# Vulnerabilities published in 2026


- [CVE-2026-74364](https://insights.sbomify.com/CVE-2026-74364/): bpf: Reject exclusive maps as inner maps in map-in-map (high 7.1)
- [CVE-2026-74363](https://insights.sbomify.com/CVE-2026-74363/): bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs (high 7.8)
- [CVE-2026-74362](https://insights.sbomify.com/CVE-2026-74362/): ext2: fix ignored return value of generic_write_sync() (not scored)
- [CVE-2026-74361](https://insights.sbomify.com/CVE-2026-74361/): nvme: fix FDP fdpcidx bounds check (critical 9.8)
- [CVE-2026-74360](https://insights.sbomify.com/CVE-2026-74360/): bpf: Reject exclusive maps for bpf_map_elem iterators (not scored)
- [CVE-2026-7436](https://insights.sbomify.com/CVE-2026-7436/): Cross-site scripting in WPC Badge Management for WooCommerce (medium 6.4)
- [CVE-2026-74359](https://insights.sbomify.com/CVE-2026-74359/): configfs_lookup(): don't leave ->s_dentry dangling on failure (high 7.8)
- [CVE-2026-74358](https://insights.sbomify.com/CVE-2026-74358/): ext4: fix fast commit wait/wake bit mapping on 64-bit (not scored)
- [CVE-2026-74357](https://insights.sbomify.com/CVE-2026-74357/): drm/amdgpu: fix KASAN slab-out-of-bounds in amdgpu_coredump ring dump (high 7.8)
- [CVE-2026-74356](https://insights.sbomify.com/CVE-2026-74356/): vhost: fix vhost_get_avail_idx for a non empty ring (high 7.4)
- [CVE-2026-74355](https://insights.sbomify.com/CVE-2026-74355/): iommu/vt-d: Fix RB-tree corruption in probe error path (high 8.2)
- [CVE-2026-74354](https://insights.sbomify.com/CVE-2026-74354/): bpf: Take mmap_lock in zap_pages() (high 7.8)
- [CVE-2026-74353](https://insights.sbomify.com/CVE-2026-74353/): drm/amdkfd: always resume_all after suspend_all (not scored)
- [CVE-2026-74352](https://insights.sbomify.com/CVE-2026-74352/): of: reserved_mem: avoid post-init UAF when alloc_reserved_mem_array() fails (not scored)
- [CVE-2026-74351](https://insights.sbomify.com/CVE-2026-74351/): ocfs2: rebase copied fsdlm LVB pointers in locking_state (not scored)
- [CVE-2026-74350](https://insights.sbomify.com/CVE-2026-74350/): ocfs2: validate fast symlink target during inode read (critical 9.8)
- [CVE-2026-7435](https://insights.sbomify.com/CVE-2026-7435/): SSCMS v7.4.0 SQL Injection via stl:sqlContent queryString (high 8.6)
- [CVE-2026-74349](https://insights.sbomify.com/CVE-2026-74349/): ocfs2: reject FITRIM ranges shorter than a cluster (high 7.1)
- [CVE-2026-74348](https://insights.sbomify.com/CVE-2026-74348/): ocfs2/dlm: require a ref for locking_state debugfs open (not scored)
- [CVE-2026-74347](https://insights.sbomify.com/CVE-2026-74347/): netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount (high 7.8)
- [CVE-2026-74346](https://insights.sbomify.com/CVE-2026-74346/): RDMA/irdma: Fix OOB read during CQ MR registration (not scored)
- [CVE-2026-74345](https://insights.sbomify.com/CVE-2026-74345/): RDMA/siw: Fix endpoint/socket association handling (critical 9.8)
- [CVE-2026-74344](https://insights.sbomify.com/CVE-2026-74344/): bpf: Clear rb node linkage when freeing bpf_rb_root (high 7.8)
- [CVE-2026-74343](https://insights.sbomify.com/CVE-2026-74343/): kernfs: fix xattr race condition with multiple superblocks (high 7.8)
- [CVE-2026-74342](https://insights.sbomify.com/CVE-2026-74342/): kernfs: link kn to its parent before the LSM init hook (not scored)
- [CVE-2026-74341](https://insights.sbomify.com/CVE-2026-74341/): wifi: wcn36xx: fix heap overflow from oversized firmware HAL response (high 8.8)
- [CVE-2026-74340](https://insights.sbomify.com/CVE-2026-74340/): wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication (high 8.1)
- [CVE-2026-74339](https://insights.sbomify.com/CVE-2026-74339/): ALSA: seq: Clear variable event pointer on read (not scored)
- [CVE-2026-74338](https://insights.sbomify.com/CVE-2026-74338/): bpf: Reject sleepable BPF_LSM_CGROUP programs at load time (high 7.8)
- [CVE-2026-74337](https://insights.sbomify.com/CVE-2026-74337/): bpf: Fix NMI/tracepoint re-entry deadlock on lru locks (not scored)
- [CVE-2026-74336](https://insights.sbomify.com/CVE-2026-74336/): wifi: mac80211: bound S1G TIM PVB walk to the TIM element (not scored)
- [CVE-2026-74335](https://insights.sbomify.com/CVE-2026-74335/): bpf: Fix NULL pointer dereference in bpf_task_from_vpid() (not scored)
- [CVE-2026-74334](https://insights.sbomify.com/CVE-2026-74334/): RDMA/nldev: Fix locking when accessing mr->pd (high 7.8)
- [CVE-2026-74333](https://insights.sbomify.com/CVE-2026-74333/): ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (high 8.4)
- [CVE-2026-74332](https://insights.sbomify.com/CVE-2026-74332/): ASoC: amd: acp-sdw-sof: Bound DAI link iteration (high 8.4)
- [CVE-2026-74331](https://insights.sbomify.com/CVE-2026-74331/): firmware_loader: Fix recursive lock in device_cache_fw_images() (not scored)
- [CVE-2026-74330](https://insights.sbomify.com/CVE-2026-74330/): configfs: fix lockless traversals of ->s_children (high 7.8)
- [CVE-2026-74329](https://insights.sbomify.com/CVE-2026-74329/): watchdog: unregister PM notifier on watchdog unregister (not scored)
- [CVE-2026-74328](https://insights.sbomify.com/CVE-2026-74328/): iommufd: Destroy the pages content after detaching from dmabuf (high 8.8)
- [CVE-2026-74327](https://insights.sbomify.com/CVE-2026-74327/): vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() (not scored)
- [CVE-2026-74326](https://insights.sbomify.com/CVE-2026-74326/): wifi: mt76: mt7921: fix resource leak in probe error path (not scored)
- [CVE-2026-74325](https://insights.sbomify.com/CVE-2026-74325/): wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link (high 7.8)
- [CVE-2026-74324](https://insights.sbomify.com/CVE-2026-74324/): wifi: mt76: mt7925: validate skb length in testmode query (not scored)
- [CVE-2026-74323](https://insights.sbomify.com/CVE-2026-74323/): wifi: mt76: mt7996: Fix possible token leak in mt7996_tx_prepare_skb() (high 8.8)
- [CVE-2026-74322](https://insights.sbomify.com/CVE-2026-74322/): wifi: mt76: mt7996: Fix possible NULL pointer dereference in mt7996_mac_write_txwi_80211() (not scored)
- [CVE-2026-74321](https://insights.sbomify.com/CVE-2026-74321/): btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() (high 7.5)
- [CVE-2026-74320](https://insights.sbomify.com/CVE-2026-74320/): fbdev: sm501fb: Fix buffer errors in OF binding code (not scored)
- [CVE-2026-7432](https://insights.sbomify.com/CVE-2026-7432/): Race condition in Secure Access Client (high 7.8)
- [CVE-2026-74319](https://insights.sbomify.com/CVE-2026-74319/): btrfs: zoned: fix deadlock waiting for ticket during data relocation (not scored)
- [CVE-2026-74318](https://insights.sbomify.com/CVE-2026-74318/): btrfs: fix deadlock cloning inline extent when using flushoncommit (not scored)
- [CVE-2026-74317](https://insights.sbomify.com/CVE-2026-74317/): ixgbe: do not configure xps for XDP queues (high 7.8)
- [CVE-2026-74316](https://insights.sbomify.com/CVE-2026-74316/): NFSD: Handle layout stid in nfsd4_drop_revoked_stid() (high 7.5)
- [CVE-2026-74315](https://insights.sbomify.com/CVE-2026-74315/): lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() (critical 9.8)
- [CVE-2026-74314](https://insights.sbomify.com/CVE-2026-74314/): bpf: Cancel special fields on map value recycle (high 7.8)
- [CVE-2026-74313](https://insights.sbomify.com/CVE-2026-74313/): vduse: hold vduse_lock across IDR lookup in open path (high 8.8)
- [CVE-2026-74312](https://insights.sbomify.com/CVE-2026-74312/): vhost/vdpa: validate virtqueue index in mmap and fault paths (high 7.8)
- [CVE-2026-74311](https://insights.sbomify.com/CVE-2026-74311/): virtio: rtc: tear down old virtqueues before restore (high 7.8)
- [CVE-2026-74310](https://insights.sbomify.com/CVE-2026-74310/): vhost/net: complete zerocopy ubufs only once (critical 9.3)
- [CVE-2026-7431](https://insights.sbomify.com/CVE-2026-7431/): Misconfiguration in Secure Access Client (medium 4.4)
- [CVE-2026-74309](https://insights.sbomify.com/CVE-2026-74309/): vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler (critical 10.0)
- [CVE-2026-74308](https://insights.sbomify.com/CVE-2026-74308/): ext4: fix kernel BUG in ext4_write_inline_data_end (not scored)
- [CVE-2026-74307](https://insights.sbomify.com/CVE-2026-74307/): ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT (not scored)
- [CVE-2026-74306](https://insights.sbomify.com/CVE-2026-74306/): vfio/qat: fix f_pos race in qat_vf_resume_write() (high 7.8)
- [CVE-2026-74305](https://insights.sbomify.com/CVE-2026-74305/): bpf: Tighten cgroup storage cookie checks for prog arrays (high 7.8)
- [CVE-2026-74304](https://insights.sbomify.com/CVE-2026-74304/): Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device (not scored)
- [CVE-2026-74303](https://insights.sbomify.com/CVE-2026-74303/): Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device (not scored)
- [CVE-2026-74302](https://insights.sbomify.com/CVE-2026-74302/): Bluetooth: hci_core: Fix UAF in hci_unregister_dev() (high 7.8)
- [CVE-2026-74301](https://insights.sbomify.com/CVE-2026-74301/): Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path (not scored)
- [CVE-2026-74300](https://insights.sbomify.com/CVE-2026-74300/): Bluetooth: hci: validate codec capability element length (high 8.8)
- [CVE-2026-7430](https://insights.sbomify.com/CVE-2026-7430/): Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import (medium 4.4)
- [CVE-2026-74299](https://insights.sbomify.com/CVE-2026-74299/): RDMA/core: Fix FRMR aging push to queue error flow (not scored)
- [CVE-2026-74298](https://insights.sbomify.com/CVE-2026-74298/): RDMA/core: Fix FRMR set pinned push error path (not scored)
- [CVE-2026-74297](https://insights.sbomify.com/CVE-2026-74297/): RDMA/mlx5: Fix undefined shift of user RQ WQE size (high 7.8)
- [CVE-2026-74296](https://insights.sbomify.com/CVE-2026-74296/): RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one (high 7.8)
- [CVE-2026-74295](https://insights.sbomify.com/CVE-2026-74295/): ASoC: codecs: hdac_hdmi: Validate written enum value (high 7.1)
- [CVE-2026-74294](https://insights.sbomify.com/CVE-2026-74294/): ASoC: meson: aiu: Validate written enum values (high 7.3)
- [CVE-2026-74293](https://insights.sbomify.com/CVE-2026-74293/): ASoC: fsl: fsl_audmix: Validate written enum values (high 7.8)
- [CVE-2026-74292](https://insights.sbomify.com/CVE-2026-74292/): ASoC: tegra: tegra210_ahub: Validate written enum value (high 7.1)
- [CVE-2026-74291](https://insights.sbomify.com/CVE-2026-74291/): ASoC: topology: Check PCM and DAI name strings before use (not scored)
- [CVE-2026-74290](https://insights.sbomify.com/CVE-2026-74290/): net/sched: cls_flow: Dont expose folded kernel pointers (not scored)
- [CVE-2026-7429](https://insights.sbomify.com/CVE-2026-7429/): SSCMS v7.4.0 Reflected Cross-Site Scripting via STL Processing (low 2.1)
- [CVE-2026-74289](https://insights.sbomify.com/CVE-2026-74289/): ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). (high 7.8)
- [CVE-2026-74288](https://insights.sbomify.com/CVE-2026-74288/): net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). (high 7.8)
- [CVE-2026-74287](https://insights.sbomify.com/CVE-2026-74287/): sctp: validate embedded address parameter length (critical 9.1)
- [CVE-2026-74286](https://insights.sbomify.com/CVE-2026-74286/): net: pfcp: allocate per-cpu tstats for PFCP netdevs (not scored)
- [CVE-2026-74285](https://insights.sbomify.com/CVE-2026-74285/): net: Stop leased rxq before uninstalling its memory provider (high 8.8)
- [CVE-2026-74284](https://insights.sbomify.com/CVE-2026-74284/): net/sched: sch_hfsc: Don't make class passive twice (not scored)
- [CVE-2026-74283](https://insights.sbomify.com/CVE-2026-74283/): tipc: require net admin for TIPCv2 netlink mutators (high 7.8)
- [CVE-2026-74282](https://insights.sbomify.com/CVE-2026-74282/): tipc: prevent snt_unacked underflow on CONN_ACK (high 7.5)
- [CVE-2026-74281](https://insights.sbomify.com/CVE-2026-74281/): tipc: reject inverted service ranges from peer bindings (high 7.5)
- [CVE-2026-74280](https://insights.sbomify.com/CVE-2026-74280/): crypto: marvell/octeontx - fix DMA cleanup using wrong loop index (critical 10.0)
- [CVE-2026-7428](https://insights.sbomify.com/CVE-2026-7428/): Insecure default administrative credentials in AlloyDB for PostgreSQL (critical 9.2)
- [CVE-2026-74279](https://insights.sbomify.com/CVE-2026-74279/): crypto: cavium/cpt - fix DMA cleanup using wrong loop index (critical 10.0)
- [CVE-2026-74278](https://insights.sbomify.com/CVE-2026-74278/): ALSA: seq: Fix kernel heap address leak in bounce_error_event() (not scored)
- [CVE-2026-74277](https://insights.sbomify.com/CVE-2026-74277/): iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (high 8.8)
- [CVE-2026-74276](https://insights.sbomify.com/CVE-2026-74276/): spi: xilinx: use FIFO occupancy register to determine buffer size (not scored)
- [CVE-2026-74275](https://insights.sbomify.com/CVE-2026-74275/): cxl/region: Fix out-of-bounds access in cxl_cancel_auto_attach() (high 8.4)
- [CVE-2026-74274](https://insights.sbomify.com/CVE-2026-74274/): cxl/region: Fill first free targets[] slot during auto-discovery (not scored)
- [CVE-2026-74273](https://insights.sbomify.com/CVE-2026-74273/): cxl/region: Block region delete during region creation (not scored)
- [CVE-2026-74272](https://insights.sbomify.com/CVE-2026-74272/): cxl/region: Resolve region deletion races (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/394/