# Vulnerabilities published in 2026


- [CVE-2026-89701](https://insights.sbomify.com/CVE-2026-89701/): nfsd: validate nseconds in TIME_DELEG decode paths (not scored)
- [CVE-2026-89700](https://insights.sbomify.com/CVE-2026-89700/): nfsd: validate sockaddr length per family in listener_set (not scored)
- [CVE-2026-8970](https://insights.sbomify.com/CVE-2026-8970/): Privilege escalation in the Security component (high 8.8)
- [CVE-2026-89699](https://insights.sbomify.com/CVE-2026-89699/): nfsd: validate symlink target length in NFSv4 CREATE (high 7.5)
- [CVE-2026-89698](https://insights.sbomify.com/CVE-2026-89698/): nfsd: widen nfsd_genl_rqstp address fields to sockaddr_storage (not scored)
- [CVE-2026-89697](https://insights.sbomify.com/CVE-2026-89697/): nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (critical 9.1)
- [CVE-2026-89696](https://insights.sbomify.com/CVE-2026-89696/): nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (high 7.5)
- [CVE-2026-89695](https://insights.sbomify.com/CVE-2026-89695/): nfsd: cap decoded POSIX ACL count to bound sort cost (high 7.5)
- [CVE-2026-89694](https://insights.sbomify.com/CVE-2026-89694/): nfsd: check client ownership when cancelling a copy-notify stateid (not scored)
- [CVE-2026-89693](https://insights.sbomify.com/CVE-2026-89693/): nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() (not scored)
- [CVE-2026-89692](https://insights.sbomify.com/CVE-2026-89692/): nfsd: clear CALLBACK_RUNNING on failed delegation recall queue (high 7.5)
- [CVE-2026-89691](https://insights.sbomify.com/CVE-2026-89691/): nfsd: clear opcnt on compound arg release to prevent OOB read (high 7.1)
- [CVE-2026-89690](https://insights.sbomify.com/CVE-2026-89690/): nfsd: defer vfree of compound ops to fix rpc_status UAF (high 7.8)
- [CVE-2026-8969](https://insights.sbomify.com/CVE-2026-8969/): Mitigation bypass in the DOM: Security component (high 8.1)
- [CVE-2026-89689](https://insights.sbomify.com/CVE-2026-89689/): nfsd: don't free session slots that are still in use (critical 9.8)
- [CVE-2026-89688](https://insights.sbomify.com/CVE-2026-89688/): nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (critical 9.8)
- [CVE-2026-89687](https://insights.sbomify.com/CVE-2026-89687/): nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file (high 7.5)
- [CVE-2026-89686](https://insights.sbomify.com/CVE-2026-89686/): nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (critical 9.8)
- [CVE-2026-89685](https://insights.sbomify.com/CVE-2026-89685/): nfsd: fix clock domain mismatch in clients_still_reclaiming() (high 7.5)
- [CVE-2026-89684](https://insights.sbomify.com/CVE-2026-89684/): nfsd: fix cpntf publish race in nfs4_init_cp_state (high 7.5)
- [CVE-2026-89683](https://insights.sbomify.com/CVE-2026-89683/): nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (not scored)
- [CVE-2026-89682](https://insights.sbomify.com/CVE-2026-89682/): nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net (high 8.1)
- [CVE-2026-89681](https://insights.sbomify.com/CVE-2026-89681/): nfsd: fix layout fence worker double-reference race (critical 9.8)
- [CVE-2026-89680](https://insights.sbomify.com/CVE-2026-89680/): nfsd: fix nfsd_file leak on inter-server COPY setup failure (high 7.5)
- [CVE-2026-8968](https://insights.sbomify.com/CVE-2026-8968/): Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (high 7.5)
- [CVE-2026-89679](https://insights.sbomify.com/CVE-2026-89679/): nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs (high 7.5)
- [CVE-2026-89678](https://insights.sbomify.com/CVE-2026-89678/): nfsd: fix partial-write detection in nfsd_direct_write (high 7.5)
- [CVE-2026-89677](https://insights.sbomify.com/CVE-2026-89677/): nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() (critical 9.8)
- [CVE-2026-89676](https://insights.sbomify.com/CVE-2026-89676/): nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (critical 9.8)
- [CVE-2026-89675](https://insights.sbomify.com/CVE-2026-89675/): nfsd: fix UAF in async copy cancel and shutdown (critical 9.8)
- [CVE-2026-89674](https://insights.sbomify.com/CVE-2026-89674/): nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (critical 9.8)
- [CVE-2026-89673](https://insights.sbomify.com/CVE-2026-89673/): nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo (not scored)
- [CVE-2026-89672](https://insights.sbomify.com/CVE-2026-89672/): nfsd: gate nfs2 setacl by argp->mask (critical 9.1)
- [CVE-2026-89671](https://insights.sbomify.com/CVE-2026-89671/): nfsd: gate nfs3 setacl by argp->mask (critical 9.1)
- [CVE-2026-89670](https://insights.sbomify.com/CVE-2026-89670/): nfsd: hold rcu across localio cmpxchg retry (high 7.8)
- [CVE-2026-8967](https://insights.sbomify.com/CVE-2026-8967/): Information disclosure in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-89669](https://insights.sbomify.com/CVE-2026-89669/): nfsd: initialize copy-notify stateid before publishing it (critical 9.8)
- [CVE-2026-89668](https://insights.sbomify.com/CVE-2026-89668/): nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() (high 7.8)
- [CVE-2026-89667](https://insights.sbomify.com/CVE-2026-89667/): nfsd: close shrinker/GC/fsnotify vs per-net shutdown race in filecache (high 8.1)
- [CVE-2026-89666](https://insights.sbomify.com/CVE-2026-89666/): nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops (not scored)
- [CVE-2026-89665](https://insights.sbomify.com/CVE-2026-89665/): nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (high 8.2)
- [CVE-2026-89664](https://insights.sbomify.com/CVE-2026-89664/): nfsd: release OPEN-decoded posix ACLs via op_release (high 7.5)
- [CVE-2026-89663](https://insights.sbomify.com/CVE-2026-89663/): nfsd: revoke copy-notify stateids before dropping their reference (high 8.8)
- [CVE-2026-89662](https://insights.sbomify.com/CVE-2026-89662/): NFSD: Prevent lock owner use-after-free during client teardown (critical 9.8)
- [CVE-2026-89661](https://insights.sbomify.com/CVE-2026-89661/): NFSD: Prevent post-shutdown use-after-free in unlock_filesystem (not scored)
- [CVE-2026-89660](https://insights.sbomify.com/CVE-2026-89660/): NFSD: Prevent client use-after-free during admin state revocation (critical 9.8)
- [CVE-2026-8966](https://insights.sbomify.com/CVE-2026-8966/): Information disclosure in the IP Protection component (high 7.5)
- [CVE-2026-89659](https://insights.sbomify.com/CVE-2026-89659/): NFSD: Prevent client use-after-free during delegation revoke (critical 9.8)
- [CVE-2026-89658](https://insights.sbomify.com/CVE-2026-89658/): NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (critical 9.8)
- [CVE-2026-89657](https://insights.sbomify.com/CVE-2026-89657/): libceph: validate OSD extent maps before cursor advance (high 7.5)
- [CVE-2026-89656](https://insights.sbomify.com/CVE-2026-89656/): libceph: reject buckets with mismatched CRUSH ids (critical 9.8)
- [CVE-2026-89655](https://insights.sbomify.com/CVE-2026-89655/): ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (critical 9.8)
- [CVE-2026-89654](https://insights.sbomify.com/CVE-2026-89654/): ceph: fix UAF in check_new_map() on session freed during unlock (critical 9.8)
- [CVE-2026-89653](https://insights.sbomify.com/CVE-2026-89653/): ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (critical 9.8)
- [CVE-2026-89652](https://insights.sbomify.com/CVE-2026-89652/): ceph: bound copied dentry name length in NFS export get_name (critical 9.8)
- [CVE-2026-89651](https://insights.sbomify.com/CVE-2026-89651/): ceph: bound MDSCapAuth path and fs_name decode in handle_session() (critical 9.8)
- [CVE-2026-89650](https://insights.sbomify.com/CVE-2026-89650/): ceph: bound num_export_targets array for mds info v2/v3 (critical 9.1)
- [CVE-2026-8965](https://insights.sbomify.com/CVE-2026-8965/): Information disclosure in the DOM: Security component (high 7.5)
- [CVE-2026-89649](https://insights.sbomify.com/CVE-2026-89649/): ceph: bound xattr value length in __build_xattrs() (critical 9.1)
- [CVE-2026-89648](https://insights.sbomify.com/CVE-2026-89648/): ceph: cap delegated inode count in ceph_parse_deleg_inos() (high 7.5)
- [CVE-2026-89647](https://insights.sbomify.com/CVE-2026-89647/): ceph: do not repeat ceph_trim_dentries() if no progress possible (high 7.5)
- [CVE-2026-89646](https://insights.sbomify.com/CVE-2026-89646/): ceph: fix leaked inode reference on writeback abort at umount (high 7.8)
- [CVE-2026-89645](https://insights.sbomify.com/CVE-2026-89645/): btrfs: drop recovered reloc root refs on recovery failure (not scored)
- [CVE-2026-89644](https://insights.sbomify.com/CVE-2026-89644/): btrfs: fix extent map leak in NOCOW direct I/O write (not scored)
- [CVE-2026-89643](https://insights.sbomify.com/CVE-2026-89643/): audit: avoid dropping live tree ref on fsnotify rule autoremove (critical 9.8)
- [CVE-2026-89642](https://insights.sbomify.com/CVE-2026-89642/): cifs: call pagecache_isize_extended() in cifs_setsize() when extending (not scored)
- [CVE-2026-89641](https://insights.sbomify.com/CVE-2026-89641/): cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (high 7.8)
- [CVE-2026-89640](https://insights.sbomify.com/CVE-2026-89640/): cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (high 7.1)
- [CVE-2026-8964](https://insights.sbomify.com/CVE-2026-8964/): Spoofing issue in the Popup Blocker component (high 7.5)
- [CVE-2026-89639](https://insights.sbomify.com/CVE-2026-89639/): cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (high 7.1)
- [CVE-2026-89638](https://insights.sbomify.com/CVE-2026-89638/): smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (high 7.8)
- [CVE-2026-89637](https://insights.sbomify.com/CVE-2026-89637/): smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 (critical 9.8)
- [CVE-2026-89636](https://insights.sbomify.com/CVE-2026-89636/): smb: client: clear ce->tgthint in free_tgts() (critical 9.8)
- [CVE-2026-89635](https://insights.sbomify.com/CVE-2026-89635/): ksmbd: only rebind the reopened file's own oplock on durable reconnect (critical 9.8)
- [CVE-2026-89634](https://insights.sbomify.com/CVE-2026-89634/): smb: client: fix ALIGN() overflow in symlink_data() error context loop (critical 9.1)
- [CVE-2026-89633](https://insights.sbomify.com/CVE-2026-89633/): smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (critical 9.8)
- [CVE-2026-89632](https://insights.sbomify.com/CVE-2026-89632/): smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() (high 8.2)
- [CVE-2026-89631](https://insights.sbomify.com/CVE-2026-89631/): smb: client: reject a tree connect response whose byte count is too small (critical 9.1)
- [CVE-2026-89630](https://insights.sbomify.com/CVE-2026-89630/): smb: client: restore the data_offset bound in is_valid_oplock_break() (critical 9.1)
- [CVE-2026-8963](https://insights.sbomify.com/CVE-2026-8963/): Spoofing issue in the Web Speech component (high 7.5)
- [CVE-2026-89629](https://insights.sbomify.com/CVE-2026-89629/): HID: corsair-void: Check size of status and firmware events before reading them (not scored)
- [CVE-2026-89628](https://insights.sbomify.com/CVE-2026-89628/): HID: picolcd: clamp eeprom debugfs read to bytes actually received (not scored)
- [CVE-2026-89627](https://insights.sbomify.com/CVE-2026-89627/): HID: roccat: free buffered reports when destroying device (not scored)
- [CVE-2026-89626](https://insights.sbomify.com/CVE-2026-89626/): HID: sensor: custom: Fix field sysfs group cleanup on failure (high 8.8)
- [CVE-2026-89625](https://insights.sbomify.com/CVE-2026-89625/): HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind (not scored)
- [CVE-2026-89624](https://insights.sbomify.com/CVE-2026-89624/): HID: universal-pidff: stop the device when force-feedback init fails (high 7.8)
- [CVE-2026-89623](https://insights.sbomify.com/CVE-2026-89623/): HID: mcp2221: stop device IO before hid_hw_stop (not scored)
- [CVE-2026-89622](https://insights.sbomify.com/CVE-2026-89622/): HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes (high 7.8)
- [CVE-2026-89621](https://insights.sbomify.com/CVE-2026-89621/): HID: mcp2221: validate report size in mcp2221_raw_event() (not scored)
- [CVE-2026-89620](https://insights.sbomify.com/CVE-2026-89620/): HID: intel-thc-hid: intel-quickspi: validate report size before copy (high 7.8)
- [CVE-2026-8962](https://insights.sbomify.com/CVE-2026-8962/): Mitigation bypass in the DOM: Security component (high 8.1)
- [CVE-2026-89619](https://insights.sbomify.com/CVE-2026-89619/): HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer (high 7.8)
- [CVE-2026-89618](https://insights.sbomify.com/CVE-2026-89618/): eventfs: Initialize ei->children and ei->list in init_ei() (not scored)
- [CVE-2026-89617](https://insights.sbomify.com/CVE-2026-89617/): fs/ntfs3: validate dirty page table on log replay (high 7.8)
- [CVE-2026-89616](https://insights.sbomify.com/CVE-2026-89616/): fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (high 7.5)
- [CVE-2026-89615](https://insights.sbomify.com/CVE-2026-89615/): fs/ntfs3: bound page_lcns[] index by the log record (high 8.4)
- [CVE-2026-89614](https://insights.sbomify.com/CVE-2026-89614/): ntfs: bound the free-cluster bitmap scan to the volume (critical 9.8)
- [CVE-2026-89613](https://insights.sbomify.com/CVE-2026-89613/): ntfs: reject invalid empty mapping pairs (critical 9.8)
- [CVE-2026-89612](https://insights.sbomify.com/CVE-2026-89612/): ntfs: reject invalid MFT LCNs from boot sector (critical 9.8)
- [CVE-2026-89611](https://insights.sbomify.com/CVE-2026-89611/): ntfs: validate non-resident attribute offsets (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/273/