# Vulnerabilities published in 2026


- [CVE-2026-89519](https://insights.sbomify.com/CVE-2026-89519/): sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return (not scored)
- [CVE-2026-89518](https://insights.sbomify.com/CVE-2026-89518/): sched_ext: Fix this_rq() assumptions in dispatch kfuncs (not scored)
- [CVE-2026-89517](https://insights.sbomify.com/CVE-2026-89517/): sched_ext: Fix rq->core_pick corruption under core scheduling (not scored)
- [CVE-2026-89516](https://insights.sbomify.com/CVE-2026-89516/): sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users (not scored)
- [CVE-2026-89515](https://insights.sbomify.com/CVE-2026-89515/): scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (not scored)
- [CVE-2026-89514](https://insights.sbomify.com/CVE-2026-89514/): scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock (not scored)
- [CVE-2026-89513](https://insights.sbomify.com/CVE-2026-89513/): RISC-V: KVM: Fix PMU event info array size overflow (high 8.8)
- [CVE-2026-89512](https://insights.sbomify.com/CVE-2026-89512/): remoteproc: scp: Fix device reference leak on failed lookup (not scored)
- [CVE-2026-89511](https://insights.sbomify.com/CVE-2026-89511/): qede: Fix NULL pointer dereference in TPA fragment processing (high 7.5)
- [CVE-2026-89510](https://insights.sbomify.com/CVE-2026-89510/): RDMA/cxgb4: Cancel reg_work before freeing device on remove (high 7.8)
- [CVE-2026-8951](https://insights.sbomify.com/CVE-2026-8951/): Spoofing issue in the Toolbar component in Firefox for Android (medium 6.5)
- [CVE-2026-89509](https://insights.sbomify.com/CVE-2026-89509/): RDMA/ionic: Embed counter driver data in rdma_counter allocation (not scored)
- [CVE-2026-89508](https://insights.sbomify.com/CVE-2026-89508/): RDMA/ucma: Lock the handler in ucma_set_ib_path() (high 7.8)
- [CVE-2026-89507](https://insights.sbomify.com/CVE-2026-89507/): RDMA/ucma: Lock the handler in ucma_write_cm_event() (high 7.8)
- [CVE-2026-89506](https://insights.sbomify.com/CVE-2026-89506/): RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR (not scored)
- [CVE-2026-89505](https://insights.sbomify.com/CVE-2026-89505/): RDMA/uverbs: Guard legacy bundles without method_elm (not scored)
- [CVE-2026-89504](https://insights.sbomify.com/CVE-2026-89504/): regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (high 8.4)
- [CVE-2026-89503](https://insights.sbomify.com/CVE-2026-89503/): ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (high 7.8)
- [CVE-2026-89502](https://insights.sbomify.com/CVE-2026-89502/): ring-buffer: Free cpu_buffer::free_page with subbuf_order (not scored)
- [CVE-2026-89501](https://insights.sbomify.com/CVE-2026-89501/): ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (high 7.8)
- [CVE-2026-89500](https://insights.sbomify.com/CVE-2026-89500/): ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (high 7.8)
- [CVE-2026-8950](https://insights.sbomify.com/CVE-2026-8950/): Same-origin policy bypass in the Networking: HTTP component (critical 9.3)
- [CVE-2026-89499](https://insights.sbomify.com/CVE-2026-89499/): ring-buffer: Stop remote reader update when page swap fails (high 7.8)
- [CVE-2026-89498](https://insights.sbomify.com/CVE-2026-89498/): orangefs: fix double-free of trailer_buf on readdir copy failure (not scored)
- [CVE-2026-89497](https://insights.sbomify.com/CVE-2026-89497/): orangefs: skip leading spaces before parsing client debug masks (high 7.8)
- [CVE-2026-89496](https://insights.sbomify.com/CVE-2026-89496/): ocfs2: always run deallocs on copy-on-write completion (not scored)
- [CVE-2026-89495](https://insights.sbomify.com/CVE-2026-89495/): ocfs2: bound namelen in dlm_migrate_request_handler (critical 9.8)
- [CVE-2026-89494](https://insights.sbomify.com/CVE-2026-89494/): ocfs2: validate lengths in dlm_mig_lockres_handler (critical 9.8)
- [CVE-2026-89493](https://insights.sbomify.com/CVE-2026-89493/): ocfs2: validate rl_used against rl_count in refcount block validator (high 8.8)
- [CVE-2026-89492](https://insights.sbomify.com/CVE-2026-89492/): ocfs2: validate directory-index entry counts when reading metadata (critical 9.8)
- [CVE-2026-89491](https://insights.sbomify.com/CVE-2026-89491/): ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (not scored)
- [CVE-2026-89490](https://insights.sbomify.com/CVE-2026-89490/): ocfs2: fix readdir position truncation on 32-bit kernels (not scored)
- [CVE-2026-8949](https://insights.sbomify.com/CVE-2026-8949/): Integer overflow in the Widget: Win32 component (high 7.5)
- [CVE-2026-89489](https://insights.sbomify.com/CVE-2026-89489/): openrisc: fix arbitrary kernel memory access via or1k_atomic syscall (high 7.8)
- [CVE-2026-89488](https://insights.sbomify.com/CVE-2026-89488/): openvswitch: Fix CT limit teardown use-after-free (high 7.8)
- [CVE-2026-89487](https://insights.sbomify.com/CVE-2026-89487/): openvswitch: only skb_tx_error() a packet we are about to drop (high 7.8)
- [CVE-2026-89486](https://insights.sbomify.com/CVE-2026-89486/): ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (high 7.8)
- [CVE-2026-89485](https://insights.sbomify.com/CVE-2026-89485/): lockd: pin next file across nlm_inspect_file lock-drop (critical 9.8)
- [CVE-2026-89484](https://insights.sbomify.com/CVE-2026-89484/): lockd: fix NULL dereference on lockowner allocation failure (not scored)
- [CVE-2026-89483](https://insights.sbomify.com/CVE-2026-89483/): nvme: zero the discard fallback page (high 7.5)
- [CVE-2026-89482](https://insights.sbomify.com/CVE-2026-89482/): nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (critical 9.8)
- [CVE-2026-89481](https://insights.sbomify.com/CVE-2026-89481/): nvme-tcp: fix host memory disclosure on R2T for a read command (high 7.5)
- [CVE-2026-89480](https://insights.sbomify.com/CVE-2026-89480/): nvme-tcp: reject a read that transferred too few bytes (high 7.5)
- [CVE-2026-8948](https://insights.sbomify.com/CVE-2026-8948/): Same-origin policy bypass in the DOM: Networking component (critical 9.1)
- [CVE-2026-89479](https://insights.sbomify.com/CVE-2026-89479/): sctp: stop processing a packet once its association is deleted (critical 9.8)
- [CVE-2026-89478](https://insights.sbomify.com/CVE-2026-89478/): sctp: drop a chunk if its transport was removed (critical 9.8)
- [CVE-2026-89477](https://insights.sbomify.com/CVE-2026-89477/): sctp: fix NULL deref on untransmitted RECONF completion (high 7.5)
- [CVE-2026-89476](https://insights.sbomify.com/CVE-2026-89476/): sctp: fix stream->outcnt underflow on duplicate RECONF responses (high 7.5)
- [CVE-2026-89475](https://insights.sbomify.com/CVE-2026-89475/): power: supply: bq24257: fix use-after-free on remove (not scored)
- [CVE-2026-89474](https://insights.sbomify.com/CVE-2026-89474/): power: supply: bq256xx: drain usb_work before freeing the charger (not scored)
- [CVE-2026-89473](https://insights.sbomify.com/CVE-2026-89473/): power: supply: bq25890: Fix power_supply reference leak (not scored)
- [CVE-2026-89472](https://insights.sbomify.com/CVE-2026-89472/): power: supply: charger-manager: register regulators before exposing sysfs (high 7.8)
- [CVE-2026-89471](https://insights.sbomify.com/CVE-2026-89471/): power: supply: cros_usbpd-charger: bound the EC-reported port count (high 8.4)
- [CVE-2026-89470](https://insights.sbomify.com/CVE-2026-89470/): power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (high 8.4)
- [CVE-2026-8947](https://insights.sbomify.com/CVE-2026-8947/): Use-after-free in the DOM: Bindings (WebIDL) component (high 7.3)
- [CVE-2026-89469](https://insights.sbomify.com/CVE-2026-89469/): power: supply: lp8727: fix use-after-free in lp8727_release_irq() (high 8.4)
- [CVE-2026-89468](https://insights.sbomify.com/CVE-2026-89468/): power: supply: lp8788-charger: fix use-after-free on remove (not scored)
- [CVE-2026-89467](https://insights.sbomify.com/CVE-2026-89467/): power: supply: qcom_battmgr: fix use-after-free (not scored)
- [CVE-2026-89466](https://insights.sbomify.com/CVE-2026-89466/): power: supply: qcom_battmgr: terminate the strings from firmware (high 7.7)
- [CVE-2026-89465](https://insights.sbomify.com/CVE-2026-89465/): power: supply: rt9455: quiesce delayed work before teardown (high 8.4)
- [CVE-2026-89464](https://insights.sbomify.com/CVE-2026-89464/): power: supply: twl4030_charger: cancel workers via devm (not scored)
- [CVE-2026-89463](https://insights.sbomify.com/CVE-2026-89463/): power: supply: ucs1002: fix use-after-free on remove (not scored)
- [CVE-2026-89462](https://insights.sbomify.com/CVE-2026-89462/): power: supply: max17040: propagate register read errors (not scored)
- [CVE-2026-89461](https://insights.sbomify.com/CVE-2026-89461/): power: supply: max17040: synchronize work cancellation on suspend (not scored)
- [CVE-2026-89460](https://insights.sbomify.com/CVE-2026-89460/): s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (not scored)
- [CVE-2026-8946](https://insights.sbomify.com/CVE-2026-8946/): Incorrect boundary conditions in the Audio/Video: Web Codecs component (high 7.5)
- [CVE-2026-89459](https://insights.sbomify.com/CVE-2026-89459/): s390/percpu: Fix MVIY_PERCPU() with older binutils (high 7.0)
- [CVE-2026-89458](https://insights.sbomify.com/CVE-2026-89458/): s390/dasd: Do not complete a failed ESE read as successful (not scored)
- [CVE-2026-89457](https://insights.sbomify.com/CVE-2026-89457/): s390/dasd: Guard sysfs discipline callbacks against unallocated private data (not scored)
- [CVE-2026-89456](https://insights.sbomify.com/CVE-2026-89456/): s390/dasd: Propagate partial completion length across ERP recovery (high 7.0)
- [CVE-2026-89455](https://insights.sbomify.com/CVE-2026-89455/): PCI: plda: Fix use-after-free of event IRQs during teardown (not scored)
- [CVE-2026-89454](https://insights.sbomify.com/CVE-2026-89454/): PCI: plda: Fix IRQ domain leaks in the error paths of plda_init_interrupts() (not scored)
- [CVE-2026-89453](https://insights.sbomify.com/CVE-2026-89453/): iommu/amd: Put PCI device after handling PPR faults (not scored)
- [CVE-2026-89452](https://insights.sbomify.com/CVE-2026-89452/): iommu/msm: Unwind probe state on registration failure (high 8.4)
- [CVE-2026-89451](https://insights.sbomify.com/CVE-2026-89451/): iommu/sva: Set handle->dev before the SVA handle is visible (not scored)
- [CVE-2026-89450](https://insights.sbomify.com/CVE-2026-89450/): iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (high 8.8)
- [CVE-2026-8945](https://insights.sbomify.com/CVE-2026-8945/): Sandbox escape in Firefox and Firefox Focus for Android (high 7.5)
- [CVE-2026-89449](https://insights.sbomify.com/CVE-2026-89449/): iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add (not scored)
- [CVE-2026-89448](https://insights.sbomify.com/CVE-2026-89448/): iommu/vt-d: Force requesting ACS when tboot is enabled (critical 9.3)
- [CVE-2026-89447](https://insights.sbomify.com/CVE-2026-89447/): iommufd: Avoid locking internal accesses during unmap (not scored)
- [CVE-2026-89446](https://insights.sbomify.com/CVE-2026-89446/): iommufd: Release current IOAS on xa_store() failure (not scored)
- [CVE-2026-89445](https://insights.sbomify.com/CVE-2026-89445/): iommufd: Fix UAF in selftest IOPF reporting (high 8.8)
- [CVE-2026-89444](https://insights.sbomify.com/CVE-2026-89444/): platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (not scored)
- [CVE-2026-89443](https://insights.sbomify.com/CVE-2026-89443/): platform/x86: ISST: Validate level in perf mask ioctls (high 7.1)
- [CVE-2026-89442](https://insights.sbomify.com/CVE-2026-89442/): platform/x86: ISST: Validate socket ID in clos_assoc ioctl (high 7.8)
- [CVE-2026-89441](https://insights.sbomify.com/CVE-2026-89441/): mmc: via-sdmmc: cancel card-detect work on remove (high 7.8)
- [CVE-2026-89440](https://insights.sbomify.com/CVE-2026-89440/): mmc: via-sdmmc: stop card-detect handling on probe failure (high 7.8)
- [CVE-2026-8944](https://insights.sbomify.com/CVE-2026-8944/): Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter (medium 4.3)
- [CVE-2026-89439](https://insights.sbomify.com/CVE-2026-89439/): platform/x86: ISST: Add a NULL check for sst_inst[] (not scored)
- [CVE-2026-89438](https://insights.sbomify.com/CVE-2026-89438/): platform/x86: ISST: Validate logical CPU id and clos id (not scored)
- [CVE-2026-89437](https://insights.sbomify.com/CVE-2026-89437/): platform/x86: int1092: Fix potential memory leak in sar_probe() (not scored)
- [CVE-2026-89436](https://insights.sbomify.com/CVE-2026-89436/): platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] (high 7.8)
- [CVE-2026-89430](https://insights.sbomify.com/CVE-2026-89430/): Gitea push mirror SSRF and forced writes to internal Git hosts (high 8.1)
- [CVE-2026-8943](https://insights.sbomify.com/CVE-2026-8943/): GoStats for WordPress <= 1.4 - Cross-Site Request Forgery via gostats_manage() Function (medium 4.3)
- [CVE-2026-89427](https://insights.sbomify.com/CVE-2026-89427/): Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter (medium 6.1)
- [CVE-2026-89426](https://insights.sbomify.com/CVE-2026-89426/): Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field (high 8.8)
- [CVE-2026-89425](https://insights.sbomify.com/CVE-2026-89425/): jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS) (high 7.5)
- [CVE-2026-89424](https://insights.sbomify.com/CVE-2026-89424/): Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter (medium 6.4)
- [CVE-2026-89422](https://insights.sbomify.com/CVE-2026-89422/): TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension (critical 9.3)
- [CVE-2026-89420](https://insights.sbomify.com/CVE-2026-89420/): Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/275/