# Vulnerabilities published in 2026


- [CVE-2026-80626](https://insights.sbomify.com/CVE-2026-80626/): powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del (not scored)
- [CVE-2026-80625](https://insights.sbomify.com/CVE-2026-80625/): RDMA/hns: Fix memory leak of bonding resources (not scored)
- [CVE-2026-80624](https://insights.sbomify.com/CVE-2026-80624/): mfd: cs42l43: Sanity check firmware size (not scored)
- [CVE-2026-80623](https://insights.sbomify.com/CVE-2026-80623/): coresight: ete: Always save state on power down (not scored)
- [CVE-2026-80622](https://insights.sbomify.com/CVE-2026-80622/): char: tlclk: fix use-after-free in tlclk_cleanup() (high 7.8)
- [CVE-2026-80621](https://insights.sbomify.com/CVE-2026-80621/): PCI: dwc: Avoid dwc_pcie_rasdes_debugfs_deinit() NULL dereference when no RAS DES capability (not scored)
- [CVE-2026-80620](https://insights.sbomify.com/CVE-2026-80620/): Revert "PCI/MSI: Unmap MSI-X region on error" (not scored)
- [CVE-2026-80619](https://insights.sbomify.com/CVE-2026-80619/): apparmor: fix potential UAF in aa_replace_profiles (high 7.8)
- [CVE-2026-80618](https://insights.sbomify.com/CVE-2026-80618/): drm/amdkfd: Avoid double-unpin of DOORBELL/MMIO BOs on free (not scored)
- [CVE-2026-80617](https://insights.sbomify.com/CVE-2026-80617/): net: airoha: fix foe_check_time allocation size (critical 9.8)
- [CVE-2026-80616](https://insights.sbomify.com/CVE-2026-80616/): ieee802154: Avoid calling WARN_ON() on -ENOMEM in cfg802154_switch_netns() (not scored)
- [CVE-2026-80615](https://insights.sbomify.com/CVE-2026-80615/): net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone (high 8.2)
- [CVE-2026-80614](https://insights.sbomify.com/CVE-2026-80614/): net: emac: Fix NULL pointer dereference in emac_probe (high 7.5)
- [CVE-2026-80613](https://insights.sbomify.com/CVE-2026-80613/): veth: fix NAPI leak in XDP enable error path (high 7.8)
- [CVE-2026-80612](https://insights.sbomify.com/CVE-2026-80612/): net: lwtunnel: Drop skb metadata before LWT encapsulation (critical 9.8)
- [CVE-2026-80611](https://insights.sbomify.com/CVE-2026-80611/): ACPI: processor_idle: Mark LPI enter functions as __cpuidle (not scored)
- [CVE-2026-80610](https://insights.sbomify.com/CVE-2026-80610/): net: enetc: fix potential divide-by-zero when num_vsi is zero (not scored)
- [CVE-2026-80609](https://insights.sbomify.com/CVE-2026-80609/): qede: fix out-of-bounds check for cqe->len_list[] (critical 9.8)
- [CVE-2026-80608](https://insights.sbomify.com/CVE-2026-80608/): accel/amdxdna: Fix iommu domain lifetime race during device removal (high 8.8)
- [CVE-2026-80607](https://insights.sbomify.com/CVE-2026-80607/): tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg (not scored)
- [CVE-2026-80606](https://insights.sbomify.com/CVE-2026-80606/): drm/xe/userptr: Hold notifier_lock for write on inject test path (high 7.8)
- [CVE-2026-80605](https://insights.sbomify.com/CVE-2026-80605/): HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait() (not scored)
- [CVE-2026-80604](https://insights.sbomify.com/CVE-2026-80604/): HID: core: Fix OOB read in hid_get_report for numbered reports (high 8.8)
- [CVE-2026-80603](https://insights.sbomify.com/CVE-2026-80603/): netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (critical 9.1)
- [CVE-2026-80602](https://insights.sbomify.com/CVE-2026-80602/): perf/x86/amd/lbr: Fix kernel address leakage (not scored)
- [CVE-2026-80601](https://insights.sbomify.com/CVE-2026-80601/): batman-adv: gw: acquire ethernet header only after skb realloc (high 8.8)
- [CVE-2026-80600](https://insights.sbomify.com/CVE-2026-80600/): batman-adv: dat: acquire ARP hw source only after skb realloc (critical 9.8)
- [CVE-2026-80599](https://insights.sbomify.com/CVE-2026-80599/): batman-adv: dat: ensure accessible eth_hdr proto field (high 8.1)
- [CVE-2026-80598](https://insights.sbomify.com/CVE-2026-80598/): ntfs3: fix out-of-bounds read in decompress_lznt (high 7.8)
- [CVE-2026-80597](https://insights.sbomify.com/CVE-2026-80597/): mtd: maps: vmu-flash: fix NULL pointer dereference in initialization (not scored)
- [CVE-2026-80596](https://insights.sbomify.com/CVE-2026-80596/): Input: ims-pcu - only expose sysfs attributes on control interface (high 8.4)
- [CVE-2026-80595](https://insights.sbomify.com/CVE-2026-80595/): Input: ims-pcu - add response length checks (not scored)
- [CVE-2026-80594](https://insights.sbomify.com/CVE-2026-80594/): Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing (not scored)
- [CVE-2026-80593](https://insights.sbomify.com/CVE-2026-80593/): hwmon: (asus_atk0110) Check package count before accessing element (high 8.4)
- [CVE-2026-80592](https://insights.sbomify.com/CVE-2026-80592/): samples/damon/mtier: fail early if address range parameters are invalid (not scored)
- [CVE-2026-80591](https://insights.sbomify.com/CVE-2026-80591/): f2fs: fix listxattr handling of corrupted xattr entries (high 7.8)
- [CVE-2026-80590](https://insights.sbomify.com/CVE-2026-80590/): inet: frags: strip GSO state from fragments before reassembly (high 8.6)
- [CVE-2026-8059](https://insights.sbomify.com/CVE-2026-8059/): Multiple Vulnerabilities in IBM Datacap (medium 6.1)
- [CVE-2026-80589](https://insights.sbomify.com/CVE-2026-80589/): block: stop the timeout timer when releasing a never added disk (critical 9.8)
- [CVE-2026-80588](https://insights.sbomify.com/CVE-2026-80588/): mptcp: reclaim forward-allocated memory on RX path errors (high 7.5)
- [CVE-2026-80587](https://insights.sbomify.com/CVE-2026-80587/): mptcp: avoid combining some incoming suboptions (critical 9.8)
- [CVE-2026-80586](https://insights.sbomify.com/CVE-2026-80586/): mptcp: options: reset DSS fields in case of unexpected size (critical 9.8)
- [CVE-2026-80585](https://insights.sbomify.com/CVE-2026-80585/): mptcp: fastopen: only mark MPTFO subflows with SYN data (critical 9.4)
- [CVE-2026-80584](https://insights.sbomify.com/CVE-2026-80584/): s390/qeth: validate user buffer length in SNMP and ARP query ioctls (high 8.4)
- [CVE-2026-80583](https://insights.sbomify.com/CVE-2026-80583/): ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses (high 7.8)
- [CVE-2026-80582](https://insights.sbomify.com/CVE-2026-80582/): drm/shmem_helper: Check VMA boundaries for PMD mappings (high 7.8)
- [CVE-2026-80581](https://insights.sbomify.com/CVE-2026-80581/): ASoC: SOF: ipc4-pcm: Continue the pipeline trigger in case of IPC timeout (not scored)
- [CVE-2026-80580](https://insights.sbomify.com/CVE-2026-80580/): fbdev: bound mode sysfs output to the sysfs buffer (high 7.8)
- [CVE-2026-8058](https://insights.sbomify.com/CVE-2026-8058/): This Power System update is being released to address a sensitive information disclosure (medium 4.5)
- [CVE-2026-80579](https://insights.sbomify.com/CVE-2026-80579/): fbdev: clear fb_info->mode before deleting a videomode (high 7.8)
- [CVE-2026-80578](https://insights.sbomify.com/CVE-2026-80578/): fbdev: core: Fix pointer desynchronization in fb_io_read() (high 7.3)
- [CVE-2026-80577](https://insights.sbomify.com/CVE-2026-80577/): drm/panthor: skip zero-sized firmware sections (not scored)
- [CVE-2026-80576](https://insights.sbomify.com/CVE-2026-80576/): drm/amdgpu: reject oversized IBs with per-ring packet limits (high 8.8)
- [CVE-2026-80575](https://insights.sbomify.com/CVE-2026-80575/): Input: cs40l50-vibra - validate custom data from user space (high 7.8)
- [CVE-2026-80574](https://insights.sbomify.com/CVE-2026-80574/): Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet (high 8.4)
- [CVE-2026-80573](https://insights.sbomify.com/CVE-2026-80573/): Input: iforce - validate input packet lengths (not scored)
- [CVE-2026-80572](https://insights.sbomify.com/CVE-2026-80572/): Input: byd - synchronize timer deletion before freeing private data (high 7.8)
- [CVE-2026-80571](https://insights.sbomify.com/CVE-2026-80571/): powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (not scored)
- [CVE-2026-80570](https://insights.sbomify.com/CVE-2026-80570/): Input: synaptics-rmi4 - zero report size on F54 work error (high 7.8)
- [CVE-2026-80569](https://insights.sbomify.com/CVE-2026-80569/): Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer (high 7.8)
- [CVE-2026-80568](https://insights.sbomify.com/CVE-2026-80568/): Input: synaptics-rmi4 - block s_input when F54 queue is busy (high 7.8)
- [CVE-2026-80567](https://insights.sbomify.com/CVE-2026-80567/): Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue (not scored)
- [CVE-2026-80566](https://insights.sbomify.com/CVE-2026-80566/): Input: hynitron_cstxxx - validate touch count and finger IDs (not scored)
- [CVE-2026-80565](https://insights.sbomify.com/CVE-2026-80565/): crypto: qce - fix error path in devm_qce_register_algs (high 7.8)
- [CVE-2026-80564](https://insights.sbomify.com/CVE-2026-80564/): gve: fix NULL dereference due to missing ptp adjfine (not scored)
- [CVE-2026-80563](https://insights.sbomify.com/CVE-2026-80563/): gpio: sloppy-logic-analyzer: fix use-after-free via debugfs trigger on unbind (not scored)
- [CVE-2026-80562](https://insights.sbomify.com/CVE-2026-80562/): gpio: ml-ioh: use raw_spinlock_t for the register lock (not scored)
- [CVE-2026-80561](https://insights.sbomify.com/CVE-2026-80561/): libceph: fix multiple unsafe decodes in decode_locker() (critical 9.8)
- [CVE-2026-80560](https://insights.sbomify.com/CVE-2026-80560/): openrisc: signal: do not restore privileged SR bits on sigreturn (high 7.8)
- [CVE-2026-8056](https://insights.sbomify.com/CVE-2026-8056/): Parameter Injection Vulnerability in API Graph Execution Engine (high 8.8)
- [CVE-2026-80559](https://insights.sbomify.com/CVE-2026-80559/): Input: sur40 - fix input device registration ordering (high 7.8)
- [CVE-2026-80558](https://insights.sbomify.com/CVE-2026-80558/): libceph: Avoid using invalid osd indices from primary_temp (critical 9.8)
- [CVE-2026-80557](https://insights.sbomify.com/CVE-2026-80557/): libceph: fix OOB read in decode_watchers() via missing bounds check (critical 9.8)
- [CVE-2026-80556](https://insights.sbomify.com/CVE-2026-80556/): mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition (high 7.8)
- [CVE-2026-80555](https://insights.sbomify.com/CVE-2026-80555/): s390/vfio_ccw: Free all memory if cp_init() fails (high 7.1)
- [CVE-2026-80554](https://insights.sbomify.com/CVE-2026-80554/): s390/vfio_ccw: Limit the number of channel program segments (critical 9.3)
- [CVE-2026-80553](https://insights.sbomify.com/CVE-2026-80553/): s390/vfio_ccw: Cancel existing workqueues (high 8.8)
- [CVE-2026-80552](https://insights.sbomify.com/CVE-2026-80552/): s390/vfio_ccw: Ensure index for read/write regions are within range (high 8.8)
- [CVE-2026-80551](https://insights.sbomify.com/CVE-2026-80551/): s390/vfio_ccw: Ensure first IDAW remains constant (critical 9.3)
- [CVE-2026-80550](https://insights.sbomify.com/CVE-2026-80550/): s390/vfio_ccw: Fix out of bounds check on CCW array (high 7.9)
- [CVE-2026-80549](https://insights.sbomify.com/CVE-2026-80549/): s390/vfio_ccw: Move cp cleanup out of not operational (high 8.2)
- [CVE-2026-80548](https://insights.sbomify.com/CVE-2026-80548/): s390/vfio_ccw: Selectively expand io_mutex (high 8.8)
- [CVE-2026-80547](https://insights.sbomify.com/CVE-2026-80547/): s390/vfio_ccw: Implement a crw lock (high 8.8)
- [CVE-2026-80546](https://insights.sbomify.com/CVE-2026-80546/): s390/zcrypt: Improve CCA CPRB length and overflow checks (high 7.8)
- [CVE-2026-80545](https://insights.sbomify.com/CVE-2026-80545/): s390/zcrypt: Improve EP11 CPRB length and overflow checks (high 7.8)
- [CVE-2026-80544](https://insights.sbomify.com/CVE-2026-80544/): s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing (high 7.8)
- [CVE-2026-80543](https://insights.sbomify.com/CVE-2026-80543/): s390/zcrypt: Pad trailing CCA or EP11 message with zeros (not scored)
- [CVE-2026-80542](https://insights.sbomify.com/CVE-2026-80542/): drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank() (not scored)
- [CVE-2026-80541](https://insights.sbomify.com/CVE-2026-80541/): drm/amdgpu: validate GEM_CREATE domain combinations (high 7.8)
- [CVE-2026-80540](https://insights.sbomify.com/CVE-2026-80540/): drm/amdgpu: Fix UVD decode image min size calculation (high 7.8)
- [CVE-2026-8054](https://insights.sbomify.com/CVE-2026-8054/): Unauthenticated SQL Injection in dotCMS Publish Audit API (critical 10.0)
- [CVE-2026-80539](https://insights.sbomify.com/CVE-2026-80539/): drm/amdgpu: disallow multiple FENCE chunks in one submit (not scored)
- [CVE-2026-80538](https://insights.sbomify.com/CVE-2026-80538/): xfs: propagate errors from xfs_rtginode_load (high 7.1)
- [CVE-2026-80537](https://insights.sbomify.com/CVE-2026-80537/): xfs: fix off-by-one in rtrefcount btree root level validation (high 7.8)
- [CVE-2026-80536](https://insights.sbomify.com/CVE-2026-80536/): xfs: bounds-check buffer log item's dirty bitmap (high 8.4)
- [CVE-2026-80535](https://insights.sbomify.com/CVE-2026-80535/): xfs: don't double-lock when deleting a self-referential directory (not scored)
- [CVE-2026-80534](https://insights.sbomify.com/CVE-2026-80534/): xfs: fix ilock leak on error in xfs_dq_get_next_id (not scored)
- [CVE-2026-80533](https://insights.sbomify.com/CVE-2026-80533/): xfs: don't walk off the end of a null sc->sa.agi_bp in AGI repair (not scored)
- [CVE-2026-80532](https://insights.sbomify.com/CVE-2026-80532/): xfs: fix another iunlink infinite loop bug in online fsck (not scored)
- [CVE-2026-80531](https://insights.sbomify.com/CVE-2026-80531/): xfs: avoid UAF on sc->tempip in xrep_tempfile_create (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/348/