# Vulnerabilities published in 2026


- [CVE-2026-90071](https://insights.sbomify.com/CVE-2026-90071/): net/sched: sch_teql: restore skb->dev on the slave failure path (high 7.8)
- [CVE-2026-90070](https://insights.sbomify.com/CVE-2026-90070/): tpm: st33zp24: Return zero on status read failure (not scored)
- [CVE-2026-9007](https://insights.sbomify.com/CVE-2026-9007/): Reflected XSS in HCL Notes (medium 5.5)
- [CVE-2026-90069](https://insights.sbomify.com/CVE-2026-90069/): crypto: acomp - allocate async request context when cloning (high 7.8)
- [CVE-2026-90068](https://insights.sbomify.com/CVE-2026-90068/): ASoC: dapm: Fix off-by-one check on the second enum channel (not scored)
- [CVE-2026-90067](https://insights.sbomify.com/CVE-2026-90067/): libceph: validate banner payload length (high 7.5)
- [CVE-2026-90066](https://insights.sbomify.com/CVE-2026-90066/): samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify (not scored)
- [CVE-2026-90065](https://insights.sbomify.com/CVE-2026-90065/): net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure (not scored)
- [CVE-2026-90064](https://insights.sbomify.com/CVE-2026-90064/): drm/xe: Reject page faults from non-fault-mode scratch VMs (not scored)
- [CVE-2026-90063](https://insights.sbomify.com/CVE-2026-90063/): virtio-net: Ensure that TCP packets don't overflow gso_segs (not scored)
- [CVE-2026-90062](https://insights.sbomify.com/CVE-2026-90062/): netfilter: nf_tables: move hardware offload step after building the chain blob (high 7.1)
- [CVE-2026-90061](https://insights.sbomify.com/CVE-2026-90061/): netfilter: nf_tables: skip double clone set expressions on element insert (not scored)
- [CVE-2026-90060](https://insights.sbomify.com/CVE-2026-90060/): ALSA: control: Don't add invalid kcontrols to LED layer (not scored)
- [CVE-2026-9006](https://insights.sbomify.com/CVE-2026-9006/): IBM WebSphere Application Server is affected by server-side request forgery (high 7.4)
- [CVE-2026-90059](https://insights.sbomify.com/CVE-2026-90059/): net: stmmac: restore NET_IP_ALIGN in the RX DMA offset (high 7.5)
- [CVE-2026-90058](https://insights.sbomify.com/CVE-2026-90058/): net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (not scored)
- [CVE-2026-90057](https://insights.sbomify.com/CVE-2026-90057/): slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (high 7.8)
- [CVE-2026-90056](https://insights.sbomify.com/CVE-2026-90056/): net: fec: only stop PTP if it was initialized (not scored)
- [CVE-2026-90055](https://insights.sbomify.com/CVE-2026-90055/): usb: atm: usbatm: fix invalid ci_range initialization (not scored)
- [CVE-2026-90054](https://insights.sbomify.com/CVE-2026-90054/): tcp: fix corruption of urgent data on multi-segment retransmit (not scored)
- [CVE-2026-90053](https://insights.sbomify.com/CVE-2026-90053/): net/sched: sch_htb: limit htb_classify inner-class filter hops (not scored)
- [CVE-2026-90051](https://insights.sbomify.com/CVE-2026-90051/): tcp: reject non zerocopy devmem tx (high 7.8)
- [CVE-2026-90049](https://insights.sbomify.com/CVE-2026-90049/): net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (critical 9.3)
- [CVE-2026-90048](https://insights.sbomify.com/CVE-2026-90048/): fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list() (critical 9.8)
- [CVE-2026-90047](https://insights.sbomify.com/CVE-2026-90047/): drm/xe: Don't hand out the flat CCS storage as usable VRAM (high 7.8)
- [CVE-2026-90046](https://insights.sbomify.com/CVE-2026-90046/): mm/page_alloc: don't spin_trylock() in NMI on UP (high 7.8)
- [CVE-2026-90045](https://insights.sbomify.com/CVE-2026-90045/): USB: gadget: ffs: fix mm lifetime handling (high 7.8)
- [CVE-2026-90044](https://insights.sbomify.com/CVE-2026-90044/): usb: gadget: f_fs: Fix Use-After-Free in AIO error path (high 7.8)
- [CVE-2026-90043](https://insights.sbomify.com/CVE-2026-90043/): zram: fix slot lock bit position on big-endian 64-bit (high 7.8)
- [CVE-2026-90042](https://insights.sbomify.com/CVE-2026-90042/): ceph: properly decrypt filenames in vmalloc() buffers (critical 9.8)
- [CVE-2026-90041](https://insights.sbomify.com/CVE-2026-90041/): HID: sony: clean up device list on probe failure (high 8.8)
- [CVE-2026-90040](https://insights.sbomify.com/CVE-2026-90040/): KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped (not scored)
- [CVE-2026-9004](https://insights.sbomify.com/CVE-2026-9004/): WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter (medium 4.3)
- [CVE-2026-90039](https://insights.sbomify.com/CVE-2026-90039/): NFSD: Guard admin state-revocation walks with NFSD_NET_UP (not scored)
- [CVE-2026-90038](https://insights.sbomify.com/CVE-2026-90038/): NFSD: Prevent client use-after-free during export state revocation (critical 9.8)
- [CVE-2026-90037](https://insights.sbomify.com/CVE-2026-90037/): NFSD: Prevent client use-after-free during close_lru reaping (critical 9.8)
- [CVE-2026-90036](https://insights.sbomify.com/CVE-2026-90036/): NFSD: Prevent client use-after-free during blocked-lock reaping (critical 9.8)
- [CVE-2026-90035](https://insights.sbomify.com/CVE-2026-90035/): drm/amd/display: fix division by zero in get_estimated_bw() (not scored)
- [CVE-2026-90034](https://insights.sbomify.com/CVE-2026-90034/): usb: image: mdc800: change kmalloc() to kzalloc() (not scored)
- [CVE-2026-90033](https://insights.sbomify.com/CVE-2026-90033/): ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (not scored)
- [CVE-2026-90032](https://insights.sbomify.com/CVE-2026-90032/): media: usbtv: keep device alive while ALSA card exists (high 7.8)
- [CVE-2026-90031](https://insights.sbomify.com/CVE-2026-90031/): usb-storage: ene_ub6250: fix race between scan work and probe (not scored)
- [CVE-2026-90030](https://insights.sbomify.com/CVE-2026-90030/): usb: dwc3: clear forceRM when issuing EndTransfer (high 7.8)
- [CVE-2026-9003](https://insights.sbomify.com/CVE-2026-9003/): TONNET｜E-LAN Hybrid Recording System - SQL Injection (high 8.7)
- [CVE-2026-90029](https://insights.sbomify.com/CVE-2026-90029/): usb: storage: realtek_cr: fix use-after-free on disconnect (not scored)
- [CVE-2026-90028](https://insights.sbomify.com/CVE-2026-90028/): usb: typec: hd3ss3220: track VBUS enable state per consumer (not scored)
- [CVE-2026-90027](https://insights.sbomify.com/CVE-2026-90027/): usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop (high 7.8)
- [CVE-2026-90026](https://insights.sbomify.com/CVE-2026-90026/): usb: typec: qcom-pmic: cancel reset_work on stop (high 7.8)
- [CVE-2026-90025](https://insights.sbomify.com/CVE-2026-90025/): usb: typec: ucsi: displayport: Fix OOB altmode array index (high 7.7)
- [CVE-2026-90024](https://insights.sbomify.com/CVE-2026-90024/): usb: gadget: midi2: Fix null-pointer dereference in f_midi2_free_ep_reqs (not scored)
- [CVE-2026-90023](https://insights.sbomify.com/CVE-2026-90023/): usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() (not scored)
- [CVE-2026-90022](https://insights.sbomify.com/CVE-2026-90022/): usb: gadget: f_midi2: fix use-after-free in string attribute show path (high 7.8)
- [CVE-2026-90021](https://insights.sbomify.com/CVE-2026-90021/): usb: gadget: f_midi: initialize work in f_midi_alloc() (not scored)
- [CVE-2026-90020](https://insights.sbomify.com/CVE-2026-90020/): USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (not scored)
- [CVE-2026-9002](https://insights.sbomify.com/CVE-2026-9002/): IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled (medium 6.5)
- [CVE-2026-90019](https://insights.sbomify.com/CVE-2026-90019/): usb: gadget: fix null pointer dereference in usb_put_function_instance() (not scored)
- [CVE-2026-90018](https://insights.sbomify.com/CVE-2026-90018/): staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (high 8.8)
- [CVE-2026-90017](https://insights.sbomify.com/CVE-2026-90017/): staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (high 7.1)
- [CVE-2026-90016](https://insights.sbomify.com/CVE-2026-90016/): staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() (high 7.1)
- [CVE-2026-90015](https://insights.sbomify.com/CVE-2026-90015/): xhci: fix lost bounce buffers on TDs spanning several ring segments (not scored)
- [CVE-2026-90014](https://insights.sbomify.com/CVE-2026-90014/): tracing: Have show_event_filters/triggers files take trace array ref (high 7.8)
- [CVE-2026-90013](https://insights.sbomify.com/CVE-2026-90013/): tracing: Take trace_array reference when opening options file (high 7.8)
- [CVE-2026-90012](https://insights.sbomify.com/CVE-2026-90012/): spi: Fix DMA mapping ownership on partial map failure (critical 9.8)
- [CVE-2026-90011](https://insights.sbomify.com/CVE-2026-90011/): scsi: target: iscsi: Reserve a terminator byte for the login payload (critical 9.1)
- [CVE-2026-90010](https://insights.sbomify.com/CVE-2026-90010/): scsi: bsg: Cap io_uring sense copy to max_response_len (high 7.8)
- [CVE-2026-90009](https://insights.sbomify.com/CVE-2026-90009/): scsi: bsg: Fix TOCTOU in io_uring passthrough command setup (high 7.8)
- [CVE-2026-90008](https://insights.sbomify.com/CVE-2026-90008/): scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame (high 7.8)
- [CVE-2026-90007](https://insights.sbomify.com/CVE-2026-90007/): scsi: pm8001: Use rollback index when freeing MSI-X vectors (high 7.8)
- [CVE-2026-90006](https://insights.sbomify.com/CVE-2026-90006/): samples/damon/mtier: handle damon_stop() failure (not scored)
- [CVE-2026-90005](https://insights.sbomify.com/CVE-2026-90005/): samples/damon/wsse: handle damon_start() failure (not scored)
- [CVE-2026-90004](https://insights.sbomify.com/CVE-2026-90004/): mm/damon/core: handle region split failure in apply_min_nr_regions() (not scored)
- [CVE-2026-90003](https://insights.sbomify.com/CVE-2026-90003/): futex: Prevent rcuwait use-after-free during requeue PI (high 7.8)
- [CVE-2026-90002](https://insights.sbomify.com/CVE-2026-90002/): ftrace: Take trace_array reference before accessing its ftrace_ops (high 7.8)
- [CVE-2026-90001](https://insights.sbomify.com/CVE-2026-90001/): HID: bpf: serialize device reference release in struct_ops destroy path (high 7.8)
- [CVE-2026-90000](https://insights.sbomify.com/CVE-2026-90000/): HID: rmi: fix OOB access with undersized RMI reports (high 8.8)
- [CVE-2026-89999](https://insights.sbomify.com/CVE-2026-89999/): HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (high 8.1)
- [CVE-2026-89998](https://insights.sbomify.com/CVE-2026-89998/): dm: fix race when loading and unloading a table (high 7.8)
- [CVE-2026-89997](https://insights.sbomify.com/CVE-2026-89997/): dm: fix resume-vs-remove race (high 7.8)
- [CVE-2026-89996](https://insights.sbomify.com/CVE-2026-89996/): dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds (not scored)
- [CVE-2026-89995](https://insights.sbomify.com/CVE-2026-89995/): dma-direct: return struct page from dma_direct_alloc_from_pool() (high 8.8)
- [CVE-2026-89994](https://insights.sbomify.com/CVE-2026-89994/): dmaengine: fsl-edma: tracing: no ptr dereference during log output (high 7.8)
- [CVE-2026-89993](https://insights.sbomify.com/CVE-2026-89993/): dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (not scored)
- [CVE-2026-89992](https://insights.sbomify.com/CVE-2026-89992/): cpuidle: dt_idle_genpd: kfree() the original name allocation (high 8.4)
- [CVE-2026-89991](https://insights.sbomify.com/CVE-2026-89991/): bpf: Fix infinite loop in pcpu_freelist push with one possible CPU (not scored)
- [CVE-2026-89990](https://insights.sbomify.com/CVE-2026-89990/): ceph: lock mutex in ceph_mds_check_access() (critical 9.8)
- [CVE-2026-89989](https://insights.sbomify.com/CVE-2026-89989/): ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (not scored)
- [CVE-2026-89988](https://insights.sbomify.com/CVE-2026-89988/): kprobes: Protect kprobe_blacklist with RCU (high 7.8)
- [CVE-2026-89987](https://insights.sbomify.com/CVE-2026-89987/): mm/huge_memory: transfer the pmd dirty bit to the folio on zap (not scored)
- [CVE-2026-89986](https://insights.sbomify.com/CVE-2026-89986/): mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave() (high 7.8)
- [CVE-2026-89985](https://insights.sbomify.com/CVE-2026-89985/): memcg: keep folio's objcg same as its node (high 7.8)
- [CVE-2026-89984](https://insights.sbomify.com/CVE-2026-89984/): perf/x86/intel: Fix kernel address leakages in LBR stack (not scored)
- [CVE-2026-89983](https://insights.sbomify.com/CVE-2026-89983/): i2c: core: fix debugfs UAF on adapter removal (not scored)
- [CVE-2026-89982](https://insights.sbomify.com/CVE-2026-89982/): i2c: mux: Fix channel node leak on adapter add failure (not scored)
- [CVE-2026-89981](https://insights.sbomify.com/CVE-2026-89981/): arm64: Don't read GMID_EL1 when MTE is disabled (not scored)
- [CVE-2026-89980](https://insights.sbomify.com/CVE-2026-89980/): ALSA: harmony: initialize locks before requesting IRQ (high 8.4)
- [CVE-2026-89979](https://insights.sbomify.com/CVE-2026-89979/): ALSA: pcm: Fix race between non-atomic ops and trigger-start (high 7.8)
- [CVE-2026-89978](https://insights.sbomify.com/CVE-2026-89978/): accel/amdxdna: return early from a zero-length flush (not scored)
- [CVE-2026-89977](https://insights.sbomify.com/CVE-2026-89977/): accel/ethosu: check MMIO mapping errors in probe (not scored)
- [CVE-2026-89976](https://insights.sbomify.com/CVE-2026-89976/): accel/ethosu: fix job completion fence cleanup (not scored)
- [CVE-2026-89975](https://insights.sbomify.com/CVE-2026-89975/): nvme-fabrics: fix DHCHAP secret leak on parse failure (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/269/