# Vulnerabilities published in 2026


- [CVE-2026-89883](https://insights.sbomify.com/CVE-2026-89883/): media: rc: sunxi-cir: Unregister rc device on probe failure (high 7.8)
- [CVE-2026-89882](https://insights.sbomify.com/CVE-2026-89882/): media: rkvdec: hevc: guard INTER_REF_PIC_SET_PRED index underflow (high 7.8)
- [CVE-2026-89881](https://insights.sbomify.com/CVE-2026-89881/): media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (not scored)
- [CVE-2026-89880](https://insights.sbomify.com/CVE-2026-89880/): media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (high 7.8)
- [CVE-2026-8988](https://insights.sbomify.com/CVE-2026-8988/): Access to Bootloader (high 8.6)
- [CVE-2026-89879](https://insights.sbomify.com/CVE-2026-89879/): media: s2255: bound JPEG frame size before copying into the buffer (not scored)
- [CVE-2026-89878](https://insights.sbomify.com/CVE-2026-89878/): media: s2255: check firmware size before reading trailing marker (not scored)
- [CVE-2026-89877](https://insights.sbomify.com/CVE-2026-89877/): media: saa7164: fix cleanup on resource allocation failure (high 8.4)
- [CVE-2026-89876](https://insights.sbomify.com/CVE-2026-89876/): media: tda18250: fix possible integer overflow (not scored)
- [CVE-2026-89875](https://insights.sbomify.com/CVE-2026-89875/): media: ti: vpe: quiesce overflow recovery before freeing streams (high 7.8)
- [CVE-2026-89874](https://insights.sbomify.com/CVE-2026-89874/): media: v4l2-async: avoid deleting unlinked ASC entry on link error (not scored)
- [CVE-2026-89873](https://insights.sbomify.com/CVE-2026-89873/): media: v4l2-ctrls: validate HEVC EXT SPS RPS counts (high 7.8)
- [CVE-2026-89872](https://insights.sbomify.com/CVE-2026-89872/): media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (not scored)
- [CVE-2026-89871](https://insights.sbomify.com/CVE-2026-89871/): media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (not scored)
- [CVE-2026-89870](https://insights.sbomify.com/CVE-2026-89870/): media: zoran: Avoid freeing a registered video_device twice (high 7.8)
- [CVE-2026-8987](https://insights.sbomify.com/CVE-2026-8987/): Authenticated Heap Overflow (critical 9.4)
- [CVE-2026-89869](https://insights.sbomify.com/CVE-2026-89869/): media: qcom: iris: use disable_irq() during power-off (not scored)
- [CVE-2026-89868](https://insights.sbomify.com/CVE-2026-89868/): media: chips-media: wave5: Add timeout while stop_streaming (not scored)
- [CVE-2026-89867](https://insights.sbomify.com/CVE-2026-89867/): media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued (not scored)
- [CVE-2026-89866](https://insights.sbomify.com/CVE-2026-89866/): media: chips-media: wave5: Resume device before setting EOS flag (not scored)
- [CVE-2026-89865](https://insights.sbomify.com/CVE-2026-89865/): scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (not scored)
- [CVE-2026-89864](https://insights.sbomify.com/CVE-2026-89864/): scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (not scored)
- [CVE-2026-89863](https://insights.sbomify.com/CVE-2026-89863/): scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (high 7.5)
- [CVE-2026-89862](https://insights.sbomify.com/CVE-2026-89862/): scsi: qla2xxx: Fix BSG job leak on validate flash image error path (not scored)
- [CVE-2026-89861](https://insights.sbomify.com/CVE-2026-89861/): scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (high 8.1)
- [CVE-2026-89860](https://insights.sbomify.com/CVE-2026-89860/): scsi: qla2xxx: Initialize NVMe abort_work once at submission (high 8.8)
- [CVE-2026-8986](https://insights.sbomify.com/CVE-2026-8986/): Command Injection via Malicious OCPP Server (critical 9.5)
- [CVE-2026-89859](https://insights.sbomify.com/CVE-2026-89859/): scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak (not scored)
- [CVE-2026-89858](https://insights.sbomify.com/CVE-2026-89858/): scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (not scored)
- [CVE-2026-89857](https://insights.sbomify.com/CVE-2026-89857/): scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject (critical 9.8)
- [CVE-2026-89856](https://insights.sbomify.com/CVE-2026-89856/): scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (high 8.4)
- [CVE-2026-89855](https://insights.sbomify.com/CVE-2026-89855/): scsi: qla2xxx: Serialize flash version read in reset handler (not scored)
- [CVE-2026-89854](https://insights.sbomify.com/CVE-2026-89854/): scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (high 7.8)
- [CVE-2026-89853](https://insights.sbomify.com/CVE-2026-89853/): scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (not scored)
- [CVE-2026-89852](https://insights.sbomify.com/CVE-2026-89852/): scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (not scored)
- [CVE-2026-89851](https://insights.sbomify.com/CVE-2026-89851/): scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (not scored)
- [CVE-2026-89850](https://insights.sbomify.com/CVE-2026-89850/): scsi: qla2xxx: Don't query firmware state while chip is down (not scored)
- [CVE-2026-8985](https://insights.sbomify.com/CVE-2026-8985/): Unauthenticated Command Injection (critical 10.0)
- [CVE-2026-89849](https://insights.sbomify.com/CVE-2026-89849/): scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (high 8.8)
- [CVE-2026-89848](https://insights.sbomify.com/CVE-2026-89848/): scsi: qla2xxx: Quiesce response IRQ before freeing request queue (high 8.1)
- [CVE-2026-89847](https://insights.sbomify.com/CVE-2026-89847/): scsi: qla2xxx: Avoid double completion in async IOCB timeout (critical 9.8)
- [CVE-2026-89846](https://insights.sbomify.com/CVE-2026-89846/): scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (critical 9.1)
- [CVE-2026-89845](https://insights.sbomify.com/CVE-2026-89845/): scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (not scored)
- [CVE-2026-89844](https://insights.sbomify.com/CVE-2026-89844/): scsi: qla2xxx: Hold vport_slock for host map update in report ID acquisition (high 8.8)
- [CVE-2026-89843](https://insights.sbomify.com/CVE-2026-89843/): scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (not scored)
- [CVE-2026-89842](https://insights.sbomify.com/CVE-2026-89842/): scsi: qla2xxx: Skip NVMe LS reject IOCB when FW not started (not scored)
- [CVE-2026-89841](https://insights.sbomify.com/CVE-2026-89841/): f2fs: only redirty pinned folios in redirty_blocks (high 7.8)
- [CVE-2026-89840](https://insights.sbomify.com/CVE-2026-89840/): f2fs: validate MOVE_RANGE destination size (high 7.1)
- [CVE-2026-8984](https://insights.sbomify.com/CVE-2026-8984/): Unauthenticated RCE (critical 10.0)
- [CVE-2026-89839](https://insights.sbomify.com/CVE-2026-89839/): f2fs: use the mount idmap for the owner check in f2fs_xattr_advise_set() (not scored)
- [CVE-2026-89838](https://insights.sbomify.com/CVE-2026-89838/): f2fs: limit recovery filename logging to stored length (high 7.1)
- [CVE-2026-89837](https://insights.sbomify.com/CVE-2026-89837/): f2fs: fix dentry folio leak in find_in_level (not scored)
- [CVE-2026-89836](https://insights.sbomify.com/CVE-2026-89836/): f2fs: fix folio_nr_pages() race after put in large folio invalidate (high 7.8)
- [CVE-2026-89835](https://insights.sbomify.com/CVE-2026-89835/): f2fs: avoid NULL checkpoint thread access in sysfs (not scored)
- [CVE-2026-89834](https://insights.sbomify.com/CVE-2026-89834/): f2fs: fix to migrate all curseg types during free_segment_range (not scored)
- [CVE-2026-89833](https://insights.sbomify.com/CVE-2026-89833/): f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() (not scored)
- [CVE-2026-89832](https://insights.sbomify.com/CVE-2026-89832/): f2fs: fix to clear dirty flag on folio in error path (high 7.8)
- [CVE-2026-89831](https://insights.sbomify.com/CVE-2026-89831/): f2fs: protect critical_task_priority updates with s_umount (not scored)
- [CVE-2026-89830](https://insights.sbomify.com/CVE-2026-89830/): f2fs: fix valid block count leak on data block allocation failure (not scored)
- [CVE-2026-8983](https://insights.sbomify.com/CVE-2026-8983/): Backdoor Authentication Token (critical 10.0)
- [CVE-2026-89829](https://insights.sbomify.com/CVE-2026-89829/): f2fs: fix to pass folio->index to f2fs_sanity_check_node_footer() (high 7.8)
- [CVE-2026-89828](https://insights.sbomify.com/CVE-2026-89828/): drm/amdgpu: Fix init ordering in amdgpu_vram_mgr_init() (not scored)
- [CVE-2026-89827](https://insights.sbomify.com/CVE-2026-89827/): drm/amdgpu: avoid force-completing uninitialized UVD rings (not scored)
- [CVE-2026-89826](https://insights.sbomify.com/CVE-2026-89826/): drm/panthor: harden firmware build-info bounds checks (high 7.1)
- [CVE-2026-89825](https://insights.sbomify.com/CVE-2026-89825/): drm/panthor: fix firmware control interface bounds checks (high 7.8)
- [CVE-2026-89824](https://insights.sbomify.com/CVE-2026-89824/): drm/panel-edp: fix i2c adapter leak on probe failure (not scored)
- [CVE-2026-89823](https://insights.sbomify.com/CVE-2026-89823/): drm: fix race between partial drm_dev_register() failure and ioctl (high 7.8)
- [CVE-2026-89822](https://insights.sbomify.com/CVE-2026-89822/): drm/i915: Guard against NULL driver_data in i915_pci_probe() (not scored)
- [CVE-2026-89821](https://insights.sbomify.com/CVE-2026-89821/): drm/amd/display: avoid divide-by-zero in __is_lut_linear() (not scored)
- [CVE-2026-89820](https://insights.sbomify.com/CVE-2026-89820/): drm/amd/display: fix dc_lock leak on GPU reset error paths (not scored)
- [CVE-2026-8982](https://insights.sbomify.com/CVE-2026-8982/): Hard-coded / Backdoor Accounts (critical 10.0)
- [CVE-2026-89819](https://insights.sbomify.com/CVE-2026-89819/): drm/amd/display: validate plane degamma LUT size for private color prop (high 7.8)
- [CVE-2026-89818](https://insights.sbomify.com/CVE-2026-89818/): drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (high 7.1)
- [CVE-2026-89817](https://insights.sbomify.com/CVE-2026-89817/): drm/gud: NUL-terminate TV mode names read from the device (not scored)
- [CVE-2026-89816](https://insights.sbomify.com/CVE-2026-89816/): drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (not scored)
- [CVE-2026-89815](https://insights.sbomify.com/CVE-2026-89815/): drm/ttm: Drop tt->restore after successful restore (high 7.8)
- [CVE-2026-89814](https://insights.sbomify.com/CVE-2026-89814/): drm/amdgpu: clamp the isolation index for rings outside a partition (high 7.8)
- [CVE-2026-89813](https://insights.sbomify.com/CVE-2026-89813/): drm/amdgpu: force complete the KIQ ring fences on reset (not scored)
- [CVE-2026-89812](https://insights.sbomify.com/CVE-2026-89812/): drm/amdgpu: force complete the MES ring fences on reset (not scored)
- [CVE-2026-89811](https://insights.sbomify.com/CVE-2026-89811/): drm/amdkfd: Add TLB flush after MES queue eviction/suspension (high 8.8)
- [CVE-2026-89810](https://insights.sbomify.com/CVE-2026-89810/): drm/amdkfd: Fix error path at svm_migrate_copy_to_ram (high 7.8)
- [CVE-2026-8981](https://insights.sbomify.com/CVE-2026-8981/): Lazy Blocks < 4.3.0 - Admin+ Stored XSS via Custom Block Frontend HTML (low 3.5)
- [CVE-2026-89809](https://insights.sbomify.com/CVE-2026-89809/): drm/amdkfd: fix scope of mqd_mgr dereference in pqm_debugfs_mqds (not scored)
- [CVE-2026-89808](https://insights.sbomify.com/CVE-2026-89808/): drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram (high 7.8)
- [CVE-2026-89807](https://insights.sbomify.com/CVE-2026-89807/): drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore (not scored)
- [CVE-2026-89806](https://insights.sbomify.com/CVE-2026-89806/): drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation (high 8.4)
- [CVE-2026-89805](https://insights.sbomify.com/CVE-2026-89805/): drm/pagemap: Fix folio allocation fallback and use-after-put (high 7.8)
- [CVE-2026-89804](https://insights.sbomify.com/CVE-2026-89804/): drm/nouveau/dmem: fix mismatched DMA unmap size for large folios (high 8.8)
- [CVE-2026-89803](https://insights.sbomify.com/CVE-2026-89803/): drm/nouveau: unsubscribe the channel-kill event before the fence context (high 7.8)
- [CVE-2026-89802](https://insights.sbomify.com/CVE-2026-89802/): drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op (not scored)
- [CVE-2026-89801](https://insights.sbomify.com/CVE-2026-89801/): drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE (high 7.8)
- [CVE-2026-89800](https://insights.sbomify.com/CVE-2026-89800/): drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE (not scored)
- [CVE-2026-8980](https://insights.sbomify.com/CVE-2026-8980/): Privilege Escalation (critical 9.3)
- [CVE-2026-89799](https://insights.sbomify.com/CVE-2026-89799/): bpf: Disable preemption in bpf_get_stackid (high 7.8)
- [CVE-2026-89798](https://insights.sbomify.com/CVE-2026-89798/): rpcrdma: arm rn_done before publishing the notification (not scored)
- [CVE-2026-89797](https://insights.sbomify.com/CVE-2026-89797/): power: supply: ab8500_fg: fix use-after-free on remove (not scored)
- [CVE-2026-89796](https://insights.sbomify.com/CVE-2026-89796/): mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (not scored)
- [CVE-2026-89795](https://insights.sbomify.com/CVE-2026-89795/): PCI: Allow per function PCI slots to fix slot reset on s390 (high 8.4)
- [CVE-2026-89794](https://insights.sbomify.com/CVE-2026-89794/): ksmbd: zero pipe read compound padding (not scored)
- [CVE-2026-89793](https://insights.sbomify.com/CVE-2026-89793/): ublk: clear VM_MAYWRITE on read-only ublk char device mmap (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/271/