)
- [CVE-2026-90246](https://insights.sbomify.com/CVE-2026-90246/): apparmor: fix integer overflow in verify_tags() bounds check (high 7.1)
- [CVE-2026-90245](https://insights.sbomify.com/CVE-2026-90245/): fbdev: kyro: Validate overlay viewport coordinates (not scored)
- [CVE-2026-90244](https://insights.sbomify.com/CVE-2026-90244/): iommu/dma: Restore locking around msi_page_list (high 7.8)
- [CVE-2026-90243](https://insights.sbomify.com/CVE-2026-90243/): iommu/vt-d: Clear Present bit before tearing down copied context entry (high 8.1)
- [CVE-2026-90242](https://insights.sbomify.com/CVE-2026-90242/): iommu/vt-d: Fix iopf_refcount leak on RID domain replacement (not scored)
- [CVE-2026-90241](https://insights.sbomify.com/CVE-2026-90241/): iommu/vt-d: Tear down scalable-mode context on probe failure (high 8.2)
- [CVE-2026-90240](https://insights.sbomify.com/CVE-2026-90240/): iommu/vt-d: Flush context cache with correct SID when tearing down aliases (high 8.8)
- [CVE-2026-9024](https://insights.sbomify.com/CVE-2026-9024/): Cross-site scripting in DELMIA Service Process Engineer (high 8.7)
- [CVE-2026-90239](https://insights.sbomify.com/CVE-2026-90239/): media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem() (not scored)
- [CVE-2026-90238](https://insights.sbomify.com/CVE-2026-90238/): media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path (not scored)
- [CVE-2026-90237](https://insights.sbomify.com/CVE-2026-90237/): netfilter: nft_ct: move custom expectation support to helper (high 7.8)
- [CVE-2026-90236](https://insights.sbomify.com/CVE-2026-90236/): NFSD: Release the export reference when reaping open stateids (not scored)
- [CVE-2026-90235](https://insights.sbomify.com/CVE-2026-90235/): sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE (critical 9.8)
- [CVE-2026-90234](https://insights.sbomify.com/CVE-2026-90234/): NFS: Return a delegation the client fails to record (high 7.5)
- [CVE-2026-90233](https://insights.sbomify.com/CVE-2026-90233/): nvme-pci: release descriptor pools on probe failure (not scored)
- [CVE-2026-90232](https://insights.sbomify.com/CVE-2026-90232/): amt: Don't support cross-netns setup. (not scored)
- [CVE-2026-90231](https://insights.sbomify.com/CVE-2026-90231/): apparmor: fix unconfined user namespace restriction forced stack (high 8.4)
- [CVE-2026-90230](https://insights.sbomify.com/CVE-2026-90230/): nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate() (critical 9.1)
- [CVE-2026-90229](https://insights.sbomify.com/CVE-2026-90229/): nvme-apple: Destroy the admin queue on removal (high 7.4)
- [CVE-2026-90228](https://insights.sbomify.com/CVE-2026-90228/): nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (high 7.5)
- [CVE-2026-90227](https://insights.sbomify.com/CVE-2026-90227/): nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (high 7.8)
- [CVE-2026-90226](https://insights.sbomify.com/CVE-2026-90226/): nfc: llcp: avoid userspace overflow on invalid optlen (not scored)
- [CVE-2026-90225](https://insights.sbomify.com/CVE-2026-90225/): nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (high 7.8)
- [CVE-2026-90224](https://insights.sbomify.com/CVE-2026-90224/): nfc: nci: fix double completion race in nci_data_exchange_complete (high 7.5)
- [CVE-2026-90223](https://insights.sbomify.com/CVE-2026-90223/): nfc: llcp: bound SNL TLV parsing to the skb and add length checks (high 7.1)
- [CVE-2026-90222](https://insights.sbomify.com/CVE-2026-90222/): nfc: pn533: hold a reference to the request skb during send_frame (not scored)
- [CVE-2026-90221](https://insights.sbomify.com/CVE-2026-90221/): nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (not scored)
- [CVE-2026-90220](https://insights.sbomify.com/CVE-2026-90220/): ALSA: seq: Don't leak the extension cell pointer in the bounce payload (not scored)
- [CVE-2026-9022](https://insights.sbomify.com/CVE-2026-9022/): Splide Carousel Block <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url' Block Attribute (medium 6.4)
- [CVE-2026-90219](https://insights.sbomify.com/CVE-2026-90219/): RDMA/cxgb4: Free debugfs on registration failure (not scored)
- [CVE-2026-90218](https://insights.sbomify.com/CVE-2026-90218/): RDMA/cma: Fix WARNING in res_to_rt (not scored)
- [CVE-2026-90217](https://insights.sbomify.com/CVE-2026-90217/): bpf: Compare iterator types during state pruning (high 7.8)
- [CVE-2026-90216](https://insights.sbomify.com/CVE-2026-90216/): ubi: Fix rollback for explicit UBI device numbers (not scored)
- [CVE-2026-90215](https://insights.sbomify.com/CVE-2026-90215/): mtd: ubi: Release device reference on busy detach (not scored)
- [CVE-2026-90214](https://insights.sbomify.com/CVE-2026-90214/): ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (not scored)
- [CVE-2026-90213](https://insights.sbomify.com/CVE-2026-90213/): firewire: core: fix memory leak in error path of build_tree() (not scored)
- [CVE-2026-90212](https://insights.sbomify.com/CVE-2026-90212/): arm64/efi: Avoid voluntary preemption with efi_mm installed (not scored)
- [CVE-2026-90211](https://insights.sbomify.com/CVE-2026-90211/): bpf, s390: Clear fetch destination on faulting arena atomic (not scored)
- [CVE-2026-90210](https://insights.sbomify.com/CVE-2026-90210/): bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure (high 7.8)
- [CVE-2026-9021](https://insights.sbomify.com/CVE-2026-9021/): Missing authorization in Easy Invoice – Invoice Generator, PDF Quotes & Payments (medium 5.3)
- [CVE-2026-90209](https://insights.sbomify.com/CVE-2026-90209/): s390/debug: Fix deadlock during unregister (not scored)
- [CVE-2026-90208](https://insights.sbomify.com/CVE-2026-90208/): clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type (not scored)
- [CVE-2026-90207](https://insights.sbomify.com/CVE-2026-90207/): ALSA: seq: midi: Serialize input teardown with event_input (high 7.8)
- [CVE-2026-90206](https://insights.sbomify.com/CVE-2026-90206/): nvmet: fix max_qid race between configfs and controller allocation (not scored)
- [CVE-2026-90205](https://insights.sbomify.com/CVE-2026-90205/): ocfs2: validate orphan slot during inode read (high 7.8)
- [CVE-2026-90204](https://insights.sbomify.com/CVE-2026-90204/): ocfs2: validate DIO orphan slot during inode read (high 7.8)
- [CVE-2026-90203](https://insights.sbomify.com/CVE-2026-90203/): Squashfs: check block offset is not negative (high 7.1)
- [CVE-2026-90202](https://insights.sbomify.com/CVE-2026-90202/): scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (not scored)
- [CVE-2026-90201](https://insights.sbomify.com/CVE-2026-90201/): net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race (not scored)
- [CVE-2026-90200](https://insights.sbomify.com/CVE-2026-90200/): fs/ntfs3: fix integer overflow in MFT cluster validation (not scored)
- [CVE-2026-90199](https://insights.sbomify.com/CVE-2026-90199/): fs/ntfs3: reject out-of-range evcn in mi_enum_attr() (high 7.8)
- [CVE-2026-90198](https://insights.sbomify.com/CVE-2026-90198/): ALSA: core: Fix use-after-free in snd_card_do_free() (not scored)
- [CVE-2026-90197](https://insights.sbomify.com/CVE-2026-90197/): HID: haptic: don't write an uninitialized value to unhandled usages (not scored)
- [CVE-2026-90196](https://insights.sbomify.com/CVE-2026-90196/): ASoC: SOF: validate topology volume range before allocation (not scored)
- [CVE-2026-90195](https://insights.sbomify.com/CVE-2026-90195/): riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args (not scored)
- [CVE-2026-90194](https://insights.sbomify.com/CVE-2026-90194/): ACPI: scan: fix bus ID cleanup on device_add() failures (not scored)
- [CVE-2026-90193](https://insights.sbomify.com/CVE-2026-90193/): mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler (not scored)
- [CVE-2026-90192](https://insights.sbomify.com/CVE-2026-90192/): mailbox: qcom-cpucp: handle NULL data in send_data callback (not scored)
- [CVE-2026-90191](https://insights.sbomify.com/CVE-2026-90191/): mailbox: riscv-sbi-mpxy: validate RPMI notification lengths (high 8.4)
- [CVE-2026-90190](https://insights.sbomify.com/CVE-2026-90190/): null_blk: use DEFINE_MUTEX for the file-scope mutex (not scored)
- [CVE-2026-9019](https://insights.sbomify.com/CVE-2026-9019/): Cross-site scripting in Easy Image Collage (medium 6.4)
- [CVE-2026-90189](https://insights.sbomify.com/CVE-2026-90189/): null_blk: register configfs subsystem after creating default devices (not scored)
- [CVE-2026-90188](https://insights.sbomify.com/CVE-2026-90188/): null_blk: free global tag_set on init error path (not scored)
- [CVE-2026-90187](https://insights.sbomify.com/CVE-2026-90187/): null_blk: free zones array on device power-off (not scored)
- [CVE-2026-90186](https://insights.sbomify.com/CVE-2026-90186/): null_blk: reject per-device queue resize for shared tag set (not scored)
- [CVE-2026-90185](https://insights.sbomify.com/CVE-2026-90185/): null_blk: serialize configfs attribute stores with the lock (not scored)
- [CVE-2026-90184](https://insights.sbomify.com/CVE-2026-90184/): null_blk: serialize configfs attribute updates with device setup (not scored)
- [CVE-2026-90183](https://insights.sbomify.com/CVE-2026-90183/): blk-iolatency: clear delay state when freeing policy data (not scored)
- [CVE-2026-90182](https://insights.sbomify.com/CVE-2026-90182/): blk-iocost: clear delay state when freeing policy data (not scored)
- [CVE-2026-90181](https://insights.sbomify.com/CVE-2026-90181/): ublk: avoid teardown retry loop on xarray allocation failure (not scored)
- [CVE-2026-90180](https://insights.sbomify.com/CVE-2026-90180/): block: mtip32xx: synchronize ioctls with device removal (not scored)
- [CVE-2026-9018](https://insights.sbomify.com/CVE-2026-9018/): Privilege escalation in Easy Elements for Elementor – Addons & Website Templates (high 8.8)
- [CVE-2026-90179](https://insights.sbomify.com/CVE-2026-90179/): apparmor: fix deadlock in complain-mode change_hat (not scored)
- [CVE-2026-90178](https://insights.sbomify.com/CVE-2026-90178/): hwmon: (coretemp) Fix core_data leak on CPUs without PTS (not scored)
- [CVE-2026-90177](https://insights.sbomify.com/CVE-2026-90177/): bpf: Check pointer type for all atomic RMW paths (high 7.8)
- [CVE-2026-90176](https://insights.sbomify.com/CVE-2026-90176/): ksmbd: Do not skip lock checks for single-byte ranges (high 8.1)
- [CVE-2026-90175](https://insights.sbomify.com/CVE-2026-90175/): smb: server: fix leak of ksmbd_ipc_login_request_ext() returned buffer (not scored)
- [CVE-2026-90174](https://insights.sbomify.com/CVE-2026-90174/): ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user() (high 7.1)
- [CVE-2026-90173](https://insights.sbomify.com/CVE-2026-90173/): smb: smbdirect: free completion queues with ib_free_cq() (critical 9.8)
- [CVE-2026-90172](https://insights.sbomify.com/CVE-2026-90172/): smb: smbdirect: destroy QP before mem pools on accept failure (high 7.5)
- [CVE-2026-90171](https://insights.sbomify.com/CVE-2026-90171/): smb: smbdirect: release pending child sockets outside the handler lock (not scored)
- [CVE-2026-90170](https://insights.sbomify.com/CVE-2026-90170/): ksmbd: validate ipc response length before dereferencing its fields (not scored)
- [CVE-2026-9017](https://insights.sbomify.com/CVE-2026-9017/): Missing authorization in NEX-Forms – Ultimate Forms Plugin for WordPress (medium 5.3)
- [CVE-2026-90169](https://insights.sbomify.com/CVE-2026-90169/): ksmbd: free preauth sessions on connection teardown (not scored)
- [CVE-2026-90167](https://insights.sbomify.com/CVE-2026-90167/): ksmbd: serialize oplock close with pending break ownership (not scored)
- [CVE-2026-90166](https://insights.sbomify.com/CVE-2026-90166/): smb/server: fix null-ptr-deref in ksmbd_ipc_tree_connect_request() (not scored)
- [CVE-2026-90165](https://insights.sbomify.com/CVE-2026-90165/): smb/server: fix invalid pointer dereference in ksmbd_stop_durable_scavenger() (not scored)
- [CVE-2026-90164](https://insights.sbomify.com/CVE-2026-90164/): smb/server: abort initialization when proc setup fails (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/267/