# Vulnerabilities published in 2026


- [CVE-2026-90163](https://insights.sbomify.com/CVE-2026-90163/): smb/server: call ksmbd_proc_cleanup() on module init failure (not scored)
- [CVE-2026-90162](https://insights.sbomify.com/CVE-2026-90162/): ksmbd: defer publishing granted locks to prevent UAF/double-free race (high 8.8)
- [CVE-2026-90161](https://insights.sbomify.com/CVE-2026-90161/): erofs: fix interlaced ztailpacking pclusters (high 7.1)
- [CVE-2026-90160](https://insights.sbomify.com/CVE-2026-90160/): lwt_bpf: Restore reserved headroom after xmit program (not scored)
- [CVE-2026-9016](https://insights.sbomify.com/CVE-2026-9016/): Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action (medium 5.3)
- [CVE-2026-90159](https://insights.sbomify.com/CVE-2026-90159/): bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks (not scored)
- [CVE-2026-90158](https://insights.sbomify.com/CVE-2026-90158/): m68k: nfcon: Do not call console_is_registered() in nfcon_device() (not scored)
- [CVE-2026-90157](https://insights.sbomify.com/CVE-2026-90157/): bpf: Reject negative optlen in cgroup getsockopt hook (not scored)
- [CVE-2026-90156](https://insights.sbomify.com/CVE-2026-90156/): ksmbd: safely discard unregistered deferred locks (not scored)
- [CVE-2026-90155](https://insights.sbomify.com/CVE-2026-90155/): ksmbd: detach blocked lock requests before freeing (not scored)
- [CVE-2026-90154](https://insights.sbomify.com/CVE-2026-90154/): ksmbd: scope session state changes to bound connections (not scored)
- [CVE-2026-90153](https://insights.sbomify.com/CVE-2026-90153/): ksmbd: bound smb_check_perm_dacl() ACE walks by DACL size (high 8.1)
- [CVE-2026-90152](https://insights.sbomify.com/CVE-2026-90152/): smb/server: fix session leak in ksmbd_session_register() (not scored)
- [CVE-2026-90151](https://insights.sbomify.com/CVE-2026-90151/): NFSv4: remove callback IDR entry on client allocation failure (critical 9.8)
- [CVE-2026-90150](https://insights.sbomify.com/CVE-2026-90150/): pnfs/blocklayout: Fix device leaks on parse failure (not scored)
- [CVE-2026-9015](https://insights.sbomify.com/CVE-2026-9015/): Missing authorization in Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance (medium 4.3)
- [CVE-2026-90149](https://insights.sbomify.com/CVE-2026-90149/): NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers (high 7.5)
- [CVE-2026-90148](https://insights.sbomify.com/CVE-2026-90148/): NFSv4: Fix incorrect argument passed to nfs4_delete_lease() in nfs4_add_lease() (not scored)
- [CVE-2026-90147](https://insights.sbomify.com/CVE-2026-90147/): clk: devres: fix cleanup in devm_clk_get_optional_enabled_with_rate() (not scored)
- [CVE-2026-90146](https://insights.sbomify.com/CVE-2026-90146/): bpf, xdp: move offload check into dev_xdp_install() (high 7.8)
- [CVE-2026-90145](https://insights.sbomify.com/CVE-2026-90145/): hinic3: Fix skb linearization mismatch and drop skb when skb_checksum_help() failed (high 7.1)
- [CVE-2026-90144](https://insights.sbomify.com/CVE-2026-90144/): dpll: fix NULL deref in dpll_device_ops() during teardown race (not scored)
- [CVE-2026-90143](https://insights.sbomify.com/CVE-2026-90143/): net: kcm: Hold RCU read lock while running BPF parser (high 7.8)
- [CVE-2026-90142](https://insights.sbomify.com/CVE-2026-90142/): virtio_net: Fix resize of the RX ring (high 7.8)
- [CVE-2026-90141](https://insights.sbomify.com/CVE-2026-90141/): ipvs: fix integer overflow in ftp helper port/address parsing (high 7.3)
- [CVE-2026-90140](https://insights.sbomify.com/CVE-2026-90140/): cuse: wait for pending RCU callbacks on module exit (not scored)
- [CVE-2026-9014](https://insights.sbomify.com/CVE-2026-9014/): WP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action (medium 5.3)
- [CVE-2026-90139](https://insights.sbomify.com/CVE-2026-90139/): fuse: check for NULL root inode in fuse_fill_super_submount (not scored)
- [CVE-2026-90138](https://insights.sbomify.com/CVE-2026-90138/): vsock: don't check the listener's sk_err in vsock_accept() (not scored)
- [CVE-2026-90137](https://insights.sbomify.com/CVE-2026-90137/): platform/x86: hp-bioscfg: fix password encoding bounds check (high 7.7)
- [CVE-2026-90136](https://insights.sbomify.com/CVE-2026-90136/): platform/x86/amd/hsmp: Reject negative power cap writes in hwmon (not scored)
- [CVE-2026-90135](https://insights.sbomify.com/CVE-2026-90135/): net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs() (not scored)
- [CVE-2026-90134](https://insights.sbomify.com/CVE-2026-90134/): ntfs: fix kmap_local_page() usage in compress (not scored)
- [CVE-2026-90133](https://insights.sbomify.com/CVE-2026-90133/): ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib() (high 7.8)
- [CVE-2026-90132](https://insights.sbomify.com/CVE-2026-90132/): ntfs: reject unprivileged writes to reserved $LX* xattrs (high 7.1)
- [CVE-2026-90131](https://insights.sbomify.com/CVE-2026-90131/): ntfs: serialize resident iomap reads with mrec_lock (high 7.1)
- [CVE-2026-90130](https://insights.sbomify.com/CVE-2026-90130/): vdpa_sim: fix cleanup after worker creation failure (not scored)
- [CVE-2026-9013](https://insights.sbomify.com/CVE-2026-9013/): Bogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API (medium 4.3)
- [CVE-2026-90129](https://insights.sbomify.com/CVE-2026-90129/): virtio_balloon: quiesce balloon work before device shutdown (not scored)
- [CVE-2026-90128](https://insights.sbomify.com/CVE-2026-90128/): vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (not scored)
- [CVE-2026-90127](https://insights.sbomify.com/CVE-2026-90127/): virtio: rtc: time out alarm requests (not scored)
- [CVE-2026-90126](https://insights.sbomify.com/CVE-2026-90126/): rtc: pcf8563: fix clock provider leak on unbind (not scored)
- [CVE-2026-90125](https://insights.sbomify.com/CVE-2026-90125/): smb: client: fix request buffer leak in smb2_new_read_req() (not scored)
- [CVE-2026-90124](https://insights.sbomify.com/CVE-2026-90124/): irqchip/renesas-rzg2l: Fix loss of interrupt (not scored)
- [CVE-2026-90123](https://insights.sbomify.com/CVE-2026-90123/): irqchip/ast2700-intc: Avoid allocating in the irq_domain activate() callback (not scored)
- [CVE-2026-90122](https://insights.sbomify.com/CVE-2026-90122/): clk: visconti: Make sure clk_init_data is fully initialized (not scored)
- [CVE-2026-90121](https://insights.sbomify.com/CVE-2026-90121/): irqchip/gic-v5: Clear per-CPU IRS data on teardown (not scored)
- [CVE-2026-90120](https://insights.sbomify.com/CVE-2026-90120/): irqchip/gic-v5: Check get_logical_index() return value in MADT IAFFID parsing (high 8.4)
- [CVE-2026-90119](https://insights.sbomify.com/CVE-2026-90119/): ALSA: ice1712: Fix the card leak at probe error with the auto-cleanup (not scored)
- [CVE-2026-90118](https://insights.sbomify.com/CVE-2026-90118/): ntfs: fix off-by-one page overflow in ntfs_decompress() (high 7.8)
- [CVE-2026-90117](https://insights.sbomify.com/CVE-2026-90117/): ntfs: validate usa_ofs before preserving the update sequence number (not scored)
- [CVE-2026-90116](https://insights.sbomify.com/CVE-2026-90116/): ALSA: mtpav: shut down output timer before card teardown (not scored)
- [CVE-2026-90115](https://insights.sbomify.com/CVE-2026-90115/): xsk: fix NULL pointer dereference in __xsk_rcv() (not scored)
- [CVE-2026-90114](https://insights.sbomify.com/CVE-2026-90114/): net: bridge: Reject descending VLAN tunnel ranges (not scored)
- [CVE-2026-90113](https://insights.sbomify.com/CVE-2026-90113/): netdevsim: update queue NAPI association on queue reset (not scored)
- [CVE-2026-90112](https://insights.sbomify.com/CVE-2026-90112/): net: qlcnic: validate unified ROM sections before loading (not scored)
- [CVE-2026-90111](https://insights.sbomify.com/CVE-2026-90111/): ip6mr: do not clone dst in ip6mr_cache_report() (high 7.8)
- [CVE-2026-90110](https://insights.sbomify.com/CVE-2026-90110/): inetpeer: randomize RB-tree node comparison using SipHash (critical 9.4)
- [CVE-2026-9011](https://insights.sbomify.com/CVE-2026-9011/): Ditty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action (high 7.5)
- [CVE-2026-90109](https://insights.sbomify.com/CVE-2026-90109/): net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue (not scored)
- [CVE-2026-90108](https://insights.sbomify.com/CVE-2026-90108/): net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition (not scored)
- [CVE-2026-90107](https://insights.sbomify.com/CVE-2026-90107/): net/smc: free pending qentry in smc_llc_flow_stop() before memset (not scored)
- [CVE-2026-90106](https://insights.sbomify.com/CVE-2026-90106/): net: bridge: arp/nd proxy: fix reading neigh ha (not scored)
- [CVE-2026-90105](https://insights.sbomify.com/CVE-2026-90105/): vxlan: fix reading neigh ha (not scored)
- [CVE-2026-90104](https://insights.sbomify.com/CVE-2026-90104/): NFSv4.1: zero referring call lists before decoding (critical 9.8)
- [CVE-2026-90103](https://insights.sbomify.com/CVE-2026-90103/): NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (high 7.5)
- [CVE-2026-90102](https://insights.sbomify.com/CVE-2026-90102/): NFSv4/pnfs: key the data server cache on the NFS version (high 7.5)
- [CVE-2026-90101](https://insights.sbomify.com/CVE-2026-90101/): bnxt_en: Fix call to hardware monitoring event handler (not scored)
- [CVE-2026-90100](https://insights.sbomify.com/CVE-2026-90100/): ptp: netc: fix period truncation and potential divide-by-zero in PEROUT (not scored)
- [CVE-2026-9010](https://insights.sbomify.com/CVE-2026-9010/): Boost <= 2.0.3 - Unauthenticated Blind SQL Injection via Multiple Parameters (high 7.5)
- [CVE-2026-90099](https://insights.sbomify.com/CVE-2026-90099/): net/sched: account classifier filter allocations to memcg (not scored)
- [CVE-2026-90098](https://insights.sbomify.com/CVE-2026-90098/): net: sparx5: fix sleep in atomic context in MAC table access (not scored)
- [CVE-2026-90097](https://insights.sbomify.com/CVE-2026-90097/): Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition (not scored)
- [CVE-2026-90096](https://insights.sbomify.com/CVE-2026-90096/): fuse: invalidate the correct range after O_APPEND direct write (not scored)
- [CVE-2026-90095](https://insights.sbomify.com/CVE-2026-90095/): fuse: Fix the condition to enable over-io-uring (not scored)
- [CVE-2026-90094](https://insights.sbomify.com/CVE-2026-90094/): arm64: process: Fix context switching MTE store-only tag check (not scored)
- [CVE-2026-90093](https://insights.sbomify.com/CVE-2026-90093/): Bluetooth: L2CAP: access chan->conn safely in get/setsockopt (high 7.8)
- [CVE-2026-90092](https://insights.sbomify.com/CVE-2026-90092/): Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (high 8.0)
- [CVE-2026-90091](https://insights.sbomify.com/CVE-2026-90091/): Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (high 8.0)
- [CVE-2026-90090](https://insights.sbomify.com/CVE-2026-90090/): Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (not scored)
- [CVE-2026-9009](https://insights.sbomify.com/CVE-2026-9009/): Code injection in Crawlomatic Multipage Scraper Post Generator (high 8.8)
- [CVE-2026-90089](https://insights.sbomify.com/CVE-2026-90089/): Bluetooth: btnxpuart: Validate the FW dump header length (high 7.1)
- [CVE-2026-90088](https://insights.sbomify.com/CVE-2026-90088/): Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (not scored)
- [CVE-2026-90087](https://insights.sbomify.com/CVE-2026-90087/): Bluetooth: do not leak an hci_conn when a second LE connect is rejected (not scored)
- [CVE-2026-90086](https://insights.sbomify.com/CVE-2026-90086/): xsk: honor XDP_TX_METADATA in zero-copy path (not scored)
- [CVE-2026-90085](https://insights.sbomify.com/CVE-2026-90085/): octeontx2-af: fix NULL deref in NIX TM tree debugfs read path (not scored)
- [CVE-2026-90084](https://insights.sbomify.com/CVE-2026-90084/): octeontx2-vf: fix workqueue and netdev race in probe/remove (not scored)
- [CVE-2026-90083](https://insights.sbomify.com/CVE-2026-90083/): net/sched: act_ife: Only operate on Ethernet frames (not scored)
- [CVE-2026-90082](https://insights.sbomify.com/CVE-2026-90082/): net: mana: Cap MSI-X vectors to the device MSI-X table size (not scored)
- [CVE-2026-90081](https://insights.sbomify.com/CVE-2026-90081/): net/rds: use wq_has_sleeper() in rds_cong_map_updated() (not scored)
- [CVE-2026-90080](https://insights.sbomify.com/CVE-2026-90080/): octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup (not scored)
- [CVE-2026-9008](https://insights.sbomify.com/CVE-2026-9008/): Missing authorization in Page-list (medium 4.3)
- [CVE-2026-90079](https://insights.sbomify.com/CVE-2026-90079/): octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init() (not scored)
- [CVE-2026-90078](https://insights.sbomify.com/CVE-2026-90078/): net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (not scored)
- [CVE-2026-90077](https://insights.sbomify.com/CVE-2026-90077/): net: fix a resource leak in copy_net_ns() error handling path (not scored)
- [CVE-2026-90076](https://insights.sbomify.com/CVE-2026-90076/): net/sched: fq: add overflow bounds to quantum and initial quantum (not scored)
- [CVE-2026-90075](https://insights.sbomify.com/CVE-2026-90075/): net/sched: fq_codel: clamp default quantum and mtu (not scored)
- [CVE-2026-90074](https://insights.sbomify.com/CVE-2026-90074/): net/sched: fq_pie: clamp default quantum to avoid signed overflow (not scored)
- [CVE-2026-90073](https://insights.sbomify.com/CVE-2026-90073/): net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (not scored)
- [CVE-2026-90072](https://insights.sbomify.com/CVE-2026-90072/): net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/268/