# Vulnerabilities published in 2026


- [CVE-2026-80901](https://insights.sbomify.com/CVE-2026-80901/): ipvs: fix the checksum validations (not scored)
- [CVE-2026-80900](https://insights.sbomify.com/CVE-2026-80900/): ASoC: SDCA: Make UMP message size check more robust (not scored)
- [CVE-2026-8090](https://insights.sbomify.com/CVE-2026-8090/): Use-after-free in the DOM: Networking component (high 7.3)
- [CVE-2026-80899](https://insights.sbomify.com/CVE-2026-80899/): erofs: remove fscache backend entirely (not scored)
- [CVE-2026-80898](https://insights.sbomify.com/CVE-2026-80898/): netfs: clear PG_private_2 on copy-to-cache append failure (not scored)
- [CVE-2026-80897](https://insights.sbomify.com/CVE-2026-80897/): netfs: release readahead folios on iterator preparation failure (not scored)
- [CVE-2026-80896](https://insights.sbomify.com/CVE-2026-80896/): mshv: Fix race in mshv_irqfd_deassign (not scored)
- [CVE-2026-80895](https://insights.sbomify.com/CVE-2026-80895/): mshv: Order pt_vp_array publish against irqfd assertion path (not scored)
- [CVE-2026-80894](https://insights.sbomify.com/CVE-2026-80894/): iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (not scored)
- [CVE-2026-80893](https://insights.sbomify.com/CVE-2026-80893/): mm/hugetlb: fix swap entry corruption when clearing uffd-wp at fork() (not scored)
- [CVE-2026-80892](https://insights.sbomify.com/CVE-2026-80892/): erofs: cap LZMA stream pool size (not scored)
- [CVE-2026-80891](https://insights.sbomify.com/CVE-2026-80891/): KVM: s390: pci: Validate AIBV and AISB before pinning guest pages (not scored)
- [CVE-2026-80890](https://insights.sbomify.com/CVE-2026-80890/): sctp: reject stale cookies with mismatched verification tags (not scored)
- [CVE-2026-8089](https://insights.sbomify.com/CVE-2026-8089/): weMail < 2.1.3 - Reflected Cross-Site Scripting (high 7.1)
- [CVE-2026-80889](https://insights.sbomify.com/CVE-2026-80889/): can: isotp: fix timer drain order, wakeup handling and tx_gen ordering (not scored)
- [CVE-2026-80888](https://insights.sbomify.com/CVE-2026-80888/): drm/vmwgfx: drop dma_buf reference on foreign-fd prime import (not scored)
- [CVE-2026-80887](https://insights.sbomify.com/CVE-2026-80887/): drm/vmwgfx: use check_add_overflow for shader size+offset bound (not scored)
- [CVE-2026-80886](https://insights.sbomify.com/CVE-2026-80886/): serial: msm: Disable DMA for kernel console UART (not scored)
- [CVE-2026-80885](https://insights.sbomify.com/CVE-2026-80885/): afs: Fix uncancelled rxrpc OOB message handler (not scored)
- [CVE-2026-80884](https://insights.sbomify.com/CVE-2026-80884/): ntb: Store original DMA address for future release (not scored)
- [CVE-2026-80883](https://insights.sbomify.com/CVE-2026-80883/): drm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered (not scored)
- [CVE-2026-80882](https://insights.sbomify.com/CVE-2026-80882/): crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (not scored)
- [CVE-2026-80881](https://insights.sbomify.com/CVE-2026-80881/): ocfs2: fix buffer head management in ocfs2_read_blocks() (not scored)
- [CVE-2026-80880](https://insights.sbomify.com/CVE-2026-80880/): IB/mlx5: Properly support implicit ODP rereg_mr (not scored)
- [CVE-2026-8088](https://insights.sbomify.com/CVE-2026-8088/): OSGeo gdal GDapi.c GDfieldinfo out-of-bounds (medium 4.8)
- [CVE-2026-80879](https://insights.sbomify.com/CVE-2026-80879/): ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write (not scored)
- [CVE-2026-80878](https://insights.sbomify.com/CVE-2026-80878/): afs: Fix leak of ungot volume (not scored)
- [CVE-2026-80877](https://insights.sbomify.com/CVE-2026-80877/): afs: Fix vllist leak (not scored)
- [CVE-2026-80876](https://insights.sbomify.com/CVE-2026-80876/): ring-buffer: Fix event length with forced 8-byte alignment (not scored)
- [CVE-2026-80875](https://insights.sbomify.com/CVE-2026-80875/): ipvs: use parsed transport offset in TCP state lookup (not scored)
- [CVE-2026-80874](https://insights.sbomify.com/CVE-2026-80874/): arm64: dts: renesas: ironhide: Describe inline ECC carveouts (not scored)
- [CVE-2026-80873](https://insights.sbomify.com/CVE-2026-80873/): KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions (not scored)
- [CVE-2026-80872](https://insights.sbomify.com/CVE-2026-80872/): ALSA: hda/tas2781: Cancel async firmware request at unbind (not scored)
- [CVE-2026-80871](https://insights.sbomify.com/CVE-2026-80871/): crypto: xilinx-trng - Remove crypto_rng interface (not scored)
- [CVE-2026-80870](https://insights.sbomify.com/CVE-2026-80870/): drm/amdkfd: Validate CRIU-restored IDs before idr_alloc (not scored)
- [CVE-2026-8087](https://insights.sbomify.com/CVE-2026-8087/): OSGeo gdal GDapi.c GDnentries heap-based overflow (medium 4.8)
- [CVE-2026-80869](https://insights.sbomify.com/CVE-2026-80869/): ntfs: bound the attribute-list entry in ntfs_read_inode_mount() (not scored)
- [CVE-2026-80868](https://insights.sbomify.com/CVE-2026-80868/): ntfs3: Allocate iomap inline_data using alloc_page (not scored)
- [CVE-2026-80867](https://insights.sbomify.com/CVE-2026-80867/): alpha/PCI: Add security_locked_down() check to pci_mmap_resource() (not scored)
- [CVE-2026-80866](https://insights.sbomify.com/CVE-2026-80866/): tipc: avoid busy looping in tipc_exit_net() (not scored)
- [CVE-2026-80865](https://insights.sbomify.com/CVE-2026-80865/): bpf: Add missing access_ok call to copy_user_syms (not scored)
- [CVE-2026-80864](https://insights.sbomify.com/CVE-2026-80864/): RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (not scored)
- [CVE-2026-80863](https://insights.sbomify.com/CVE-2026-80863/): RDMA/rxe: Fix OOB in free_rd_atomic_resources() (not scored)
- [CVE-2026-80862](https://insights.sbomify.com/CVE-2026-80862/): nvme-tcp: fix usage of page_frag_cache (not scored)
- [CVE-2026-80861](https://insights.sbomify.com/CVE-2026-80861/): usb: xhci: bail out of setup if the controller is inaccessible (not scored)
- [CVE-2026-80860](https://insights.sbomify.com/CVE-2026-80860/): fuse: fix race between interrupt and resend (not scored)
- [CVE-2026-8086](https://insights.sbomify.com/CVE-2026-8086/): OSGeo gdal SWapi.c SWnentries heap-based overflow (medium 4.8)
- [CVE-2026-80859](https://insights.sbomify.com/CVE-2026-80859/): fuse: fix missing barrier when checking io-uring readiness (not scored)
- [CVE-2026-80858](https://insights.sbomify.com/CVE-2026-80858/): fuse: publish io-uring queues with release semantics (not scored)
- [CVE-2026-80857](https://insights.sbomify.com/CVE-2026-80857/): fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free (not scored)
- [CVE-2026-80856](https://insights.sbomify.com/CVE-2026-80856/): fuse: fix invalidate lock leak on setattr writeback failure (not scored)
- [CVE-2026-80855](https://insights.sbomify.com/CVE-2026-80855/): fuse: fix invalidate lock leak on open O_TRUNC DAX failure (not scored)
- [CVE-2026-80854](https://insights.sbomify.com/CVE-2026-80854/): usb: gadget: f_tcm: keep port count until LUN teardown completes (not scored)
- [CVE-2026-80853](https://insights.sbomify.com/CVE-2026-80853/): KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts (not scored)
- [CVE-2026-80852](https://insights.sbomify.com/CVE-2026-80852/): tls: device: fix out-of-bounds write in tls_append_frag() (not scored)
- [CVE-2026-80851](https://insights.sbomify.com/CVE-2026-80851/): gtp: serialize PDP context updates (not scored)
- [CVE-2026-80850](https://insights.sbomify.com/CVE-2026-80850/): tcp: fix AO info use-after-free in tcp_ao_connect_init() (not scored)
- [CVE-2026-8085](https://insights.sbomify.com/CVE-2026-8085/): Rockwell Automation Arena® - Memory Corruption Vulnerability (high 7.0)
- [CVE-2026-80849](https://insights.sbomify.com/CVE-2026-80849/): net/tcp-ao: fix use-after-free of current_key on reconnect to another peer (not scored)
- [CVE-2026-80848](https://insights.sbomify.com/CVE-2026-80848/): xfrm: espintcp: fix UAF during close (not scored)
- [CVE-2026-80847](https://insights.sbomify.com/CVE-2026-80847/): tcp: clamp route advmss to TCP_MIN_MSS (not scored)
- [CVE-2026-80846](https://insights.sbomify.com/CVE-2026-80846/): xfrm: drop ESP-in-TCP packets with no ingress device (not scored)
- [CVE-2026-80845](https://insights.sbomify.com/CVE-2026-80845/): xfrm: avoid lock inversion in nat keepalive work (not scored)
- [CVE-2026-80844](https://insights.sbomify.com/CVE-2026-80844/): xfrm: ah6: validate routing header segments_left (not scored)
- [CVE-2026-80843](https://insights.sbomify.com/CVE-2026-80843/): xfrm: fix xfrm_state_construct() auth-trunc leak (not scored)
- [CVE-2026-80842](https://insights.sbomify.com/CVE-2026-80842/): net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (not scored)
- [CVE-2026-80841](https://insights.sbomify.com/CVE-2026-80841/): net/packet: defer vmalloc TX_RING free until skbs finish (not scored)
- [CVE-2026-80840](https://insights.sbomify.com/CVE-2026-80840/): ipv6: seg6: clear IPv4 control block on IPIP decapsulation (not scored)
- [CVE-2026-8084](https://insights.sbomify.com/CVE-2026-8084/): OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds (medium 4.8)
- [CVE-2026-80839](https://insights.sbomify.com/CVE-2026-80839/): batman-adv: reject unrepresentable multicast TVLV offsets (not scored)
- [CVE-2026-80838](https://insights.sbomify.com/CVE-2026-80838/): vxlan: keep the last remote linked during FDB flush (not scored)
- [CVE-2026-80837](https://insights.sbomify.com/CVE-2026-80837/): netfilter: nf_tables: don't queue packet path object notifications (not scored)
- [CVE-2026-80836](https://insights.sbomify.com/CVE-2026-80836/): crypto: virtio - bound the akcipher result length (not scored)
- [CVE-2026-80835](https://insights.sbomify.com/CVE-2026-80835/): crypto: qcom-rng - Remove crypto_rng interface (not scored)
- [CVE-2026-80834](https://insights.sbomify.com/CVE-2026-80834/): crypto: sun8i-ce - Remove crypto_rng interface (not scored)
- [CVE-2026-80833](https://insights.sbomify.com/CVE-2026-80833/): crypto: sun8i-ss - Remove crypto_rng interface (not scored)
- [CVE-2026-80832](https://insights.sbomify.com/CVE-2026-80832/): crypto: qce - fix CCM AAD buffer underallocation (not scored)
- [CVE-2026-80831](https://insights.sbomify.com/CVE-2026-80831/): crypto: mxs-dcp - fix source scatterlist length access (not scored)
- [CVE-2026-80830](https://insights.sbomify.com/CVE-2026-80830/): usb: core: Add lock to usb_wakeup_notification() (not scored)
- [CVE-2026-8083](https://insights.sbomify.com/CVE-2026-8083/): SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection (medium 6.9)
- [CVE-2026-80829](https://insights.sbomify.com/CVE-2026-80829/): ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() (not scored)
- [CVE-2026-80828](https://insights.sbomify.com/CVE-2026-80828/): ALSA: usb-audio: Complete cleanup after system-resume errors (not scored)
- [CVE-2026-80827](https://insights.sbomify.com/CVE-2026-80827/): USB: serial: option: fix slab OOB read in interrupt URB callback (not scored)
- [CVE-2026-80826](https://insights.sbomify.com/CVE-2026-80826/): USB: c67x00: fix use-after-free in c67x00_add_iso_urb() (not scored)
- [CVE-2026-80825](https://insights.sbomify.com/CVE-2026-80825/): wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb (not scored)
- [CVE-2026-80824](https://insights.sbomify.com/CVE-2026-80824/): usb: usbfs: fix use-after-free of usb_device in usbdev_release() (not scored)
- [CVE-2026-80823](https://insights.sbomify.com/CVE-2026-80823/): nfc: st21nfca: validate ATR_REQ length against the received frame (not scored)
- [CVE-2026-80822](https://insights.sbomify.com/CVE-2026-80822/): mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf() (not scored)
- [CVE-2026-80821](https://insights.sbomify.com/CVE-2026-80821/): nvmet: pci-epf: put CQ ref on create_cq mapping failure (not scored)
- [CVE-2026-80820](https://insights.sbomify.com/CVE-2026-80820/): xfs: don't livelock in scrub on a circular unlinked list (not scored)
- [CVE-2026-8082](https://insights.sbomify.com/CVE-2026-8082/): Bpost Shipping Platform < 3.2.3 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-80819](https://insights.sbomify.com/CVE-2026-80819/): Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept (not scored)
- [CVE-2026-80818](https://insights.sbomify.com/CVE-2026-80818/): iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown (not scored)
- [CVE-2026-80817](https://insights.sbomify.com/CVE-2026-80817/): iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages (not scored)
- [CVE-2026-80816](https://insights.sbomify.com/CVE-2026-80816/): ALSA: FCP: Use a private URB for the notification endpoint (not scored)
- [CVE-2026-80815](https://insights.sbomify.com/CVE-2026-80815/): ALSA: scarlett2: Use a private URB for the notification endpoint (not scored)
- [CVE-2026-80814](https://insights.sbomify.com/CVE-2026-80814/): rndis_host: add overflow check in rndis_rx_fixup() (not scored)
- [CVE-2026-80813](https://insights.sbomify.com/CVE-2026-80813/): nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist() (not scored)
- [CVE-2026-80812](https://insights.sbomify.com/CVE-2026-80812/): ALSA: dummy: Check card index validity at probe (not scored)
- [CVE-2026-80811](https://insights.sbomify.com/CVE-2026-80811/): io_uring/cmd: fix iovec leak when the async cmd is not recycled (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/345/