# Vulnerabilities published in 2026


- [CVE-2026-72498](https://insights.sbomify.com/CVE-2026-72498/): RDMA/bnxt_re: Avoid displaying the kernel pointer (not scored)
- [CVE-2026-72497](https://insights.sbomify.com/CVE-2026-72497/): RDMA/bnxt_re: Add a max slot check for SQ (high 8.8)
- [CVE-2026-72496](https://insights.sbomify.com/CVE-2026-72496/): RDMA/bnxt_re: Proper rollback if the ioremap fails (critical 9.2)
- [CVE-2026-72495](https://insights.sbomify.com/CVE-2026-72495/): RDMA/bnxt_re: Avoid repeated requests to allocate WC pages (critical 9.3)
- [CVE-2026-72494](https://insights.sbomify.com/CVE-2026-72494/): RDMA/irdma: Replace waitqueue and flag with completion (critical 9.8)
- [CVE-2026-72493](https://insights.sbomify.com/CVE-2026-72493/): net: serialize netif_running() check in enqueue_to_backlog() (critical 9.9)
- [CVE-2026-72492](https://insights.sbomify.com/CVE-2026-72492/): ksmbd: fix use-after-free in same_client_has_lease() (high 8.8)
- [CVE-2026-72491](https://insights.sbomify.com/CVE-2026-72491/): net/9p: fix race condition on rdma->state in trans_rdma.c (critical 9.8)
- [CVE-2026-72490](https://insights.sbomify.com/CVE-2026-72490/): staging: rtl8723bs: fix stainfo check in rtw_aes_decrypt (not scored)
- [CVE-2026-7249](https://insights.sbomify.com/CVE-2026-7249/): Missing authorization in Location Weather – WordPress Weather Forecast, AQI, Temperature and Weather Widget (medium 4.3)
- [CVE-2026-72489](https://insights.sbomify.com/CVE-2026-72489/): staging: nvec: fix use-after-free in nvec_rx_completed() (high 8.4)
- [CVE-2026-72488](https://insights.sbomify.com/CVE-2026-72488/): soundwire: fix bug in sdw_add_element_group_count found by syzkaller (high 7.8)
- [CVE-2026-72487](https://insights.sbomify.com/CVE-2026-72487/): PCI: Check ROM header and data structure addr before accessing (high 7.7)
- [CVE-2026-72486](https://insights.sbomify.com/CVE-2026-72486/): mailbox: mtk-adsp: fix UAF during device teardown (not scored)
- [CVE-2026-72485](https://insights.sbomify.com/CVE-2026-72485/): coresight: platform: defer connection counter increment until alloc succeeds (high 7.8)
- [CVE-2026-72484](https://insights.sbomify.com/CVE-2026-72484/): staging: most: video: avoid double free on video register failure (not scored)
- [CVE-2026-72483](https://insights.sbomify.com/CVE-2026-72483/): usb: host: max3421: Fix shift-out-of-bounds in max3421_hub_control() (high 7.8)
- [CVE-2026-72482](https://insights.sbomify.com/CVE-2026-72482/): gpib: fix double decrement of descriptor_busy in command_ioctl() (high 7.8)
- [CVE-2026-72481](https://insights.sbomify.com/CVE-2026-72481/): iio: magnetometer: ak8975: fix potential kernel stack memory leak (not scored)
- [CVE-2026-72480](https://insights.sbomify.com/CVE-2026-72480/): iio: adc: xilinx-ams: fix out-of-bounds channel lookup in event handling (high 7.8)
- [CVE-2026-7248](https://insights.sbomify.com/CVE-2026-7248/): D-Link DI-8100 CGI Endpoint tgfile.htm tgfile_htm buffer overflow (critical 9.3)
- [CVE-2026-72479](https://insights.sbomify.com/CVE-2026-72479/): iio: accel: mma8452: handle I2C read error(s) in mma8452_read() (not scored)
- [CVE-2026-72478](https://insights.sbomify.com/CVE-2026-72478/): fs/ntfs3: add bounds check to run_get_highest_vcn() (high 8.4)
- [CVE-2026-72477](https://insights.sbomify.com/CVE-2026-72477/): fs/ntfs3: call _ntfs_bad_inode() when failing to rename (critical 9.8)
- [CVE-2026-72476](https://insights.sbomify.com/CVE-2026-72476/): dmaengine: Fix possible use after free (high 7.8)
- [CVE-2026-72475](https://insights.sbomify.com/CVE-2026-72475/): dmaengine: dma-axi-dmac: Properly free struct axi_dmac_desc (not scored)
- [CVE-2026-72474](https://insights.sbomify.com/CVE-2026-72474/): dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor (not scored)
- [CVE-2026-72473](https://insights.sbomify.com/CVE-2026-72473/): xprtrdma: Decouple req recycling from RPC completion (critical 9.8)
- [CVE-2026-72472](https://insights.sbomify.com/CVE-2026-72472/): nfs: use nfsi->rwsem to protect traversal of the file lock list (critical 9.8)
- [CVE-2026-72471](https://insights.sbomify.com/CVE-2026-72471/): fs/ntfs3: prevent potential lcn remains uninitialized (high 7.1)
- [CVE-2026-72470](https://insights.sbomify.com/CVE-2026-72470/): fs/ntfs3: resize log->one_page_buf when adopting on-disk page size (high 7.8)
- [CVE-2026-7247](https://insights.sbomify.com/CVE-2026-7247/): D-Link DI-8100 File Extension file_exten.asp file_exten_asp buffer overflow (high 8.6)
- [CVE-2026-72469](https://insights.sbomify.com/CVE-2026-72469/): xprtrdma: Fix ep kref imbalance on ADDR_CHANGE (high 8.8)
- [CVE-2026-72468](https://insights.sbomify.com/CVE-2026-72468/): xprtrdma: Initialize re_id before removal registration (not scored)
- [CVE-2026-72467](https://insights.sbomify.com/CVE-2026-72467/): xprtrdma: Check frwr_wp_create() during connect (not scored)
- [CVE-2026-72466](https://insights.sbomify.com/CVE-2026-72466/): xprtrdma: Fix bcall rep leak and unbounded peek (critical 9.8)
- [CVE-2026-72465](https://insights.sbomify.com/CVE-2026-72465/): xprtrdma: Sanitize the reply credit grant after parsing (high 7.5)
- [CVE-2026-72464](https://insights.sbomify.com/CVE-2026-72464/): xprtrdma: Repost Receive buffers for malformed replies (high 7.5)
- [CVE-2026-72463](https://insights.sbomify.com/CVE-2026-72463/): xfrm: Fix dev use-after-free in xfrm async resumption (critical 9.8)
- [CVE-2026-72462](https://insights.sbomify.com/CVE-2026-72462/): apparmor: fix race in unix socket mediation when peer_path is used (high 8.8)
- [CVE-2026-72461](https://insights.sbomify.com/CVE-2026-72461/): apparmor: fix refcount leak when updating the sk_ctx (high 7.8)
- [CVE-2026-72460](https://insights.sbomify.com/CVE-2026-72460/): apparmor: check label build before no_new_privs test (high 7.1)
- [CVE-2026-7246](https://insights.sbomify.com/CVE-2026-7246/): [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()" (high 7.2)
- [CVE-2026-72459](https://insights.sbomify.com/CVE-2026-72459/): apparmor: aa_label_alloc use aa_label_free on alloc failure (high 7.8)
- [CVE-2026-72458](https://insights.sbomify.com/CVE-2026-72458/): apparmor: fix NULL pointer dereference in unpack_pdb (not scored)
- [CVE-2026-72457](https://insights.sbomify.com/CVE-2026-72457/): apparmor: fail policy unpack on accept2 allocation failure (not scored)
- [CVE-2026-72456](https://insights.sbomify.com/CVE-2026-72456/): apparmor: release exe file resources on path failure (not scored)
- [CVE-2026-72455](https://insights.sbomify.com/CVE-2026-72455/): apparmor: fix uninitialised pointer passed to audit_log_untrustedstring() (high 7.1)
- [CVE-2026-72454](https://insights.sbomify.com/CVE-2026-72454/): i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev() (high 7.8)
- [CVE-2026-72453](https://insights.sbomify.com/CVE-2026-72453/): regcache: Do not overwrite error code when finalizing cache after error (not scored)
- [CVE-2026-72452](https://insights.sbomify.com/CVE-2026-72452/): drm/i915: clear CRTC color blob pointers after dropping refs (high 7.8)
- [CVE-2026-72451](https://insights.sbomify.com/CVE-2026-72451/): xfrm: Fix xfrm state cache insertion race (critical 9.8)
- [CVE-2026-72450](https://insights.sbomify.com/CVE-2026-72450/): xfrm: validate selector family and prefixlen during match (high 7.8)
- [CVE-2026-72449](https://insights.sbomify.com/CVE-2026-72449/): drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm (high 7.8)
- [CVE-2026-72448](https://insights.sbomify.com/CVE-2026-72448/): octeontx2-pf: Fix leak of SQ timestamp buffer on teardown (not scored)
- [CVE-2026-72447](https://insights.sbomify.com/CVE-2026-72447/): sctp: hold socket lock when dumping endpoints in sctp_diag (not scored)
- [CVE-2026-72446](https://insights.sbomify.com/CVE-2026-72446/): ALSA: usb-audio: qcom: reject stream disable with no active interface (high 7.8)
- [CVE-2026-72445](https://insights.sbomify.com/CVE-2026-72445/): ALSA: usb-audio: qcom: clear opened when stream enable fails (not scored)
- [CVE-2026-72444](https://insights.sbomify.com/CVE-2026-72444/): flow_dissector: check device type before reading ETH_ADDRS (high 7.8)
- [CVE-2026-72443](https://insights.sbomify.com/CVE-2026-72443/): ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (not scored)
- [CVE-2026-72442](https://insights.sbomify.com/CVE-2026-72442/): netfilter: flowtable: fix and simplify IP6IP6 tunnel handling (critical 9.8)
- [CVE-2026-72441](https://insights.sbomify.com/CVE-2026-72441/): ieee802154: fix kernel-infoleak in dgram_recvmsg() (not scored)
- [CVE-2026-72440](https://insights.sbomify.com/CVE-2026-72440/): md/raid1: fix writes_pending and barrier reference leaks on write failures (high 7.1)
- [CVE-2026-7244](https://insights.sbomify.com/CVE-2026-7244/): Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection (critical 9.3)
- [CVE-2026-72439](https://insights.sbomify.com/CVE-2026-72439/): md/raid10: fix writes_pending leak on write request failures (not scored)
- [CVE-2026-72438](https://insights.sbomify.com/CVE-2026-72438/): md/raid10: fix writes_pending and barrier reference leaks on discard failures (high 7.5)
- [CVE-2026-72437](https://insights.sbomify.com/CVE-2026-72437/): md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry (not scored)
- [CVE-2026-72436](https://insights.sbomify.com/CVE-2026-72436/): netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (critical 9.8)
- [CVE-2026-72435](https://insights.sbomify.com/CVE-2026-72435/): netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (high 7.8)
- [CVE-2026-72434](https://insights.sbomify.com/CVE-2026-72434/): netfilter: ipset: make sure gc is properly stopped (high 7.8)
- [CVE-2026-72433](https://insights.sbomify.com/CVE-2026-72433/): netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (not scored)
- [CVE-2026-72432](https://insights.sbomify.com/CVE-2026-72432/): tpm_crb: Check ACPI_COMPANION() against NULL during probe (not scored)
- [CVE-2026-72431](https://insights.sbomify.com/CVE-2026-72431/): alloc_tag: fix use-after-free in /proc/allocinfo after module unload (not scored)
- [CVE-2026-72430](https://insights.sbomify.com/CVE-2026-72430/): net/sched: act_ct: fix nf_connlabels leak on two error paths (not scored)
- [CVE-2026-7243](https://insights.sbomify.com/CVE-2026-7243/): Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection (critical 9.3)
- [CVE-2026-72429](https://insights.sbomify.com/CVE-2026-72429/): ipv6: ioam: fix type confusion of dst_entry (critical 9.8)
- [CVE-2026-72428](https://insights.sbomify.com/CVE-2026-72428/): bpf: Fix stack slot index in nospec checks (not scored)
- [CVE-2026-72427](https://insights.sbomify.com/CVE-2026-72427/): bpf: Fix effective prog array index with BPF_F_PREORDER (high 7.8)
- [CVE-2026-72426](https://insights.sbomify.com/CVE-2026-72426/): bpf: Preserve pointer spill metadata during half-slot cleanup (high 8.4)
- [CVE-2026-72425](https://insights.sbomify.com/CVE-2026-72425/): ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (high 7.1)
- [CVE-2026-72424](https://insights.sbomify.com/CVE-2026-72424/): rtc: msc313: fix NULL deref in shared IRQ handler at probe (not scored)
- [CVE-2026-72423](https://insights.sbomify.com/CVE-2026-72423/): bpf: Guard conntrack opts error writes (high 8.8)
- [CVE-2026-72422](https://insights.sbomify.com/CVE-2026-72422/): ksmbd: fix use-after-free of conn->preauth_info in concurrent SMB2 NEGOTIATE (critical 9.8)
- [CVE-2026-72421](https://insights.sbomify.com/CVE-2026-72421/): ipv4: fib: Don't ignore error route in local/main tables. (critical 10.0)
- [CVE-2026-72420](https://insights.sbomify.com/CVE-2026-72420/): md/raid5: avoid R5_Overlap races while breaking stripe batches (high 8.8)
- [CVE-2026-7242](https://insights.sbomify.com/CVE-2026-7242/): Totolink A8000RU CGI cstecgi.cgi setOpenVpnClientCfg os command injection (critical 9.3)
- [CVE-2026-72419](https://insights.sbomify.com/CVE-2026-72419/): netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init() (high 7.8)
- [CVE-2026-72418](https://insights.sbomify.com/CVE-2026-72418/): netfilter: nf_conncount: prevent connlimit drops for early confirmed ct (high 7.5)
- [CVE-2026-72417](https://insights.sbomify.com/CVE-2026-72417/): netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto() (critical 9.8)
- [CVE-2026-72416](https://insights.sbomify.com/CVE-2026-72416/): netfilter: nft_compat: ebtables emulation must reject non-bridge targets (high 7.3)
- [CVE-2026-72415](https://insights.sbomify.com/CVE-2026-72415/): ASoC: SDCA: Validate written enum value in ge_put_enum_double() (high 7.1)
- [CVE-2026-72414](https://insights.sbomify.com/CVE-2026-72414/): net: dsa: sja1105: round up PTP perout pin duration (not scored)
- [CVE-2026-72413](https://insights.sbomify.com/CVE-2026-72413/): sctp: fix err_chunk memory leaks in INIT handling (not scored)
- [CVE-2026-72412](https://insights.sbomify.com/CVE-2026-72412/): s390/mm: Fix handling of _PAGE_UNUSED pte bit (critical 9.3)
- [CVE-2026-72411](https://insights.sbomify.com/CVE-2026-72411/): net: dsa: mxl862xx: fix use-after-free of DSA ports in crc_err_work (high 7.8)
- [CVE-2026-72410](https://insights.sbomify.com/CVE-2026-72410/): octeontx2-af: Validate NIX maximum LFs correctly (high 7.8)
- [CVE-2026-7241](https://insights.sbomify.com/CVE-2026-7241/): Totolink A8000RU CGI cstecgi.cgi setWiFiBasicCfg os command injection (critical 9.3)
- [CVE-2026-72409](https://insights.sbomify.com/CVE-2026-72409/): net: mvneta: re-enable percpu interrupt on resume (high 7.5)
- [CVE-2026-72408](https://insights.sbomify.com/CVE-2026-72408/): geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint (critical 10.0)
- [CVE-2026-72407](https://insights.sbomify.com/CVE-2026-72407/): geneve: validate inner network offset in geneve_gro_complete() (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/410/