# Vulnerabilities published in 2026


- [CVE-2026-74550](https://insights.sbomify.com/CVE-2026-74550/): net: do not send ICMP/NDISC Redirects when peer allocation fails (high 7.5)
- [CVE-2026-7455](https://insights.sbomify.com/CVE-2026-7455/): FLT File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max (high 7.8)
- [CVE-2026-74549](https://insights.sbomify.com/CVE-2026-74549/): hwmon: (nct6775-core) Prevent access to unsupported weight registers (high 7.8)
- [CVE-2026-74548](https://insights.sbomify.com/CVE-2026-74548/): forcedeth: fix UAF of txrx_stats in nv_remove (high 7.8)
- [CVE-2026-74547](https://insights.sbomify.com/CVE-2026-74547/): hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread (not scored)
- [CVE-2026-74546](https://insights.sbomify.com/CVE-2026-74546/): hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read (not scored)
- [CVE-2026-74545](https://insights.sbomify.com/CVE-2026-74545/): rtase: fix double free of multi-frag skb on DMA map failure (critical 9.8)
- [CVE-2026-74544](https://insights.sbomify.com/CVE-2026-74544/): net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds (high 7.8)
- [CVE-2026-74543](https://insights.sbomify.com/CVE-2026-74543/): net: udp_tunnel: fix memory leak in udp_tunnel_nic_unregister() (not scored)
- [CVE-2026-74542](https://insights.sbomify.com/CVE-2026-74542/): netfs: Fix folio_queue ENOMEM in writeback by adding a mempool (not scored)
- [CVE-2026-74541](https://insights.sbomify.com/CVE-2026-74541/): Bluetooth: ISO: clear iso_data always when detaching conn from hcon (high 8.8)
- [CVE-2026-74540](https://insights.sbomify.com/CVE-2026-74540/): Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp (high 8.8)
- [CVE-2026-7454](https://insights.sbomify.com/CVE-2026-7454/): WRL File Parsing Memory Corruption in Autodesk 3ds Max (high 7.8)
- [CVE-2026-74539](https://insights.sbomify.com/CVE-2026-74539/): Bluetooth: ISO: lock sk in iso_sock_getname (high 8.0)
- [CVE-2026-74538](https://insights.sbomify.com/CVE-2026-74538/): Bluetooth: ISO: lock sk in iso_connect_ind (high 8.8)
- [CVE-2026-74537](https://insights.sbomify.com/CVE-2026-74537/): Bluetooth: ISO: hold sk properly in iso_conn_ready (high 8.8)
- [CVE-2026-74536](https://insights.sbomify.com/CVE-2026-74536/): Bluetooth: ISO: fix leaking sk after socket release (not scored)
- [CVE-2026-74535](https://insights.sbomify.com/CVE-2026-74535/): Bluetooth: ISO: avoid deadlocks in iso_sock_timeout (high 8.8)
- [CVE-2026-74534](https://insights.sbomify.com/CVE-2026-74534/): Bluetooth: ISO: fix refcounting of iso_conn (high 8.8)
- [CVE-2026-74533](https://insights.sbomify.com/CVE-2026-74533/): Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero (high 8.8)
- [CVE-2026-74532](https://insights.sbomify.com/CVE-2026-74532/): Bluetooth: btintel: Validate length before parsing diagnostics TLV (not scored)
- [CVE-2026-74531](https://insights.sbomify.com/CVE-2026-74531/): Bluetooth: hci_conn: hold conn reference in abort_conn_sync() (high 8.8)
- [CVE-2026-74530](https://insights.sbomify.com/CVE-2026-74530/): Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback (high 8.8)
- [CVE-2026-7453](https://insights.sbomify.com/CVE-2026-7453/): WRL File Parsing Memory Exhaustion in Autodesk 3ds Max (medium 5.5)
- [CVE-2026-74529](https://insights.sbomify.com/CVE-2026-74529/): Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback (high 7.8)
- [CVE-2026-74528](https://insights.sbomify.com/CVE-2026-74528/): Bluetooth: hci_sync: hold conn in hci_past_sync() callback (high 8.0)
- [CVE-2026-74527](https://insights.sbomify.com/CVE-2026-74527/): octeontx2-af: Block VFs from clobbering special CGX PKIND state (high 8.8)
- [CVE-2026-74526](https://insights.sbomify.com/CVE-2026-74526/): scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (not scored)
- [CVE-2026-74525](https://insights.sbomify.com/CVE-2026-74525/): net: sxgbe: free TX rings on RX allocation failure (not scored)
- [CVE-2026-74524](https://insights.sbomify.com/CVE-2026-74524/): riscv: mm: Fix out-of-bounds page-table walk during memory hot-remove (not scored)
- [CVE-2026-74523](https://insights.sbomify.com/CVE-2026-74523/): qede: sync udp_tunnel ports outside qede_lock in the recovery path (high 7.5)
- [CVE-2026-74522](https://insights.sbomify.com/CVE-2026-74522/): ksmbd: fix use-after-free in __close_file_table_ids() (high 8.8)
- [CVE-2026-74521](https://insights.sbomify.com/CVE-2026-74521/): ksmbd: use memcmp() to compare ClientGUIDs (critical 9.1)
- [CVE-2026-74520](https://insights.sbomify.com/CVE-2026-74520/): iommu/iommufd: Fix IOPF group ownership UAF (high 8.8)
- [CVE-2026-7452](https://insights.sbomify.com/CVE-2026-7452/): WRL File Parsing Memory Corruption in Autodesk 3ds Max (high 7.8)
- [CVE-2026-74519](https://insights.sbomify.com/CVE-2026-74519/): pinctrl: devicetree: don't free uninitialized dev_name on error path (high 7.8)
- [CVE-2026-74518](https://insights.sbomify.com/CVE-2026-74518/): mm/hugetlb: fix list corruption in allocate_file_region_entries() (high 7.8)
- [CVE-2026-74517](https://insights.sbomify.com/CVE-2026-74517/): KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (critical 9.3)
- [CVE-2026-74516](https://insights.sbomify.com/CVE-2026-74516/): KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (high 8.2)
- [CVE-2026-74515](https://insights.sbomify.com/CVE-2026-74515/): KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (high 8.8)
- [CVE-2026-74514](https://insights.sbomify.com/CVE-2026-74514/): KVM: s390: pci: Fix memory accounting for pinned/unpinned pages (not scored)
- [CVE-2026-74513](https://insights.sbomify.com/CVE-2026-74513/): dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister (high 7.8)
- [CVE-2026-74512](https://insights.sbomify.com/CVE-2026-74512/): audit: fix potential use-after-free in audit_del_rule() (high 7.8)
- [CVE-2026-74510](https://insights.sbomify.com/CVE-2026-74510/): Bluetooth: mgmt: fix UAF in pair command cancellation (high 7.8)
- [CVE-2026-7451](https://insights.sbomify.com/CVE-2026-7451/): TIF File Parsing Out-of-Bounds Write in Autodesk 3ds Max (high 7.8)
- [CVE-2026-74509](https://insights.sbomify.com/CVE-2026-74509/): Bluetooth: hci_sync: Fix advertising data UAFs (high 8.8)
- [CVE-2026-74508](https://insights.sbomify.com/CVE-2026-74508/): Bluetooth: HIDP: reject frames without a transaction header (high 8.8)
- [CVE-2026-74507](https://insights.sbomify.com/CVE-2026-74507/): Bluetooth: HIDP: validate numbered report payloads (high 7.1)
- [CVE-2026-74506](https://insights.sbomify.com/CVE-2026-74506/): afs: Fix UAF when sending a message (high 7.8)
- [CVE-2026-74505](https://insights.sbomify.com/CVE-2026-74505/): ALSA: 6fire: Fix UAF at error handling during probe (not scored)
- [CVE-2026-74504](https://insights.sbomify.com/CVE-2026-74504/): ALSA: seq: Fix division by zero in initialize_timer() (not scored)
- [CVE-2026-74503](https://insights.sbomify.com/CVE-2026-74503/): ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (high 7.8)
- [CVE-2026-74502](https://insights.sbomify.com/CVE-2026-74502/): ALSA: ump: fix double free of out_cvts on rawmidi error (not scored)
- [CVE-2026-74501](https://insights.sbomify.com/CVE-2026-74501/): ALSA: usb-audio: fix use-after-free in ump_to_endpoint() (not scored)
- [CVE-2026-74500](https://insights.sbomify.com/CVE-2026-74500/): ALSA: usb-audio: fix stack info leak in RME Digiface status (not scored)
- [CVE-2026-7450](https://insights.sbomify.com/CVE-2026-7450/): PAR File Parsing NULL Pointer Dereference in Autodesk 3ds Max (medium 5.5)
- [CVE-2026-74499](https://insights.sbomify.com/CVE-2026-74499/): ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() (not scored)
- [CVE-2026-74498](https://insights.sbomify.com/CVE-2026-74498/): ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set (not scored)
- [CVE-2026-74497](https://insights.sbomify.com/CVE-2026-74497/): ALSA: usb-audio: Clamp frame size in implicit-feedback mode (high 8.4)
- [CVE-2026-74496](https://insights.sbomify.com/CVE-2026-74496/): fou: Fix use-after-free in fou_create() (high 7.8)
- [CVE-2026-74495](https://insights.sbomify.com/CVE-2026-74495/): igbvf: Fix leak in TX DMA error cleanup (critical 9.8)
- [CVE-2026-74494](https://insights.sbomify.com/CVE-2026-74494/): ksmbd: reject repeated SMB2 NEGOTIATE requests (not scored)
- [CVE-2026-74493](https://insights.sbomify.com/CVE-2026-74493/): net/smc: fix socket use-after-free during link group termination (critical 9.8)
- [CVE-2026-74492](https://insights.sbomify.com/CVE-2026-74492/): netfilter: ipset: do not update comments from kernel-side hash adds (high 8.4)
- [CVE-2026-74491](https://insights.sbomify.com/CVE-2026-74491/): of/address: Fix NULL bus dereference in of_pci_range_parser_one() (not scored)
- [CVE-2026-74490](https://insights.sbomify.com/CVE-2026-74490/): tipc: avoid use-after-free in poll trace queue dumps (high 8.8)
- [CVE-2026-74489](https://insights.sbomify.com/CVE-2026-74489/): wifi: mac80211: fix tid_tx use-after-free on BA session stop (high 8.8)
- [CVE-2026-74488](https://insights.sbomify.com/CVE-2026-74488/): wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames (high 8.8)
- [CVE-2026-74487](https://insights.sbomify.com/CVE-2026-74487/): binfmt_misc: restore write access when removing an entry (not scored)
- [CVE-2026-74486](https://insights.sbomify.com/CVE-2026-74486/): binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (not scored)
- [CVE-2026-74485](https://insights.sbomify.com/CVE-2026-74485/): binfmt_misc: reject a flag character as the field delimiter (high 7.1)
- [CVE-2026-74484](https://insights.sbomify.com/CVE-2026-74484/): binfmt_misc: don't let an 'F' entry pin its own instance (not scored)
- [CVE-2026-74483](https://insights.sbomify.com/CVE-2026-74483/): binfmt_misc: don't leak the user namespace when the mount fails (not scored)
- [CVE-2026-74482](https://insights.sbomify.com/CVE-2026-74482/): mm/huge_memory: unlock i_mmap_rwsem before releasing after-split folios (high 7.8)
- [CVE-2026-74481](https://insights.sbomify.com/CVE-2026-74481/): mm/page_reporting: use system_freezable_wq to fix UAF during suspend (high 7.8)
- [CVE-2026-74480](https://insights.sbomify.com/CVE-2026-74480/): net: bridge: stop fast-leave after deleting a port group (critical 9.8)
- [CVE-2026-74479](https://insights.sbomify.com/CVE-2026-74479/): net: pktgen: fix proc entry use-after-free (high 7.8)
- [CVE-2026-74478](https://insights.sbomify.com/CVE-2026-74478/): um: vector: fix use-after-free in vector_mmsg_rx() (critical 9.8)
- [CVE-2026-74477](https://insights.sbomify.com/CVE-2026-74477/): uprobes: Fix NULL pointer dereference in hprobe_expire() (not scored)
- [CVE-2026-74476](https://insights.sbomify.com/CVE-2026-74476/): veth: convert frag_list skbs before running XDP (critical 9.1)
- [CVE-2026-74475](https://insights.sbomify.com/CVE-2026-74475/): vxlan: use neigh_ha_snapshot() in route_shortcircuit() (critical 10.0)
- [CVE-2026-74474](https://insights.sbomify.com/CVE-2026-74474/): vxlan: use pskb_network_may_pull() for transmit path header pulls (critical 9.8)
- [CVE-2026-74473](https://insights.sbomify.com/CVE-2026-74473/): vxlan: use pskb_network_may_pull() in route_shortcircuit() (critical 9.8)
- [CVE-2026-74472](https://insights.sbomify.com/CVE-2026-74472/): ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (not scored)
- [CVE-2026-74471](https://insights.sbomify.com/CVE-2026-74471/): tracing: Check return value of __register_event() in trace_module_add_events() (high 7.8)
- [CVE-2026-74470](https://insights.sbomify.com/CVE-2026-74470/): scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (high 7.8)
- [CVE-2026-7447](https://insights.sbomify.com/CVE-2026-7447/): SourceCodester Pet Grooming Management Software update_customer.php sql injection (medium 5.3)
- [CVE-2026-74469](https://insights.sbomify.com/CVE-2026-74469/): sctp: prevent peer transport count overflow (high 8.8)
- [CVE-2026-74468](https://insights.sbomify.com/CVE-2026-74468/): gpio: pch: use raw_spinlock_t for the register lock (not scored)
- [CVE-2026-74467](https://insights.sbomify.com/CVE-2026-74467/): s390/qeth: Check CAP_NET_ADMIN for private ioctls (high 7.8)
- [CVE-2026-74466](https://insights.sbomify.com/CVE-2026-74466/): s390/zcrypt: Close speculative mem read possibility (not scored)
- [CVE-2026-74465](https://insights.sbomify.com/CVE-2026-74465/): net: openvswitch: fix potential UAF on meter attach failure (high 7.8)
- [CVE-2026-74464](https://insights.sbomify.com/CVE-2026-74464/): net: openvswitch: fix skb leak on flow key update failure during ct (not scored)
- [CVE-2026-74463](https://insights.sbomify.com/CVE-2026-74463/): i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock (not scored)
- [CVE-2026-74462](https://insights.sbomify.com/CVE-2026-74462/): i2c: imx: mark I2C adapter when hardware is powered down (not scored)
- [CVE-2026-74461](https://insights.sbomify.com/CVE-2026-74461/): i2c: imx: Cancel hrtimer before clearing slave pointer (high 8.4)
- [CVE-2026-74460](https://insights.sbomify.com/CVE-2026-74460/): can: ems_usb: validate CPC message lengths (not scored)
- [CVE-2026-7446](https://insights.sbomify.com/CVE-2026-7446/): VetCoders mcp-server-semgrep MCP index.ts create_rule os command injection (medium 6.9)
- [CVE-2026-74459](https://insights.sbomify.com/CVE-2026-74459/): can: etas_es58x: es58x_read_bulk_callback(): fix RX buffer leak on URB resubmit failure (not scored)
- [CVE-2026-74458](https://insights.sbomify.com/CVE-2026-74458/): can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/392/