# Vulnerabilities published in 2026


- [CVE-2026-80719](https://insights.sbomify.com/CVE-2026-80719/): mm: mglru: fix stale batch updates after memcg reparenting (not scored)
- [CVE-2026-80718](https://insights.sbomify.com/CVE-2026-80718/): mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() (high 7.8)
- [CVE-2026-80717](https://insights.sbomify.com/CVE-2026-80717/): sctp: validate Adaptation Indication parameter length (high 7.5)
- [CVE-2026-80716](https://insights.sbomify.com/CVE-2026-80716/): ALSA: pcm: wake linked drain waiters on unlink (high 7.8)
- [CVE-2026-80715](https://insights.sbomify.com/CVE-2026-80715/): igc: remove napi_synchronize() in igc_down() (not scored)
- [CVE-2026-80714](https://insights.sbomify.com/CVE-2026-80714/): ipvs: do not propagate one-packet flag to synced conns (critical 9.8)
- [CVE-2026-80713](https://insights.sbomify.com/CVE-2026-80713/): io_uring: preserve task restrictions across exec (high 8.4)
- [CVE-2026-80712](https://insights.sbomify.com/CVE-2026-80712/): spi: spi-qpic-snand: write the feature value before executing SET_FEATURE (high 8.4)
- [CVE-2026-80711](https://insights.sbomify.com/CVE-2026-80711/): power: supply: max17040: handle missing status supplier (not scored)
- [CVE-2026-80710](https://insights.sbomify.com/CVE-2026-80710/): s390/dasd: Fix undersized format-check buffer (high 7.8)
- [CVE-2026-8071](https://insights.sbomify.com/CVE-2026-8071/): Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass (high 8.8)
- [CVE-2026-80709](https://insights.sbomify.com/CVE-2026-80709/): s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (high 7.8)
- [CVE-2026-80708](https://insights.sbomify.com/CVE-2026-80708/): s390/zcrypt: Fix missing mem scrub at clear key import in cca_clr2cipherkey() (not scored)
- [CVE-2026-80707](https://insights.sbomify.com/CVE-2026-80707/): can: j1939: transport: j1939_session_fresh_new(): initialize receive buffer (high 7.5)
- [CVE-2026-80706](https://insights.sbomify.com/CVE-2026-80706/): can: softing: fw_parse(): validate firmware record spans (high 7.8)
- [CVE-2026-80705](https://insights.sbomify.com/CVE-2026-80705/): drm/amd/display: check if dml21_add_phantom_plane() is successful (not scored)
- [CVE-2026-80704](https://insights.sbomify.com/CVE-2026-80704/): drm/amd/display: use proper context for logging (not scored)
- [CVE-2026-80703](https://insights.sbomify.com/CVE-2026-80703/): drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE (not scored)
- [CVE-2026-80702](https://insights.sbomify.com/CVE-2026-80702/): drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size (high 7.8)
- [CVE-2026-80701](https://insights.sbomify.com/CVE-2026-80701/): drm/vmwgfx: enforce cursor size limits for MOB cursors (not scored)
- [CVE-2026-80700](https://insights.sbomify.com/CVE-2026-80700/): drm/vmwgfx: validate external BO copy bounds for both stride paths (high 7.8)
- [CVE-2026-8070](https://insights.sbomify.com/CVE-2026-8070/): Misconfiguration in Armoury Crate (high 7.3)
- [CVE-2026-80699](https://insights.sbomify.com/CVE-2026-80699/): KVM: arm64: vgic: Avoid double-deactivate of IRQs in the nested context (not scored)
- [CVE-2026-80698](https://insights.sbomify.com/CVE-2026-80698/): dmaengine: idxd: fix double free of wq, engine, and group structs (not scored)
- [CVE-2026-80697](https://insights.sbomify.com/CVE-2026-80697/): erofs: ensure valid f_path for page cache sharing (not scored)
- [CVE-2026-80696](https://insights.sbomify.com/CVE-2026-80696/): hwmon: (ltc4282) Fix reading the minimum alarm voltage (high 7.8)
- [CVE-2026-80695](https://insights.sbomify.com/CVE-2026-80695/): hwmon: (sht3x) Fix unaligned accesses (not scored)
- [CVE-2026-80694](https://insights.sbomify.com/CVE-2026-80694/): net: ethernet: mtk_eth_soc: pass eth to mtk_handle_irq_rx in poll_controller (critical 9.8)
- [CVE-2026-80693](https://insights.sbomify.com/CVE-2026-80693/): idpf: bound interrupt-vector register fill to the allocated array (critical 9.3)
- [CVE-2026-80692](https://insights.sbomify.com/CVE-2026-80692/): Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks (high 8.8)
- [CVE-2026-80691](https://insights.sbomify.com/CVE-2026-80691/): scsi: target: iblock: Fix wrong PR ops NULL check for PREEMPT/RELEASE (high 7.5)
- [CVE-2026-80690](https://insights.sbomify.com/CVE-2026-80690/): scsi: ufs: core: Initialize hba->rpmbs list in ufshcd (not scored)
- [CVE-2026-8069](https://insights.sbomify.com/CVE-2026-8069/): PredatorSense V3: Local Privilege Escalation (LPE) vulnerability (high 8.5)
- [CVE-2026-80689](https://insights.sbomify.com/CVE-2026-80689/): tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (not scored)
- [CVE-2026-80688](https://insights.sbomify.com/CVE-2026-80688/): riscv: drop __init from vec_check_unaligned_access_speed_all_cpus (not scored)
- [CVE-2026-80687](https://insights.sbomify.com/CVE-2026-80687/): iommufd/viommu: Release the igroup lock on the vdevice_size error path (not scored)
- [CVE-2026-80686](https://insights.sbomify.com/CVE-2026-80686/): mm: migrate_device: fix pte_pfn/pte_dirty called on non-present PTE (not scored)
- [CVE-2026-80685](https://insights.sbomify.com/CVE-2026-80685/): mm/util: don't read __page_2 for order-1 folios in snapshot_page() (high 7.1)
- [CVE-2026-80684](https://insights.sbomify.com/CVE-2026-80684/): KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (critical 9.3)
- [CVE-2026-80683](https://insights.sbomify.com/CVE-2026-80683/): Bluetooth: SCO: give the socket its own sco_conn reference (high 8.8)
- [CVE-2026-80682](https://insights.sbomify.com/CVE-2026-80682/): riscv/mm: use physical alignment for vmemmap_start_pfn (high 7.8)
- [CVE-2026-80681](https://insights.sbomify.com/CVE-2026-80681/): vxlan: re-fetch eth header after route_shortcircuit() (critical 9.8)
- [CVE-2026-80680](https://insights.sbomify.com/CVE-2026-80680/): i2c: amd-mp2: Unregister callback on adapter add failure (high 7.8)
- [CVE-2026-80679](https://insights.sbomify.com/CVE-2026-80679/): s390/dasd: Fix potential NULL pointer dereference (not scored)
- [CVE-2026-80678](https://insights.sbomify.com/CVE-2026-80678/): i2c: imx: Fix slave registration race and error handling (high 8.4)
- [CVE-2026-80677](https://insights.sbomify.com/CVE-2026-80677/): driver core: use READ_ONCE() for dev->driver in dev_has_sync_state() (high 7.8)
- [CVE-2026-80676](https://insights.sbomify.com/CVE-2026-80676/): Drivers: hv: vmbus: use generic driver_override infrastructure (not scored)
- [CVE-2026-80675](https://insights.sbomify.com/CVE-2026-80675/): libbpf: Reject non-exclusive metadata maps in the signed loader (high 7.1)
- [CVE-2026-80674](https://insights.sbomify.com/CVE-2026-80674/): ntfs: validate resident attribute lists and harden the validator (critical 9.8)
- [CVE-2026-80673](https://insights.sbomify.com/CVE-2026-80673/): ntfs: bound the look-ahead attribute-list entry in ntfs_external_attr_find() (critical 9.8)
- [CVE-2026-80672](https://insights.sbomify.com/CVE-2026-80672/): ntfs: fix u16 truncation of restart-area length check (high 8.8)
- [CVE-2026-80671](https://insights.sbomify.com/CVE-2026-80671/): perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (critical 9.3)
- [CVE-2026-80670](https://insights.sbomify.com/CVE-2026-80670/): perf tools: Use perf_env__get_cpu_topology() in machine__resolve() (critical 9.1)
- [CVE-2026-8067](https://insights.sbomify.com/CVE-2026-8067/): Missing authorization in RTU500 series CMU firmware (medium 6.5)
- [CVE-2026-80669](https://insights.sbomify.com/CVE-2026-80669/): bpf: Disable xfrm_decode_session hook attachment (not scored)
- [CVE-2026-80668](https://insights.sbomify.com/CVE-2026-80668/): netfilter: nf_conntrack_expect: use conntrack GC to reap expectations (critical 9.8)
- [CVE-2026-80667](https://insights.sbomify.com/CVE-2026-80667/): net/mlx5: LAG, MPESW, Fix missing complete() on devcom error (not scored)
- [CVE-2026-80666](https://insights.sbomify.com/CVE-2026-80666/): Bluetooth: sco: Fix a race condition in sco_sock_timeout() (not scored)
- [CVE-2026-80665](https://insights.sbomify.com/CVE-2026-80665/): KVM: arm64: nv: Inject SEA if kvm_translate_vncr() can't resolve PFN (high 7.1)
- [CVE-2026-80664](https://insights.sbomify.com/CVE-2026-80664/): netfilter: xt_nat: reject unsupported target families (high 7.3)
- [CVE-2026-80663](https://insights.sbomify.com/CVE-2026-80663/): tools/power/x86/intel-speed-select: Harden daemon pidfile open (high 7.1)
- [CVE-2026-80662](https://insights.sbomify.com/CVE-2026-80662/): cxl: Fix CXL_HEADERLOG_SIZE to match RAS Capability size (high 7.1)
- [CVE-2026-80661](https://insights.sbomify.com/CVE-2026-80661/): ufs: core: tracing: Do not dereference pointers in TP_printk() (high 7.8)
- [CVE-2026-80660](https://insights.sbomify.com/CVE-2026-80660/): hwmon: (occ) unregister sysfs devices outside occ lock (not scored)
- [CVE-2026-8066](https://insights.sbomify.com/CVE-2026-8066/): Path traversal in RTU500 series CMU firmware (critical 9.1)
- [CVE-2026-80659](https://insights.sbomify.com/CVE-2026-80659/): mmc: vub300: defer reset until cmd_mutex is unlocked (not scored)
- [CVE-2026-80658](https://insights.sbomify.com/CVE-2026-80658/): drm/rockchip: dw_dp: Fix null-ptr-deref in dw_dp_remove() (not scored)
- [CVE-2026-80657](https://insights.sbomify.com/CVE-2026-80657/): accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer (not scored)
- [CVE-2026-80656](https://insights.sbomify.com/CVE-2026-80656/): hfsplus: Add a sanity check for btree node size (high 7.8)
- [CVE-2026-80655](https://insights.sbomify.com/CVE-2026-80655/): soc: xilinx: Fix race condition in event registration (not scored)
- [CVE-2026-80654](https://insights.sbomify.com/CVE-2026-80654/): soc: xilinx: Shutdown and free rx mailbox channel (not scored)
- [CVE-2026-80653](https://insights.sbomify.com/CVE-2026-80653/): scsi: hisi_sas: Add slave_destroy interface for v3 hw (high 8.4)
- [CVE-2026-80652](https://insights.sbomify.com/CVE-2026-80652/): crypto: ccp - Treat zero-length cert chain as query for blob lengths (not scored)
- [CVE-2026-80651](https://insights.sbomify.com/CVE-2026-80651/): crypto: ccp/sev-dev-tsm - bail out early when pdev->bus is NULL (not scored)
- [CVE-2026-80650](https://insights.sbomify.com/CVE-2026-80650/): media: atomisp: gc2235: fix UAF and memory leak (not scored)
- [CVE-2026-8065](https://insights.sbomify.com/CVE-2026-8065/): Auth bypass in RTU500 series CMU firmware (critical 9.1)
- [CVE-2026-80649](https://insights.sbomify.com/CVE-2026-80649/): firmware: arm_scmi: Fix OOB in scmi_power_name_get() (high 7.8)
- [CVE-2026-80648](https://insights.sbomify.com/CVE-2026-80648/): pinctrl: spacemit: fix NULL check in spacemit_pin_set_config (not scored)
- [CVE-2026-80647](https://insights.sbomify.com/CVE-2026-80647/): RDMA/hns: Fix warning in poll cq direct mode (not scored)
- [CVE-2026-80646](https://insights.sbomify.com/CVE-2026-80646/): ipv6: guard against possible NULL deref in __in6_dev_stats_get() (high 7.5)
- [CVE-2026-80645](https://insights.sbomify.com/CVE-2026-80645/): rapidio/tsi721: prevent a bad dereference in tsi721_db_dpc() (high 8.1)
- [CVE-2026-80644](https://insights.sbomify.com/CVE-2026-80644/): ocfs2: don't BUG_ON an invalid journal dinode (not scored)
- [CVE-2026-80643](https://insights.sbomify.com/CVE-2026-80643/): EDAC/igen6: Fix call trace due to missing release() (not scored)
- [CVE-2026-80642](https://insights.sbomify.com/CVE-2026-80642/): liveupdate: Reference count incoming FLB data (not scored)
- [CVE-2026-80641](https://insights.sbomify.com/CVE-2026-80641/): wifi: wlcore: enable the right set of ciphers (not scored)
- [CVE-2026-80640](https://insights.sbomify.com/CVE-2026-80640/): cxl/fwctl: Fix __fortify_panic (not scored)
- [CVE-2026-80639](https://insights.sbomify.com/CVE-2026-80639/): cxl/test: Fix __fortify_panic (not scored)
- [CVE-2026-80638](https://insights.sbomify.com/CVE-2026-80638/): ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent (high 8.8)
- [CVE-2026-80637](https://insights.sbomify.com/CVE-2026-80637/): netfilter: synproxy: fix unaligned memory access in timestamp adjustment (high 7.5)
- [CVE-2026-80636](https://insights.sbomify.com/CVE-2026-80636/): netfilter: conntrack: revert ct extension genid infrastructure (not scored)
- [CVE-2026-80635](https://insights.sbomify.com/CVE-2026-80635/): wifi: wcn36xx: fix OOB read from short trigger BA firmware response (high 8.8)
- [CVE-2026-80634](https://insights.sbomify.com/CVE-2026-80634/): netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (critical 9.8)
- [CVE-2026-80633](https://insights.sbomify.com/CVE-2026-80633/): iommufd: Take dma_resv lock before dma_buf_unpin() in release path (high 8.8)
- [CVE-2026-80632](https://insights.sbomify.com/CVE-2026-80632/): wifi: mt76: mt7996: Fix NULL pointer dereference in mt7996_init_tx_queues() (not scored)
- [CVE-2026-80631](https://insights.sbomify.com/CVE-2026-80631/): btrfs: lzo: reject compressed segment that overflows the compressed input (high 7.5)
- [CVE-2026-80630](https://insights.sbomify.com/CVE-2026-80630/): net/sched: sch_fq_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen (critical 9.8)
- [CVE-2026-8063](https://insights.sbomify.com/CVE-2026-8063/): Post-auth null pointer dereference when aggregating against a view with empty search pipeline (high 7.1)
- [CVE-2026-80629](https://insights.sbomify.com/CVE-2026-80629/): octeontx2-af: npc: Fix size of entry2cntr_map (not scored)
- [CVE-2026-80628](https://insights.sbomify.com/CVE-2026-80628/): ALSA: seq: oss: Serialize readq reset state with q->lock (high 7.8)
- [CVE-2026-80627](https://insights.sbomify.com/CVE-2026-80627/): MIPS: mm: Fix out-of-bounds write in maar_res_walk() (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/347/