# Vulnerabilities published in 2026


- [CVE-2026-89610](https://insights.sbomify.com/CVE-2026-89610/): ntfs: verify run length exceeding volume boundary (critical 9.8)
- [CVE-2026-8961](https://insights.sbomify.com/CVE-2026-8961/): Spoofing issue in the Form Autofill component (medium 6.5)
- [CVE-2026-89609](https://insights.sbomify.com/CVE-2026-89609/): ecryptfs: hold msg ctx list lock when cleaning daemon queue (high 7.8)
- [CVE-2026-89608](https://insights.sbomify.com/CVE-2026-89608/): ecryptfs: pass packet set buffer size to parser (high 7.1)
- [CVE-2026-89607](https://insights.sbomify.com/CVE-2026-89607/): ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (high 7.8)
- [CVE-2026-89606](https://insights.sbomify.com/CVE-2026-89606/): ecryptfs: reject too-small tag 70 packets (high 7.8)
- [CVE-2026-89605](https://insights.sbomify.com/CVE-2026-89605/): ecryptfs: release message context on send failure (high 7.8)
- [CVE-2026-89604](https://insights.sbomify.com/CVE-2026-89604/): efivarfs: Rate limit statfs() handler (not scored)
- [CVE-2026-89602](https://insights.sbomify.com/CVE-2026-89602/): erofs: skip sufficiently large global buffers when resizing (high 7.8)
- [CVE-2026-89601](https://insights.sbomify.com/CVE-2026-89601/): ext2: Fix lost inode updates for IS_SYNC inodes (high 8.8)
- [CVE-2026-89600](https://insights.sbomify.com/CVE-2026-89600/): fanotify: fix use-after-free of file range info (high 7.8)
- [CVE-2026-8960](https://insights.sbomify.com/CVE-2026-8960/): Spoofing issue in WebExtensions (high 7.5)
- [CVE-2026-89599](https://insights.sbomify.com/CVE-2026-89599/): fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (high 8.4)
- [CVE-2026-89598](https://insights.sbomify.com/CVE-2026-89598/): fbdev: ssd1307fb: defer I2C transfers from damage callbacks (not scored)
- [CVE-2026-89597](https://insights.sbomify.com/CVE-2026-89597/): fbdev: uvesafb: unregister connector callback on init failure (high 7.8)
- [CVE-2026-89596](https://insights.sbomify.com/CVE-2026-89596/): forcedeth: fix off-by-one when saving/restoring non-PCI config space (high 7.1)
- [CVE-2026-89595](https://insights.sbomify.com/CVE-2026-89595/): fsnotify: Fix stale object mask after concurrent mark updates (not scored)
- [CVE-2026-89594](https://insights.sbomify.com/CVE-2026-89594/): hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (high 7.8)
- [CVE-2026-89593](https://insights.sbomify.com/CVE-2026-89593/): hugetlb: only adjust reservation during unmapping if mapcount is 0 (high 7.1)
- [CVE-2026-89592](https://insights.sbomify.com/CVE-2026-89592/): accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() (not scored)
- [CVE-2026-89591](https://insights.sbomify.com/CVE-2026-89591/): accel/rocket: initialize job domain before cleanup paths (not scored)
- [CVE-2026-89590](https://insights.sbomify.com/CVE-2026-89590/): accel/rocket: Fix error path handling in rocket_job_run() (not scored)
- [CVE-2026-8959](https://insights.sbomify.com/CVE-2026-8959/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (critical 9.6)
- [CVE-2026-89589](https://insights.sbomify.com/CVE-2026-89589/): acpi/apei/ghes: Use raw_spinlock_t for CXL CPER work locks (not scored)
- [CVE-2026-89588](https://insights.sbomify.com/CVE-2026-89588/): ACPI: APEI: GHES: fix ARM section length accounting after header (high 8.4)
- [CVE-2026-89587](https://insights.sbomify.com/CVE-2026-89587/): ACPI: pfr_update: fix stack buffer overflow in query_capability() (high 7.8)
- [CVE-2026-89586](https://insights.sbomify.com/CVE-2026-89586/): ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (high 8.2)
- [CVE-2026-89585](https://insights.sbomify.com/CVE-2026-89585/): auxdisplay: charlcd: cancel backlight work on registration failure (high 7.8)
- [CVE-2026-89584](https://insights.sbomify.com/CVE-2026-89584/): block: validate user space vectors during extraction (high 7.8)
- [CVE-2026-89583](https://insights.sbomify.com/CVE-2026-89583/): Bluetooth: eir: Fix OOB read in eir_get_service_data() (high 8.1)
- [CVE-2026-89582](https://insights.sbomify.com/CVE-2026-89582/): bnx2x: fix double free in bnx2x_init_firmware() error path (not scored)
- [CVE-2026-89581](https://insights.sbomify.com/CVE-2026-89581/): bpf, x86: Fix per-CPU address resolution into an extended register (high 7.8)
- [CVE-2026-89580](https://insights.sbomify.com/CVE-2026-89580/): bpf: Disable preemption in __bpf_get_stack (high 7.8)
- [CVE-2026-8958](https://insights.sbomify.com/CVE-2026-8958/): Information disclosure, sandbox escape in the Security: Process Sandboxing component (high 8.6)
- [CVE-2026-89579](https://insights.sbomify.com/CVE-2026-89579/): bpf: Harden bloom filter sizing and indexing on 32-bit kernels (high 7.8)
- [CVE-2026-89578](https://insights.sbomify.com/CVE-2026-89578/): dm-io: clone the source bio instead of copying its biovec (not scored)
- [CVE-2026-89577](https://insights.sbomify.com/CVE-2026-89577/): dm-io: report non-retryable errors separatedly (not scored)
- [CVE-2026-89576](https://insights.sbomify.com/CVE-2026-89576/): dm-era: fix shadowed superblock leak on take-snap failure (not scored)
- [CVE-2026-89575](https://insights.sbomify.com/CVE-2026-89575/): dm raid1: reserve space for NUL-terminator in build_constructor_string() (not scored)
- [CVE-2026-89574](https://insights.sbomify.com/CVE-2026-89574/): dm array: validate array block headers on read (high 7.8)
- [CVE-2026-89573](https://insights.sbomify.com/CVE-2026-89573/): dm array: reject an array block whose value size is not the caller's (high 7.8)
- [CVE-2026-89572](https://insights.sbomify.com/CVE-2026-89572/): cpufreq: apple-soc: Fix OPP table cleanup (not scored)
- [CVE-2026-89571](https://insights.sbomify.com/CVE-2026-89571/): cxl/features: bound fwctl command payload to the input buffer (high 7.1)
- [CVE-2026-89570](https://insights.sbomify.com/CVE-2026-89570/): cxl/mce: Make the MCE notifier per-region (high 7.8)
- [CVE-2026-8957](https://insights.sbomify.com/CVE-2026-8957/): Privilege escalation in the Enterprise Policies component (high 8.8)
- [CVE-2026-89569](https://insights.sbomify.com/CVE-2026-89569/): Bluetooth: RFCOMM: serialize security confirmation handling (high 8.8)
- [CVE-2026-89568](https://insights.sbomify.com/CVE-2026-89568/): kho: fix size calculation in kho_preserved_memory_reserve() (not scored)
- [CVE-2026-89567](https://insights.sbomify.com/CVE-2026-89567/): jbd2: bound shrinker scans by examined checkpoint buffers (not scored)
- [CVE-2026-89566](https://insights.sbomify.com/CVE-2026-89566/): jbd2: check need_resched() when skipping busy checkpoint buffers (not scored)
- [CVE-2026-89565](https://insights.sbomify.com/CVE-2026-89565/): ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (not scored)
- [CVE-2026-89564](https://insights.sbomify.com/CVE-2026-89564/): ip: orphan prefetched skbs before multicast forwarding (high 7.8)
- [CVE-2026-89563](https://insights.sbomify.com/CVE-2026-89563/): ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (high 7.8)
- [CVE-2026-89562](https://insights.sbomify.com/CVE-2026-89562/): ip6_gre: fix hardware header length for NBMA tunnels (high 7.8)
- [CVE-2026-89561](https://insights.sbomify.com/CVE-2026-89561/): ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() (high 7.5)
- [CVE-2026-89560](https://insights.sbomify.com/CVE-2026-89560/): landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (high 8.4)
- [CVE-2026-8956](https://insights.sbomify.com/CVE-2026-8956/): Integer overflow in the Networking: JAR component (critical 9.8)
- [CVE-2026-89559](https://insights.sbomify.com/CVE-2026-89559/): libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (high 7.8)
- [CVE-2026-89558](https://insights.sbomify.com/CVE-2026-89558/): md/raid10: fix still_degraded being inverted in raid10_sync_request() (critical 9.8)
- [CVE-2026-89557](https://insights.sbomify.com/CVE-2026-89557/): md: do overflow check for sb->bblog_shift in super_1_load() (high 7.8)
- [CVE-2026-89556](https://insights.sbomify.com/CVE-2026-89556/): module: validate string table section types (not scored)
- [CVE-2026-89555](https://insights.sbomify.com/CVE-2026-89555/): mpls: reload header after pskb_may_pull() (critical 9.8)
- [CVE-2026-89554](https://insights.sbomify.com/CVE-2026-89554/): mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (high 8.2)
- [CVE-2026-89553](https://insights.sbomify.com/CVE-2026-89553/): nouveau/gem: reserve the bo in the info ioctl around the vma lookup (high 7.8)
- [CVE-2026-89552](https://insights.sbomify.com/CVE-2026-89552/): params: fix charp corruption on allocation failure (not scored)
- [CVE-2026-89551](https://insights.sbomify.com/CVE-2026-89551/): SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (critical 9.8)
- [CVE-2026-89550](https://insights.sbomify.com/CVE-2026-89550/): SUNRPC: svcauth_gss: enforce krb5 token minimum length (critical 9.8)
- [CVE-2026-8955](https://insights.sbomify.com/CVE-2026-8955/): Privilege escalation in the DOM: Workers component (high 8.8)
- [CVE-2026-89549](https://insights.sbomify.com/CVE-2026-89549/): sunrpc: route to a populated pool in svc_pool_for_cpu() (high 7.5)
- [CVE-2026-89548](https://insights.sbomify.com/CVE-2026-89548/): SUNRPC: always drain cache_cleaner before destroying a cache_detail (high 7.8)
- [CVE-2026-89547](https://insights.sbomify.com/CVE-2026-89547/): SUNRPC: Check svc pool percpu counter allocation (high 8.1)
- [CVE-2026-89546](https://insights.sbomify.com/CVE-2026-89546/): SUNRPC: close backchannel before destroying callback service (critical 9.8)
- [CVE-2026-89545](https://insights.sbomify.com/CVE-2026-89545/): sunrpc: defer rq_argp and rq_resp free until after RCU grace period (high 7.8)
- [CVE-2026-89544](https://insights.sbomify.com/CVE-2026-89544/): SUNRPC: fix gssx_dec_option_array error path bugs (high 7.5)
- [CVE-2026-89543](https://insights.sbomify.com/CVE-2026-89543/): sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir (not scored)
- [CVE-2026-89542](https://insights.sbomify.com/CVE-2026-89542/): SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (critical 9.8)
- [CVE-2026-89541](https://insights.sbomify.com/CVE-2026-89541/): SUNRPC: harden gss_unwrap_resp_priv length checks (critical 9.8)
- [CVE-2026-89540](https://insights.sbomify.com/CVE-2026-89540/): sunrpc: init gssp_lock before publishing proc entry (high 7.8)
- [CVE-2026-8954](https://insights.sbomify.com/CVE-2026-8954/): Incorrect boundary conditions, integer overflow in the Audio/Video component (high 7.5)
- [CVE-2026-89539](https://insights.sbomify.com/CVE-2026-89539/): SUNRPC: reject duplicate CREDS_VALUE options (not scored)
- [CVE-2026-89538](https://insights.sbomify.com/CVE-2026-89538/): SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (critical 9.8)
- [CVE-2026-89537](https://insights.sbomify.com/CVE-2026-89537/): SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (critical 9.1)
- [CVE-2026-89536](https://insights.sbomify.com/CVE-2026-89536/): SUNRPC: wait for in-flight client TLS handshake callback (critical 9.8)
- [CVE-2026-89535](https://insights.sbomify.com/CVE-2026-89535/): svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id (high 8.1)
- [CVE-2026-89534](https://insights.sbomify.com/CVE-2026-89534/): svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (high 8.8)
- [CVE-2026-89533](https://insights.sbomify.com/CVE-2026-89533/): svcrdma: Fix offset arithmetic in read_chunk_range (critical 9.8)
- [CVE-2026-89532](https://insights.sbomify.com/CVE-2026-89532/): svcrdma: Fix pcl_for_each_segment for empty chunks (critical 9.1)
- [CVE-2026-89531](https://insights.sbomify.com/CVE-2026-89531/): svcrdma: Reject connection when transport allocation fails (not scored)
- [CVE-2026-89530](https://insights.sbomify.com/CVE-2026-89530/): svcrdma: Reject inline replies that overflow the pull-up buffer (critical 9.8)
- [CVE-2026-8953](https://insights.sbomify.com/CVE-2026-8953/): Sandbox escape due to use-after-free in the Disability Access APIs component (critical 9.6)
- [CVE-2026-89529](https://insights.sbomify.com/CVE-2026-89529/): svcrdma: Reject oversized Read segments at decode time (not scored)
- [CVE-2026-89528](https://insights.sbomify.com/CVE-2026-89528/): svcrdma: Reject Read lists that exceed the page budget (high 7.5)
- [CVE-2026-89527](https://insights.sbomify.com/CVE-2026-89527/): svcrdma: Use svc_xprt_put to free listener on create failure (not scored)
- [CVE-2026-89526](https://insights.sbomify.com/CVE-2026-89526/): svcrdma: Validate Read chunk positions before reconstruction (critical 9.8)
- [CVE-2026-89525](https://insights.sbomify.com/CVE-2026-89525/): udf: reject VAT indexes equal to the entry count (not scored)
- [CVE-2026-89524](https://insights.sbomify.com/CVE-2026-89524/): wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (high 8.1)
- [CVE-2026-89523](https://insights.sbomify.com/CVE-2026-89523/): wifi: mt76: mt7925: cancel pending mlo_pm_work (high 7.8)
- [CVE-2026-89522](https://insights.sbomify.com/CVE-2026-89522/): media: staging/ipu7: fix async notifier UAF on probe error path (high 7.8)
- [CVE-2026-89521](https://insights.sbomify.com/CVE-2026-89521/): sched/core: Handle pick_task() releasing the rq lock (high 7.3)
- [CVE-2026-89520](https://insights.sbomify.com/CVE-2026-89520/): sched/core: Make core-sched flips wait for in-flight selections (high 7.8)
- [CVE-2026-8952](https://insights.sbomify.com/CVE-2026-8952/): Privilege escalation in the Application Update component (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/274/