# Vulnerabilities published in 2026


- [CVE-2026-80993](https://insights.sbomify.com/CVE-2026-80993/): net: phylink: correctly validate returned PCS in phylink_inband_caps (not scored)
- [CVE-2026-80992](https://insights.sbomify.com/CVE-2026-80992/): net: ravb: avoid dereferencing an invalid PTP clock (high 7.8)
- [CVE-2026-80991](https://insights.sbomify.com/CVE-2026-80991/): net: ravb: serialize PTP clock teardown (high 7.8)
- [CVE-2026-80990](https://insights.sbomify.com/CVE-2026-80990/): net: thunderbolt: Release the Rx HopID that was handed out on mismatch (not scored)
- [CVE-2026-80989](https://insights.sbomify.com/CVE-2026-80989/): net: thunderbolt: Mark the connection down when bringing it up fails (high 8.8)
- [CVE-2026-80988](https://insights.sbomify.com/CVE-2026-80988/): NTB: ntb_transport: Fail TX enqueue when the QP link is down (not scored)
- [CVE-2026-80987](https://insights.sbomify.com/CVE-2026-80987/): NTB: ntb_transport: Reject oversized TX buffers (high 7.5)
- [CVE-2026-80986](https://insights.sbomify.com/CVE-2026-80986/): net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (critical 9.8)
- [CVE-2026-80985](https://insights.sbomify.com/CVE-2026-80985/): net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (high 8.2)
- [CVE-2026-80984](https://insights.sbomify.com/CVE-2026-80984/): net/smc: do not dereference an unset send buffer on the SMC-D teardown path (not scored)
- [CVE-2026-80983](https://insights.sbomify.com/CVE-2026-80983/): net/smc: fix socket refcount leak in smc_switch_conns() (not scored)
- [CVE-2026-80982](https://insights.sbomify.com/CVE-2026-80982/): net/smc: fix use-after-free in smc_rx_pipe_buf_release() (high 7.8)
- [CVE-2026-80981](https://insights.sbomify.com/CVE-2026-80981/): net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (critical 9.8)
- [CVE-2026-80980](https://insights.sbomify.com/CVE-2026-80980/): net/smc: stop killed, freed and out_of_sync sharing a byte (critical 9.8)
- [CVE-2026-8098](https://insights.sbomify.com/CVE-2026-8098/): code-projects Feedback System checklogin.php sql injection (medium 6.9)
- [CVE-2026-80979](https://insights.sbomify.com/CVE-2026-80979/): net/smc: unregister the connection before draining the rx tasklet (high 7.8)
- [CVE-2026-80978](https://insights.sbomify.com/CVE-2026-80978/): net: cap advertised IP tunnel headroom (high 7.8)
- [CVE-2026-80977](https://insights.sbomify.com/CVE-2026-80977/): net: skbuff: don't touch shared zerocopy state in skb_tx_error() (high 7.8)
- [CVE-2026-80976](https://insights.sbomify.com/CVE-2026-80976/): seg6: reset IP6CB after IPv6 decapsulation (critical 9.8)
- [CVE-2026-80975](https://insights.sbomify.com/CVE-2026-80975/): mfd: qnap-mcu: keep the reply buffer alive past a command timeout (high 7.8)
- [CVE-2026-80974](https://insights.sbomify.com/CVE-2026-80974/): mfd: sm501: Fix potential memory leaks during remove (not scored)
- [CVE-2026-80973](https://insights.sbomify.com/CVE-2026-80973/): ALSA: 6fire: bound the MIDI event length from the device (not scored)
- [CVE-2026-80972](https://insights.sbomify.com/CVE-2026-80972/): ALSA: aloop: Check card index validity at probe (not scored)
- [CVE-2026-80971](https://insights.sbomify.com/CVE-2026-80971/): ALSA: bcd2000: clear the URB pointers on disconnect (high 7.8)
- [CVE-2026-80970](https://insights.sbomify.com/CVE-2026-80970/): ALSA: FCP: do not copy out an uninitialised init response (not scored)
- [CVE-2026-8097](https://insights.sbomify.com/CVE-2026-8097/): CodeAstro Online Classroom askquery.php sql injection (medium 5.3)
- [CVE-2026-80969](https://insights.sbomify.com/CVE-2026-80969/): ALSA: mpu401: Check card index validity at probe (not scored)
- [CVE-2026-80968](https://insights.sbomify.com/CVE-2026-80968/): ALSA: mts64: Check card index validity at probe (not scored)
- [CVE-2026-80967](https://insights.sbomify.com/CVE-2026-80967/): ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (high 8.4)
- [CVE-2026-80966](https://insights.sbomify.com/CVE-2026-80966/): ALSA: portman2x4: Check card index validity at probe (not scored)
- [CVE-2026-80965](https://insights.sbomify.com/CVE-2026-80965/): ALSA: serial-u16550: Check card index validity at probe (not scored)
- [CVE-2026-80964](https://insights.sbomify.com/CVE-2026-80964/): ALSA: virmidi: Check card index validity at probe (not scored)
- [CVE-2026-80963](https://insights.sbomify.com/CVE-2026-80963/): dm-stats: fix a crash if allocation of per-cpu data fails (not scored)
- [CVE-2026-80962](https://insights.sbomify.com/CVE-2026-80962/): dm-pcache: validate geometry fields from on-disk cache_info (high 7.8)
- [CVE-2026-80961](https://insights.sbomify.com/CVE-2026-80961/): dm-pcache: validate kset key_num and intra-segment bounds (high 7.8)
- [CVE-2026-80960](https://insights.sbomify.com/CVE-2026-80960/): dm-pcache: validate on-media seg_num against the cache device size (not scored)
- [CVE-2026-8096](https://insights.sbomify.com/CVE-2026-8096/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 6.5)
- [CVE-2026-80959](https://insights.sbomify.com/CVE-2026-80959/): dm-pcache: bound the persisted tail-position offset (high 7.8)
- [CVE-2026-80958](https://insights.sbomify.com/CVE-2026-80958/): dm-pcache: clamp the tail kset read to the segment data region (high 7.1)
- [CVE-2026-80957](https://insights.sbomify.com/CVE-2026-80957/): dm-pcache: detect a cycle in the last-kset chain during replay (not scored)
- [CVE-2026-80956](https://insights.sbomify.com/CVE-2026-80956/): dm-pcache: only hand out initialized cache segments (not scored)
- [CVE-2026-80955](https://insights.sbomify.com/CVE-2026-80955/): dm-pcache: fix use-after-free and invalid seg operations in kset_replay() (high 7.8)
- [CVE-2026-80954](https://insights.sbomify.com/CVE-2026-80954/): i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() (high 7.8)
- [CVE-2026-80953](https://insights.sbomify.com/CVE-2026-80953/): i3c: master: adi: initialize the lock before enabling interrupts (high 8.4)
- [CVE-2026-80952](https://insights.sbomify.com/CVE-2026-80952/): i3c: master: Fix info leak and UAF in device unregister path (high 7.8)
- [CVE-2026-80951](https://insights.sbomify.com/CVE-2026-80951/): i3c: master: svc: bound IBI payload to the requested max_payload_len (not scored)
- [CVE-2026-80950](https://insights.sbomify.com/CVE-2026-80950/): i3c: renesas: Check that the transfer is valid before accessing it (high 7.8)
- [CVE-2026-8095](https://insights.sbomify.com/CVE-2026-8095/): Frontend File Manager Plugin <= 23.6 - Authenticated (Subscriber+) Arbitrary File Deletion (high 8.1)
- [CVE-2026-80949](https://insights.sbomify.com/CVE-2026-80949/): wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (not scored)
- [CVE-2026-80948](https://insights.sbomify.com/CVE-2026-80948/): wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() (not scored)
- [CVE-2026-80947](https://insights.sbomify.com/CVE-2026-80947/): wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (high 7.8)
- [CVE-2026-80946](https://insights.sbomify.com/CVE-2026-80946/): fuse: copy request headers via a stack buffer for io-uring (not scored)
- [CVE-2026-80945](https://insights.sbomify.com/CVE-2026-80945/): crypto: iaa - unmap dst before software fallback on decompress (critical 9.1)
- [CVE-2026-80944](https://insights.sbomify.com/CVE-2026-80944/): wifi: mwifiex: Detach sync cmd buffer on interrupted wait (high 7.8)
- [CVE-2026-80943](https://insights.sbomify.com/CVE-2026-80943/): wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (high 7.6)
- [CVE-2026-80942](https://insights.sbomify.com/CVE-2026-80942/): wifi: rtlwifi: rtl8192du: Fix possible memory leak in rtl92du_init_sw_vars() (not scored)
- [CVE-2026-80941](https://insights.sbomify.com/CVE-2026-80941/): wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (not scored)
- [CVE-2026-80940](https://insights.sbomify.com/CVE-2026-80940/): wifi: rtw88: pci: fix resource leak on failed NAPI setup (not scored)
- [CVE-2026-8094](https://insights.sbomify.com/CVE-2026-8094/): Other issue in the WebRTC component (critical 9.8)
- [CVE-2026-80939](https://insights.sbomify.com/CVE-2026-80939/): wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (not scored)
- [CVE-2026-80938](https://insights.sbomify.com/CVE-2026-80938/): wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (not scored)
- [CVE-2026-80937](https://insights.sbomify.com/CVE-2026-80937/): wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (high 8.8)
- [CVE-2026-80936](https://insights.sbomify.com/CVE-2026-80936/): wifi: mt76: mt7925: cancel mlo_pm_work on stop (high 7.8)
- [CVE-2026-80935](https://insights.sbomify.com/CVE-2026-80935/): wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (high 8.8)
- [CVE-2026-80934](https://insights.sbomify.com/CVE-2026-80934/): wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames (not scored)
- [CVE-2026-80933](https://insights.sbomify.com/CVE-2026-80933/): wifi: mt76: mt7996: validate default EEPROM firmware size (high 7.8)
- [CVE-2026-80932](https://insights.sbomify.com/CVE-2026-80932/): vsock/virtio: flush works in dependency order (high 8.4)
- [CVE-2026-80931](https://insights.sbomify.com/CVE-2026-80931/): w1: ds28e17: reject an oversize length on an I2C block read (high 7.8)
- [CVE-2026-80930](https://insights.sbomify.com/CVE-2026-80930/): tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (not scored)
- [CVE-2026-8093](https://insights.sbomify.com/CVE-2026-8093/): Memory safety bugs fixed in Thunderbird 150.0.2 (high 8.1)
- [CVE-2026-80929](https://insights.sbomify.com/CVE-2026-80929/): sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] (high 7.8)
- [CVE-2026-80928](https://insights.sbomify.com/CVE-2026-80928/): smack: fix cred UAF in smack_file_send_sigiotask() (high 7.8)
- [CVE-2026-80927](https://insights.sbomify.com/CVE-2026-80927/): timekeeping: Check the return value of tk_get_aux_ts64 in __do_adjtimex() (not scored)
- [CVE-2026-80926](https://insights.sbomify.com/CVE-2026-80926/): ksmbd: fix use-after-free in oplock break notification (critical 9.8)
- [CVE-2026-80925](https://insights.sbomify.com/CVE-2026-80925/): vlan: fix skb_under_panic and races when toggling HW VLAN offload (not scored)
- [CVE-2026-80924](https://insights.sbomify.com/CVE-2026-80924/): crypto: krb5 - use kfree_sensitive() for derived key buffers (high 7.5)
- [CVE-2026-80923](https://insights.sbomify.com/CVE-2026-80923/): xhci: dbgtty: Fix unregister on tty_register_driver() failure (not scored)
- [CVE-2026-80922](https://insights.sbomify.com/CVE-2026-80922/): crypto: qcom-rng - Allow zero as a random number (not scored)
- [CVE-2026-80921](https://insights.sbomify.com/CVE-2026-80921/): KVM: s390: vsie: zero stale crypto bits (high 8.8)
- [CVE-2026-80920](https://insights.sbomify.com/CVE-2026-80920/): io_uring: defer eventfd signaling when queued from a wakeup handler (not scored)
- [CVE-2026-8092](https://insights.sbomify.com/CVE-2026-8092/): Memory safety bugs fixed in Thunderbird ESR 140.10.2 and Thunderbird 150.0.2 (high 8.1)
- [CVE-2026-80919](https://insights.sbomify.com/CVE-2026-80919/): drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format (not scored)
- [CVE-2026-80918](https://insights.sbomify.com/CVE-2026-80918/): HID: core: fix number/pointer type confusion on long items (not scored)
- [CVE-2026-80917](https://insights.sbomify.com/CVE-2026-80917/): PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems (not scored)
- [CVE-2026-80916](https://insights.sbomify.com/CVE-2026-80916/): kcov: fix data corruption and race conditions on PREEMPT_RT (not scored)
- [CVE-2026-80915](https://insights.sbomify.com/CVE-2026-80915/): drm/xe: Fix DPT allocation paths. (not scored)
- [CVE-2026-80914](https://insights.sbomify.com/CVE-2026-80914/): Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (high 8.8)
- [CVE-2026-80913](https://insights.sbomify.com/CVE-2026-80913/): selinux: require every boolean value to be defined (not scored)
- [CVE-2026-80912](https://insights.sbomify.com/CVE-2026-80912/): selinux: reject an unclaimed class value in security_get_classes() (not scored)
- [CVE-2026-80911](https://insights.sbomify.com/CVE-2026-80911/): ASoC: SOF: sof-audio: Fix error path in sof_widget_setup_unlocked() (not scored)
- [CVE-2026-80910](https://insights.sbomify.com/CVE-2026-80910/): ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses (not scored)
- [CVE-2026-8091](https://insights.sbomify.com/CVE-2026-8091/): Incorrect boundary conditions in the Audio/Video: Playback component (critical 9.8)
- [CVE-2026-80909](https://insights.sbomify.com/CVE-2026-80909/): drm/amdgpu: Reject UVD message with invalid number of h265 refs (not scored)
- [CVE-2026-80908](https://insights.sbomify.com/CVE-2026-80908/): drm/amdgpu: Reject UVD message with dimensions above 4096 (not scored)
- [CVE-2026-80907](https://insights.sbomify.com/CVE-2026-80907/): drm/amdgpu: Fix UVD dpb min size calculation for H264 (not scored)
- [CVE-2026-80906](https://insights.sbomify.com/CVE-2026-80906/): net: packet: fix wrong transport_header when sending VLAN-tagged frame (not scored)
- [CVE-2026-80905](https://insights.sbomify.com/CVE-2026-80905/): net: tap: fix wrong transport_header when sending VLAN-tagged frame (not scored)
- [CVE-2026-80904](https://insights.sbomify.com/CVE-2026-80904/): net/tls: Fail tls_sw_splice_read() after a failed async decrypt (not scored)
- [CVE-2026-80903](https://insights.sbomify.com/CVE-2026-80903/): drm/xe/oa: Fix sync entry leak on OA config emit failure (not scored)
- [CVE-2026-80902](https://insights.sbomify.com/CVE-2026-80902/): dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/344/