# Vulnerabilities published in 2026


- [CVE-2026-89974](https://insights.sbomify.com/CVE-2026-89974/): nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails (high 7.5)
- [CVE-2026-89973](https://insights.sbomify.com/CVE-2026-89973/): nvme-tcp: check the data direction of a C2HData PDU (high 8.2)
- [CVE-2026-89972](https://insights.sbomify.com/CVE-2026-89972/): nvme: add missing SRCU grace period in error path (critical 9.8)
- [CVE-2026-89971](https://insights.sbomify.com/CVE-2026-89971/): nvme: skip the zoned limits update if the zone info query failed (high 7.5)
- [CVE-2026-89970](https://insights.sbomify.com/CVE-2026-89970/): nvmet-auth: Synchronize timeout work during SQ teardown (critical 9.8)
- [CVE-2026-8997](https://insights.sbomify.com/CVE-2026-8997/): Heap Buffer Overflow in vifm (medium 4.8)
- [CVE-2026-89969](https://insights.sbomify.com/CVE-2026-89969/): nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (critical 9.8)
- [CVE-2026-89968](https://insights.sbomify.com/CVE-2026-89968/): nvmet-tcp: reject unsolicited H2CData PDUs (high 7.5)
- [CVE-2026-89967](https://insights.sbomify.com/CVE-2026-89967/): mm/migrate_device: avoid out-of-bounds writes for compound folios (high 7.8)
- [CVE-2026-89966](https://insights.sbomify.com/CVE-2026-89966/): mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio (not scored)
- [CVE-2026-89965](https://insights.sbomify.com/CVE-2026-89965/): nvdimm/btt: reject an arena whose nfree is below the lane count (high 7.8)
- [CVE-2026-89964](https://insights.sbomify.com/CVE-2026-89964/): parisc: eisa: Fix infinite loop when parsing invalid IRQ value (not scored)
- [CVE-2026-89963](https://insights.sbomify.com/CVE-2026-89963/): powerpc/kexec_file: Fix null-ptr-def in extra size calculation (not scored)
- [CVE-2026-89962](https://insights.sbomify.com/CVE-2026-89962/): powerpc/kexec_file: Prevent kexec range truncation (not scored)
- [CVE-2026-89961](https://insights.sbomify.com/CVE-2026-89961/): powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population (high 7.8)
- [CVE-2026-89960](https://insights.sbomify.com/CVE-2026-89960/): s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm() (high 8.8)
- [CVE-2026-8996](https://insights.sbomify.com/CVE-2026-8996/): Missing authorization in Backup and Staging by WP Time Capsule (medium 6.5)
- [CVE-2026-89959](https://insights.sbomify.com/CVE-2026-89959/): s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove (high 8.8)
- [CVE-2026-89958](https://insights.sbomify.com/CVE-2026-89958/): s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL (not scored)
- [CVE-2026-89957](https://insights.sbomify.com/CVE-2026-89957/): s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed (high 8.8)
- [CVE-2026-89956](https://insights.sbomify.com/CVE-2026-89956/): s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects (not scored)
- [CVE-2026-89955](https://insights.sbomify.com/CVE-2026-89955/): s390/vfio-ap: Fix NULL deref in status_show() during queue probe (not scored)
- [CVE-2026-89954](https://insights.sbomify.com/CVE-2026-89954/): mtd: afs: validate v2 image info bounds (high 8.0)
- [CVE-2026-89953](https://insights.sbomify.com/CVE-2026-89953/): mtd: mtdoops: free page bitmap when the backing MTD is removed (not scored)
- [CVE-2026-89952](https://insights.sbomify.com/CVE-2026-89952/): mtd: rawnand: validate ONFI extended parameter page sections (not scored)
- [CVE-2026-89951](https://insights.sbomify.com/CVE-2026-89951/): batman-adv: fix stale receive device on merged fragments (high 8.8)
- [CVE-2026-89950](https://insights.sbomify.com/CVE-2026-89950/): batman-adv: mcast: linearize skbuff for packet generation (not scored)
- [CVE-2026-8995](https://insights.sbomify.com/CVE-2026-8995/): Missing authorization in Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls (medium 4.3)
- [CVE-2026-89949](https://insights.sbomify.com/CVE-2026-89949/): batman-adv: dat: avoid unaligned fault in IP extraction (not scored)
- [CVE-2026-89948](https://insights.sbomify.com/CVE-2026-89948/): batman-adv: bla: fix freeing of claims on meshif deletion (not scored)
- [CVE-2026-89947](https://insights.sbomify.com/CVE-2026-89947/): clk: meson: align gxbb_32k_clk_sel number of parents with actual count (high 8.0)
- [CVE-2026-89946](https://insights.sbomify.com/CVE-2026-89946/): ASoC: cs35l33: drain threaded IRQ before runtime suspend (not scored)
- [CVE-2026-89945](https://insights.sbomify.com/CVE-2026-89945/): ASoC: cs35l34: drain threaded IRQ before runtime suspend (not scored)
- [CVE-2026-89944](https://insights.sbomify.com/CVE-2026-89944/): ASoC: hdac_hda: Fix hlink refcount leak on component registration failure (not scored)
- [CVE-2026-89943](https://insights.sbomify.com/CVE-2026-89943/): ASoC: loongson: Fix error handling in ACPI property parsing (high 8.4)
- [CVE-2026-89942](https://insights.sbomify.com/CVE-2026-89942/): iio: buffer: Fix potential use-after-free in anonymous buffer release (high 7.8)
- [CVE-2026-89941](https://insights.sbomify.com/CVE-2026-89941/): iio: buffer: Make IIO DMA fence release RCU-safe (high 7.8)
- [CVE-2026-89940](https://insights.sbomify.com/CVE-2026-89940/): iio: buffer: Tie IIO dma fence lock lifetime to the fence (high 7.8)
- [CVE-2026-8994](https://insights.sbomify.com/CVE-2026-8994/): Login with NEAR <= 0.3.3 - Authentication Bypass via 'account' Parameter (high 8.1)
- [CVE-2026-89939](https://insights.sbomify.com/CVE-2026-89939/): iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (not scored)
- [CVE-2026-89938](https://insights.sbomify.com/CVE-2026-89938/): iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF (high 7.8)
- [CVE-2026-89937](https://insights.sbomify.com/CVE-2026-89937/): iio: chemical: sgp30: Handle IAQ thread creation failure (not scored)
- [CVE-2026-89936](https://insights.sbomify.com/CVE-2026-89936/): iio: dac: m62332: Fix regulator reference count imbalance (not scored)
- [CVE-2026-89935](https://insights.sbomify.com/CVE-2026-89935/): iio: light: apds9306: fix PM reference leak in apds9306_read_data() (not scored)
- [CVE-2026-89934](https://insights.sbomify.com/CVE-2026-89934/): iio: light: ltrf216a: fix runtime PM reference leak in error path (not scored)
- [CVE-2026-89933](https://insights.sbomify.com/CVE-2026-89933/): iio: pressure: dps310: fix NULL pointer dereference on ACPI probe (not scored)
- [CVE-2026-89932](https://insights.sbomify.com/CVE-2026-89932/): KVM: nVMX: Always flush vpid02 on first use (high 8.8)
- [CVE-2026-89931](https://insights.sbomify.com/CVE-2026-89931/): KVM: nVMX: Ensure KVM_REQ_GET_NESTED_STATE_PAGES is cleared on VM-Exit (not scored)
- [CVE-2026-89930](https://insights.sbomify.com/CVE-2026-89930/): KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (critical 9.3)
- [CVE-2026-8993](https://insights.sbomify.com/CVE-2026-8993/): Improper URL Handler Processing in D.Launcher 2 enables NTLM Credential Disclosure and SSRF attacks (medium 6.5)
- [CVE-2026-89929](https://insights.sbomify.com/CVE-2026-89929/): KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (high 8.8)
- [CVE-2026-89928](https://insights.sbomify.com/CVE-2026-89928/): KVM: x86/mmu: Consume the locked rmap value in the lockless rmap walk (high 8.8)
- [CVE-2026-89927](https://insights.sbomify.com/CVE-2026-89927/): KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (high 7.1)
- [CVE-2026-89926](https://insights.sbomify.com/CVE-2026-89926/): KVM: s390: Fix length check __import_wp_info() (not scored)
- [CVE-2026-89925](https://insights.sbomify.com/CVE-2026-89925/): KVM: s390: Fix memory leak in guest debug handling (not scored)
- [CVE-2026-89924](https://insights.sbomify.com/CVE-2026-89924/): KVM: s390: Fix old_data leak in guest debug error path (not scored)
- [CVE-2026-89923](https://insights.sbomify.com/CVE-2026-89923/): KVM: s390: Free guest debug data on vcpu destroy (not scored)
- [CVE-2026-89922](https://insights.sbomify.com/CVE-2026-89922/): KVM: s390: Take srcu when importing watchpoint data (high 7.8)
- [CVE-2026-89921](https://insights.sbomify.com/CVE-2026-89921/): KVM: s390: Zero initialize data structures for inject_pfault_token (not scored)
- [CVE-2026-89920](https://insights.sbomify.com/CVE-2026-89920/): KVM: s390: Fix memory corruption by not reinjecting CK machine checks (high 7.8)
- [CVE-2026-8992](https://insights.sbomify.com/CVE-2026-8992/): Security feature bypass in Secure Access Client (high 8.8)
- [CVE-2026-89919](https://insights.sbomify.com/CVE-2026-89919/): KVM: s390: keyop: use mmu_lock to read gmap->asce (high 7.8)
- [CVE-2026-89918](https://insights.sbomify.com/CVE-2026-89918/): KVM: arm64: Correctly handle end of VA space TLBI invalidation (critical 9.3)
- [CVE-2026-89917](https://insights.sbomify.com/CVE-2026-89917/): KVM: arm64: Handle VNCR TLB invalidation race with vcpu_put() VNCR unmapping (not scored)
- [CVE-2026-89916](https://insights.sbomify.com/CVE-2026-89916/): KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry (critical 9.3)
- [CVE-2026-89915](https://insights.sbomify.com/CVE-2026-89915/): KVM: arm64: Remove VM-wide VNCR mapping counter (critical 9.3)
- [CVE-2026-89914](https://insights.sbomify.com/CVE-2026-89914/): KVM: arm64: Sign-extend VA for range-based TLBI invalidation (critical 9.3)
- [CVE-2026-89913](https://insights.sbomify.com/CVE-2026-89913/): KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables (high 8.8)
- [CVE-2026-89912](https://insights.sbomify.com/CVE-2026-89912/): KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save (high 7.1)
- [CVE-2026-89911](https://insights.sbomify.com/CVE-2026-89911/): KVM: arm64: Correctly cap TLBI Range to the architural limit (high 7.9)
- [CVE-2026-89910](https://insights.sbomify.com/CVE-2026-89910/): LoongArch: KVM: Fix uninitialized stack variable issue with dmsintc (high 7.3)
- [CVE-2026-8991](https://insights.sbomify.com/CVE-2026-8991/): Cross-site scripting in Drag and Drop Multiple File Upload for Contact Form 7 (medium 4.4)
- [CVE-2026-89909](https://insights.sbomify.com/CVE-2026-89909/): LoongArch: KVM: Free init resources if kvm_init() fails (not scored)
- [CVE-2026-89908](https://insights.sbomify.com/CVE-2026-89908/): LoongArch: KVM: Preserve memslot arch flags on KVM_MR_FLAGS_ONLY (high 8.8)
- [CVE-2026-89907](https://insights.sbomify.com/CVE-2026-89907/): LoongArch: KVM: Validate MSI data before routing it to EIOINTC (high 8.8)
- [CVE-2026-89906](https://insights.sbomify.com/CVE-2026-89906/): LoongArch: BPF: Refactor jump offset calculation in tail call (high 7.8)
- [CVE-2026-89905](https://insights.sbomify.com/CVE-2026-89905/): LoongArch: BPF: Move arena register slot below TCC context (not scored)
- [CVE-2026-89904](https://insights.sbomify.com/CVE-2026-89904/): LoongArch: Fix acpi_package_ids[] array overflow (high 8.4)
- [CVE-2026-89903](https://insights.sbomify.com/CVE-2026-89903/): LoongArch: Do not save/restore percpu base register in rethook trampoline (high 7.8)
- [CVE-2026-89902](https://insights.sbomify.com/CVE-2026-89902/): LoongArch: Avoid preempt count underflow without probe (high 7.8)
- [CVE-2026-89901](https://insights.sbomify.com/CVE-2026-89901/): media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (not scored)
- [CVE-2026-89900](https://insights.sbomify.com/CVE-2026-89900/): media: cec: core: Fix kmemleak due to missed rc_free_device() call (not scored)
- [CVE-2026-8990](https://insights.sbomify.com/CVE-2026-8990/): Authentication Bypass in Kidsview (medium 5.3)
- [CVE-2026-89899](https://insights.sbomify.com/CVE-2026-89899/): media: cec: disable delayed work before freeing an interrupted transmit (high 7.8)
- [CVE-2026-89898](https://insights.sbomify.com/CVE-2026-89898/): media: cec: extron-da-hd-4k-plus: add sanity check (high 8.8)
- [CVE-2026-89897](https://insights.sbomify.com/CVE-2026-89897/): media: cec: Serialize exclusive follower delivery (high 7.5)
- [CVE-2026-89896](https://insights.sbomify.com/CVE-2026-89896/): media: cedrus: fix memory leak in cedrus_init_ctrls() (not scored)
- [CVE-2026-89895](https://insights.sbomify.com/CVE-2026-89895/): media: cobalt: Avoid freeing ALSA private data twice (not scored)
- [CVE-2026-89894](https://insights.sbomify.com/CVE-2026-89894/): media: cx231xx: reject geometry changes while the VBI queue is busy (high 7.8)
- [CVE-2026-89893](https://insights.sbomify.com/CVE-2026-89893/): media: cx23885: cancel NetUP CI work before teardown (high 7.8)
- [CVE-2026-89892](https://insights.sbomify.com/CVE-2026-89892/): media: em28xx: defer audio-only extension registration (not scored)
- [CVE-2026-89891](https://insights.sbomify.com/CVE-2026-89891/): media: em28xx: fix use-after-free of dev_next->devlist on disconnect (not scored)
- [CVE-2026-89890](https://insights.sbomify.com/CVE-2026-89890/): media: go7007: defer the ALSA v4l2 put until card release (high 7.8)
- [CVE-2026-8989](https://insights.sbomify.com/CVE-2026-8989/): Open Recovery Mode (high 8.6)
- [CVE-2026-89889](https://insights.sbomify.com/CVE-2026-89889/): media: i2c: imx415: Release runtime PM reference on VBLANK error (not scored)
- [CVE-2026-89888](https://insights.sbomify.com/CVE-2026-89888/): media: i2c: ov02a10: fix endpoint parsing use-after-free (high 7.8)
- [CVE-2026-89887](https://insights.sbomify.com/CVE-2026-89887/): media: i2c: ov7740: fix use-after-destroy in remove (high 7.8)
- [CVE-2026-89886](https://insights.sbomify.com/CVE-2026-89886/): media: intel/ipu6: fix async notifier cleanup leak on parse error (not scored)
- [CVE-2026-89885](https://insights.sbomify.com/CVE-2026-89885/): media: platform: mtk-mdp3: Fix SCP device refcounting (high 8.4)
- [CVE-2026-89884](https://insights.sbomify.com/CVE-2026-89884/): media: platform: mtk-mdp3: fix NULL deref on failed SCP lookup (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/270/