# Vulnerabilities published in 2026


- [CVE-2026-89792](https://insights.sbomify.com/CVE-2026-89792/): ksmbd: prevent out-of-bounds reads in share config responses (high 7.1)
- [CVE-2026-89791](https://insights.sbomify.com/CVE-2026-89791/): perf: Fix use-after-free when perf mmap() revival races with the last munmap() (high 7.8)
- [CVE-2026-89790](https://insights.sbomify.com/CVE-2026-89790/): ipv6: avoid divide by zero in rt6_multipath_rebalance (not scored)
- [CVE-2026-8979](https://insights.sbomify.com/CVE-2026-8979/): Authentication Bypass (critical 9.3)
- [CVE-2026-89789](https://insights.sbomify.com/CVE-2026-89789/): gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (high 7.8)
- [CVE-2026-89788](https://insights.sbomify.com/CVE-2026-89788/): ksmbd: fix tree connection use-after-free in smb2_tree_connect() (critical 9.8)
- [CVE-2026-89787](https://insights.sbomify.com/CVE-2026-89787/): ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (not scored)
- [CVE-2026-89786](https://insights.sbomify.com/CVE-2026-89786/): ext4: fix out-of-bounds read in ext4_read_inline_dir() (critical 9.1)
- [CVE-2026-89785](https://insights.sbomify.com/CVE-2026-89785/): fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init (not scored)
- [CVE-2026-89784](https://insights.sbomify.com/CVE-2026-89784/): SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (not scored)
- [CVE-2026-89783](https://insights.sbomify.com/CVE-2026-89783/): xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (critical 9.8)
- [CVE-2026-89782](https://insights.sbomify.com/CVE-2026-89782/): fs/ntfs3: reject restart table growth beyond U16_MAX entries (high 8.4)
- [CVE-2026-89781](https://insights.sbomify.com/CVE-2026-89781/): fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() (high 8.4)
- [CVE-2026-89780](https://insights.sbomify.com/CVE-2026-89780/): net: qualcomm: rmnet: restore skb->dev on deaggregated frames (not scored)
- [CVE-2026-8978](https://insights.sbomify.com/CVE-2026-8978/): OptinCraft <= 1.2.0 - Authenticated (Administrator+) SQL Injection via 'order_by' Parameter (medium 4.9)
- [CVE-2026-89779](https://insights.sbomify.com/CVE-2026-89779/): fs/ntfs3: validate ef->size covers the record's name and value (critical 9.1)
- [CVE-2026-89778](https://insights.sbomify.com/CVE-2026-89778/): isofs: fix out-of-bounds page array access on empty zisofs block (critical 9.8)
- [CVE-2026-89777](https://insights.sbomify.com/CVE-2026-89777/): vfio/pci: clear vdev->msi_perm after freeing it on init failure (high 8.8)
- [CVE-2026-89776](https://insights.sbomify.com/CVE-2026-89776/): vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (not scored)
- [CVE-2026-89775](https://insights.sbomify.com/CVE-2026-89775/): KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (critical 9.3)
- [CVE-2026-89774](https://insights.sbomify.com/CVE-2026-89774/): Bluetooth: SCO: hold sk properly in sco_conn_ready (high 8.8)
- [CVE-2026-89773](https://insights.sbomify.com/CVE-2026-89773/): drm/amd/display: Skip Update HDCP Config In Transition State (not scored)
- [CVE-2026-89772](https://insights.sbomify.com/CVE-2026-89772/): btrfs: write-protect folios during data writeback (not scored)
- [CVE-2026-89771](https://insights.sbomify.com/CVE-2026-89771/): ring-buffer: Fix subbuf resize race with ring buffer readers (high 7.8)
- [CVE-2026-89770](https://insights.sbomify.com/CVE-2026-89770/): iomap: don't free integrity payload that doesn't exist (not scored)
- [CVE-2026-8977](https://insights.sbomify.com/CVE-2026-8977/): Cross-site scripting in WP GDPR Cookie Consent (medium 6.4)
- [CVE-2026-89769](https://insights.sbomify.com/CVE-2026-89769/): clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (high 7.4)
- [CVE-2026-89768](https://insights.sbomify.com/CVE-2026-89768/): fs: fix user path of nested backing files (not scored)
- [CVE-2026-89767](https://insights.sbomify.com/CVE-2026-89767/): ovl: fix double end_creating() on the casefold-mismatch path (high 7.8)
- [CVE-2026-89766](https://insights.sbomify.com/CVE-2026-89766/): pidfd: hold exec_update_lock around namespace ioctl (not scored)
- [CVE-2026-89765](https://insights.sbomify.com/CVE-2026-89765/): timers/itimer: Zero-init old itimerval before copy to userspace (not scored)
- [CVE-2026-89764](https://insights.sbomify.com/CVE-2026-89764/): rust: devres: fix race between concurrent revokers (high 7.8)
- [CVE-2026-89763](https://insights.sbomify.com/CVE-2026-89763/): KEYS: trusted: Fix TPM teardown ordering (high 7.8)
- [CVE-2026-89762](https://insights.sbomify.com/CVE-2026-89762/): apparmor: fix cred UAF caused by begin_current_label_crit_section() (high 7.8)
- [CVE-2026-89761](https://insights.sbomify.com/CVE-2026-89761/): apparmor: fix out-of-bounds write when null terminating a label vec (high 7.8)
- [CVE-2026-89760](https://insights.sbomify.com/CVE-2026-89760/): mm, swap: don't free a hibernation slot that is in the swap cache (high 7.8)
- [CVE-2026-8976](https://insights.sbomify.com/CVE-2026-8976/): Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 4.3)
- [CVE-2026-89759](https://insights.sbomify.com/CVE-2026-89759/): mm/kmemleak: avoid soft lockup when scanning task stacks (not scored)
- [CVE-2026-89758](https://insights.sbomify.com/CVE-2026-89758/): mm/mempolicy: skip non-present PMDs when queueing folios (high 7.8)
- [CVE-2026-89757](https://insights.sbomify.com/CVE-2026-89757/): mm/mglru: fix and remove redundant unevictable folio handling (not scored)
- [CVE-2026-89756](https://insights.sbomify.com/CVE-2026-89756/): mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (not scored)
- [CVE-2026-89755](https://insights.sbomify.com/CVE-2026-89755/): mm/migrate_device: clear stale mapping after freeing swapcache (high 7.8)
- [CVE-2026-89754](https://insights.sbomify.com/CVE-2026-89754/): mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (high 7.8)
- [CVE-2026-89753](https://insights.sbomify.com/CVE-2026-89753/): mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (not scored)
- [CVE-2026-89752](https://insights.sbomify.com/CVE-2026-89752/): mm: memcg: stop reclaim when a limit update is superseded (not scored)
- [CVE-2026-89751](https://insights.sbomify.com/CVE-2026-89751/): x86/tdx: Fix off-by-one in port I/O handling (not scored)
- [CVE-2026-89750](https://insights.sbomify.com/CVE-2026-89750/): tracing/user_events: Clear copied tracing state before fork duplication (high 7.8)
- [CVE-2026-8975](https://insights.sbomify.com/CVE-2026-8975/): Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 (high 8.8)
- [CVE-2026-89749](https://insights.sbomify.com/CVE-2026-89749/): tracing: Fix crash passing ERR_PTR to kthread_stop() (not scored)
- [CVE-2026-89748](https://insights.sbomify.com/CVE-2026-89748/): tracing: Fix retry exhaustion in simple ring buffer reader swap (high 7.8)
- [CVE-2026-89747](https://insights.sbomify.com/CVE-2026-89747/): tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (high 7.8)
- [CVE-2026-89746](https://insights.sbomify.com/CVE-2026-89746/): tracing: Fix use-after-free with same-name named triggers (high 7.8)
- [CVE-2026-89745](https://insights.sbomify.com/CVE-2026-89745/): debugfs: Fix lockdown check for mmap_prepare (not scored)
- [CVE-2026-89744](https://insights.sbomify.com/CVE-2026-89744/): device property: fix infinite loop in fwnode_for_each_child_node() (high 8.4)
- [CVE-2026-89743](https://insights.sbomify.com/CVE-2026-89743/): misc: nsm: bound the device-reported response length (high 7.7)
- [CVE-2026-89742](https://insights.sbomify.com/CVE-2026-89742/): rapidio: mport_cdev: fix use-after-free in dma_req_free() (high 7.8)
- [CVE-2026-89741](https://insights.sbomify.com/CVE-2026-89741/): Revert "media: v4l2-dev: fix error handling in __video_register_device()" (high 7.8)
- [CVE-2026-89740](https://insights.sbomify.com/CVE-2026-89740/): serial: imx: serialize imx_uart_ports[] lifetime (not scored)
- [CVE-2026-8974](https://insights.sbomify.com/CVE-2026-8974/): Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 (high 8.8)
- [CVE-2026-89739](https://insights.sbomify.com/CVE-2026-89739/): usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (not scored)
- [CVE-2026-89738](https://insights.sbomify.com/CVE-2026-89738/): usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (high 7.8)
- [CVE-2026-89737](https://insights.sbomify.com/CVE-2026-89737/): usb: typec: thunderbolt: Disable work before freeing tbt on remove (not scored)
- [CVE-2026-89736](https://insights.sbomify.com/CVE-2026-89736/): usb: gadget: u_audio: Fix use-after-free on sound card disconnect (high 7.8)
- [CVE-2026-89735](https://insights.sbomify.com/CVE-2026-89735/): usb: gadget: midi2: remove default configfs groups on teardown (not scored)
- [CVE-2026-89734](https://insights.sbomify.com/CVE-2026-89734/): usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() (not scored)
- [CVE-2026-89733](https://insights.sbomify.com/CVE-2026-89733/): usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (high 7.8)
- [CVE-2026-89732](https://insights.sbomify.com/CVE-2026-89732/): usb: gadget: f_fs: Prevent deadlock during ep0 read loop (not scored)
- [CVE-2026-89731](https://insights.sbomify.com/CVE-2026-89731/): cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read (high 7.1)
- [CVE-2026-89730](https://insights.sbomify.com/CVE-2026-89730/): fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (not scored)
- [CVE-2026-8973](https://insights.sbomify.com/CVE-2026-8973/): Memory safety bugs fixed in Thunderbird 151 (high 8.8)
- [CVE-2026-89729](https://insights.sbomify.com/CVE-2026-89729/): HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (high 8.8)
- [CVE-2026-89728](https://insights.sbomify.com/CVE-2026-89728/): i3c: renesas: Fix out-of-bounds access for newdevs mask (not scored)
- [CVE-2026-89727](https://insights.sbomify.com/CVE-2026-89727/): KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID (not scored)
- [CVE-2026-89726](https://insights.sbomify.com/CVE-2026-89726/): lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (not scored)
- [CVE-2026-89725](https://insights.sbomify.com/CVE-2026-89725/): media: cec: stm32: prevent out-of-bounds write on RX overflow (high 8.8)
- [CVE-2026-89724](https://insights.sbomify.com/CVE-2026-89724/): media: vicodec: fix out-of-bounds write in FWHT encoder (high 7.8)
- [CVE-2026-89723](https://insights.sbomify.com/CVE-2026-89723/): nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (high 7.8)
- [CVE-2026-89722](https://insights.sbomify.com/CVE-2026-89722/): PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() (not scored)
- [CVE-2026-89721](https://insights.sbomify.com/CVE-2026-89721/): phy: rockchip-samsung-dcphy: fix out-of-range max_register (not scored)
- [CVE-2026-89720](https://insights.sbomify.com/CVE-2026-89720/): ubifs: fix out-of-bounds read in signature length check (high 7.7)
- [CVE-2026-8972](https://insights.sbomify.com/CVE-2026-8972/): Privilege escalation in the WebRTC: Audio/Video component (high 8.8)
- [CVE-2026-89719](https://insights.sbomify.com/CVE-2026-89719/): zram: fix out-of-bounds access in read_block_state() (not scored)
- [CVE-2026-89718](https://insights.sbomify.com/CVE-2026-89718/): zram: fix out-of-bounds access in writeback_store() (not scored)
- [CVE-2026-89717](https://insights.sbomify.com/CVE-2026-89717/): zram: set default primary compressor in zram_destroy_comps() (not scored)
- [CVE-2026-89716](https://insights.sbomify.com/CVE-2026-89716/): zram: validate deflate params (not scored)
- [CVE-2026-89715](https://insights.sbomify.com/CVE-2026-89715/): NFS/localio: fix ref leak on nfs_uuid_add_file failure (not scored)
- [CVE-2026-89714](https://insights.sbomify.com/CVE-2026-89714/): NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails (not scored)
- [CVE-2026-89713](https://insights.sbomify.com/CVE-2026-89713/): NFSD: check truncate permission under inode lock (critical 9.1)
- [CVE-2026-89712](https://insights.sbomify.com/CVE-2026-89712/): NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (critical 9.8)
- [CVE-2026-89711](https://insights.sbomify.com/CVE-2026-89711/): NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (high 8.2)
- [CVE-2026-89710](https://insights.sbomify.com/CVE-2026-89710/): NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (not scored)
- [CVE-2026-8971](https://insights.sbomify.com/CVE-2026-8971/): Same-origin policy bypass in the Networking: JAR component (medium 6.5)
- [CVE-2026-89709](https://insights.sbomify.com/CVE-2026-89709/): lockd, nfsd: RCU-protect nlmsvc_ops dispatch (high 8.1)
- [CVE-2026-89708](https://insights.sbomify.com/CVE-2026-89708/): nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown (critical 9.8)
- [CVE-2026-89707](https://insights.sbomify.com/CVE-2026-89707/): nfsd: release path refs on follow_down() error (high 7.5)
- [CVE-2026-89706](https://insights.sbomify.com/CVE-2026-89706/): nfsd: Reset write verifier when async COPY writeback fails (high 7.5)
- [CVE-2026-89705](https://insights.sbomify.com/CVE-2026-89705/): nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (high 7.1)
- [CVE-2026-89704](https://insights.sbomify.com/CVE-2026-89704/): nfsd: sample writeback error cursor before async COPY loop (high 7.5)
- [CVE-2026-89703](https://insights.sbomify.com/CVE-2026-89703/): nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (critical 9.8)
- [CVE-2026-89702](https://insights.sbomify.com/CVE-2026-89702/): nfsd: size fh_verify server sockaddr slot by xpt_locallen (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/272/