# Vulnerabilities published in 2026


- [CVE-2026-72406](https://insights.sbomify.com/CVE-2026-72406/): net: sungem: fix probe error cleanup (high 7.8)
- [CVE-2026-72405](https://insights.sbomify.com/CVE-2026-72405/): net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (high 7.8)
- [CVE-2026-72404](https://insights.sbomify.com/CVE-2026-72404/): tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() (high 7.8)
- [CVE-2026-72403](https://insights.sbomify.com/CVE-2026-72403/): ALSA: FCP: Fix NULL pointer dereference in interface lookup (not scored)
- [CVE-2026-72402](https://insights.sbomify.com/CVE-2026-72402/): bpf: Mask pseudo pointer values in verifier logs (not scored)
- [CVE-2026-72401](https://insights.sbomify.com/CVE-2026-72401/): bpf: Fix insn_aux_data leak on verifier err_free_env path (not scored)
- [CVE-2026-72400](https://insights.sbomify.com/CVE-2026-72400/): seg6: validate SRH length before reading fixed fields (high 7.8)
- [CVE-2026-7240](https://insights.sbomify.com/CVE-2026-7240/): Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection (critical 9.3)
- [CVE-2026-72399](https://insights.sbomify.com/CVE-2026-72399/): net: enetc: check the number of BDs needed for xdp_frame (critical 9.8)
- [CVE-2026-72398](https://insights.sbomify.com/CVE-2026-72398/): sctp: add INIT verification after cookie unpacking (critical 9.8)
- [CVE-2026-72397](https://insights.sbomify.com/CVE-2026-72397/): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() (high 7.1)
- [CVE-2026-72396](https://insights.sbomify.com/CVE-2026-72396/): hwmon: adm1275: Prevent reading uninitialized stack (not scored)
- [CVE-2026-72395](https://insights.sbomify.com/CVE-2026-72395/): hwmon: (pmbus) Fix passing events to regulator core (high 7.1)
- [CVE-2026-72394](https://insights.sbomify.com/CVE-2026-72394/): hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero (not scored)
- [CVE-2026-72393](https://insights.sbomify.com/CVE-2026-72393/): eth: fbnic: don't cache shinfo across skb realloc (critical 9.8)
- [CVE-2026-72392](https://insights.sbomify.com/CVE-2026-72392/): ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (not scored)
- [CVE-2026-72391](https://insights.sbomify.com/CVE-2026-72391/): net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy (not scored)
- [CVE-2026-72390](https://insights.sbomify.com/CVE-2026-72390/): net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF (high 7.8)
- [CVE-2026-72389](https://insights.sbomify.com/CVE-2026-72389/): bridge: stp: Fix a potential use-after-free when deleting a bridge (high 7.8)
- [CVE-2026-72388](https://insights.sbomify.com/CVE-2026-72388/): drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock (not scored)
- [CVE-2026-72387](https://insights.sbomify.com/CVE-2026-72387/): drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() (not scored)
- [CVE-2026-72386](https://insights.sbomify.com/CVE-2026-72386/): drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced (not scored)
- [CVE-2026-72385](https://insights.sbomify.com/CVE-2026-72385/): tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry() (not scored)
- [CVE-2026-72384](https://insights.sbomify.com/CVE-2026-72384/): irqchip/ts4800: Fix missing chained handler cleanup on remove (not scored)
- [CVE-2026-72383](https://insights.sbomify.com/CVE-2026-72383/): sctp: fix addr_wq_timer race in sctp_free_addr_wq() (high 7.8)
- [CVE-2026-72382](https://insights.sbomify.com/CVE-2026-72382/): ksmbd: reject undersized DACLs before parsing ACEs (high 8.8)
- [CVE-2026-72381](https://insights.sbomify.com/CVE-2026-72381/): ksmbd: fix use-after-free of fp->owner.name in durable handle owner check (critical 9.8)
- [CVE-2026-72380](https://insights.sbomify.com/CVE-2026-72380/): xen/pvcalls: bound backend response req_id before indexing rsp[] (high 8.8)
- [CVE-2026-7238](https://insights.sbomify.com/CVE-2026-7238/): code-projects Online Music Site AdminUpdateAlbum.php unrestricted upload (medium 5.1)
- [CVE-2026-72379](https://insights.sbomify.com/CVE-2026-72379/): fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid (not scored)
- [CVE-2026-72378](https://insights.sbomify.com/CVE-2026-72378/): afs: Fix error code in afs_extract_vl_addrs() (high 7.5)
- [CVE-2026-72377](https://insights.sbomify.com/CVE-2026-72377/): afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints (not scored)
- [CVE-2026-72376](https://insights.sbomify.com/CVE-2026-72376/): afs: Fix misplaced inc of net->cells_outstanding (not scored)
- [CVE-2026-72375](https://insights.sbomify.com/CVE-2026-72375/): afs: Fix reinitialisation of the inode, in particular ->lock_work (high 7.8)
- [CVE-2026-72374](https://insights.sbomify.com/CVE-2026-72374/): afs: Fix callback service message parsers to pass through -EAGAIN (high 7.5)
- [CVE-2026-72373](https://insights.sbomify.com/CVE-2026-72373/): afs: Fix missing NULL pointer check in afs_break_some_callbacks() (high 7.5)
- [CVE-2026-72372](https://insights.sbomify.com/CVE-2026-72372/): afs: Fix lack of locking around modifications of net->cells_dyn_ino (high 7.8)
- [CVE-2026-72371](https://insights.sbomify.com/CVE-2026-72371/): afs: Fix the volume AFS_VOLUME_RM_TREE is set on (high 7.8)
- [CVE-2026-72370](https://insights.sbomify.com/CVE-2026-72370/): iomap: release pages on atomic dio size mismatch (not scored)
- [CVE-2026-7237](https://insights.sbomify.com/CVE-2026-7237/): AgiFlow scaffold-mcp write-to-file Tool index.ts path traversal (medium 6.9)
- [CVE-2026-72369](https://insights.sbomify.com/CVE-2026-72369/): minix: avoid overflow in bitmap block count calculation (high 7.8)
- [CVE-2026-72368](https://insights.sbomify.com/CVE-2026-72368/): cachefiles: Fix double unlock in nomem_d_alloc error path (high 7.8)
- [CVE-2026-72367](https://insights.sbomify.com/CVE-2026-72367/): iomap: guard io_size EOF trim against concurrent truncate underflow (high 8.8)
- [CVE-2026-72366](https://insights.sbomify.com/CVE-2026-72366/): netfs: Fix netfs_create_write_req() to handle async cache object creation (critical 9.8)
- [CVE-2026-72365](https://insights.sbomify.com/CVE-2026-72365/): netfs: Fix writethrough to use collection offload (not scored)
- [CVE-2026-72364](https://insights.sbomify.com/CVE-2026-72364/): netfs: Fix writeback error handling (high 7.1)
- [CVE-2026-72363](https://insights.sbomify.com/CVE-2026-72363/): netfs: Fix folio state after ENOMEM whilst under writeback iteration (not scored)
- [CVE-2026-72362](https://insights.sbomify.com/CVE-2026-72362/): drm/xe/pt: Fix NULL pointer dereference in xe_pt_zap_ptes_entry() (not scored)
- [CVE-2026-72361](https://insights.sbomify.com/CVE-2026-72361/): drm/xe/hw_engine: Fix double-free of managed BO in error path (not scored)
- [CVE-2026-72360](https://insights.sbomify.com/CVE-2026-72360/): drm/xe/pf: Don't attempt to process FAST_REQ or EVENT relays (high 8.4)
- [CVE-2026-72359](https://insights.sbomify.com/CVE-2026-72359/): drm/xe: fix NPD in bo_meminfo() (not scored)
- [CVE-2026-72358](https://insights.sbomify.com/CVE-2026-72358/): drm/xe/pt: prevent invalid cursor access for purged BOs (high 7.8)
- [CVE-2026-72357](https://insights.sbomify.com/CVE-2026-72357/): uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline (high 7.8)
- [CVE-2026-72356](https://insights.sbomify.com/CVE-2026-72356/): cifs: Fix missing credit release on failure in cifs_issue_read() (high 7.5)
- [CVE-2026-72355](https://insights.sbomify.com/CVE-2026-72355/): netfs: Fix barriering when walking subrequest list (critical 9.8)
- [CVE-2026-72354](https://insights.sbomify.com/CVE-2026-72354/): ntfs: avoid stale runlist element dereference in MFT writeback (high 8.8)
- [CVE-2026-72353](https://insights.sbomify.com/CVE-2026-72353/): ntfs: avoid stale runlist element dereference in fallocate (high 8.8)
- [CVE-2026-72352](https://insights.sbomify.com/CVE-2026-72352/): HID: bpf: Fix hid_bpf_get_data() range check (high 7.8)
- [CVE-2026-72351](https://insights.sbomify.com/CVE-2026-72351/): gue: validate REMCSUM private option length (critical 9.8)
- [CVE-2026-72350](https://insights.sbomify.com/CVE-2026-72350/): netfilter: xt_u32: reject invalid shift counts (high 7.8)
- [CVE-2026-7235](https://insights.sbomify.com/CVE-2026-7235/): ErlichLiu claude-agent-sdk-master route.ts path traversal (medium 6.9)
- [CVE-2026-72349](https://insights.sbomify.com/CVE-2026-72349/): netfilter: xt_rateest: fix u64 truncation in xt_rateest_mt() (not scored)
- [CVE-2026-72348](https://insights.sbomify.com/CVE-2026-72348/): netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (critical 9.1)
- [CVE-2026-72347](https://insights.sbomify.com/CVE-2026-72347/): netfilter: xt_connmark: reject invalid shift parameters (high 7.3)
- [CVE-2026-72346](https://insights.sbomify.com/CVE-2026-72346/): platform/x86: bitland-mifs-wmi: Fix NULL pointer dereference during suspend/resume (not scored)
- [CVE-2026-72345](https://insights.sbomify.com/CVE-2026-72345/): net/mlx5: LAG, Fix off-by-one in single-FDB error rollback (high 7.8)
- [CVE-2026-72344](https://insights.sbomify.com/CVE-2026-72344/): net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable (high 7.8)
- [CVE-2026-72343](https://insights.sbomify.com/CVE-2026-72343/): net/mlx5e: Fix HV VHCA stats zero-sized buffer allocation (high 8.4)
- [CVE-2026-72342](https://insights.sbomify.com/CVE-2026-72342/): net/mlx5e: Fix HV VHCA stats agent registration race (high 8.4)
- [CVE-2026-72341](https://insights.sbomify.com/CVE-2026-72341/): net/mlx5e: Fix publication race for priv->channel_stats[] (not scored)
- [CVE-2026-72340](https://insights.sbomify.com/CVE-2026-72340/): net: microchip: vcap: fix races on the shared Super VCAP block (high 7.8)
- [CVE-2026-7234](https://insights.sbomify.com/CVE-2026-7234/): BrowserOperator browser-operator-core server.js startsWith path traversal (medium 6.9)
- [CVE-2026-72339](https://insights.sbomify.com/CVE-2026-72339/): qede: fix off-by-one in BD ring consumption on build_skb failure (critical 9.8)
- [CVE-2026-72338](https://insights.sbomify.com/CVE-2026-72338/): net/sched: act_pedit: fix TOCTOU heap OOB write in tc offload (high 7.8)
- [CVE-2026-72337](https://insights.sbomify.com/CVE-2026-72337/): Bluetooth: 6lowpan: avoid untracked enable work (not scored)
- [CVE-2026-72336](https://insights.sbomify.com/CVE-2026-72336/): Bluetooth: 6lowpan: hold L2CAP conn across debugfs control (not scored)
- [CVE-2026-72335](https://insights.sbomify.com/CVE-2026-72335/): Bluetooth: MGMT: Fix adv monitor add failure cleanup (high 7.8)
- [CVE-2026-72334](https://insights.sbomify.com/CVE-2026-72334/): Bluetooth: ISO: fix malformed ISO_END/CONT handling (high 8.8)
- [CVE-2026-72333](https://insights.sbomify.com/CVE-2026-72333/): Bluetooth: L2CAP: fix tx ident leak for commands without a response (not scored)
- [CVE-2026-72332](https://insights.sbomify.com/CVE-2026-72332/): accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo() (not scored)
- [CVE-2026-72331](https://insights.sbomify.com/CVE-2026-72331/): accel/amdxdna: Fix VMA access race (high 7.8)
- [CVE-2026-72330](https://insights.sbomify.com/CVE-2026-72330/): net/tls: Consume empty data records in tls_sw_read_sock() (high 7.5)
- [CVE-2026-7233](https://insights.sbomify.com/CVE-2026-7233/): Artifex MuPDF CFF Index subset-cff.c fz_subset_cff_for_gids out-of-bounds (medium 4.8)
- [CVE-2026-72329](https://insights.sbomify.com/CVE-2026-72329/): net/liquidio: drop cached VF pci_dev LUT (critical 9.3)
- [CVE-2026-72328](https://insights.sbomify.com/CVE-2026-72328/): accel/amdxdna: Fix potential amdxdna_umap lifetime race (high 7.8)
- [CVE-2026-72327](https://insights.sbomify.com/CVE-2026-72327/): drm/v3d: Reject invalid indirect BO handle in indirect CSD setup (not scored)
- [CVE-2026-72326](https://insights.sbomify.com/CVE-2026-72326/): net/sched: cake: reject overhead values that underflow length (not scored)
- [CVE-2026-72325](https://insights.sbomify.com/CVE-2026-72325/): perf/x86/amd/core: Avoid enabling BRS from the SVM reload path (not scored)
- [CVE-2026-72324](https://insights.sbomify.com/CVE-2026-72324/): gpio: mvebu: free generic chips on unbind (not scored)
- [CVE-2026-72323](https://insights.sbomify.com/CVE-2026-72323/): ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() (critical 9.8)
- [CVE-2026-72322](https://insights.sbomify.com/CVE-2026-72322/): ipv6: mcast: Fix potential UAF in MLD delayed work (critical 9.8)
- [CVE-2026-72321](https://insights.sbomify.com/CVE-2026-72321/): ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() (not scored)
- [CVE-2026-72320](https://insights.sbomify.com/CVE-2026-72320/): netfilter: nft_lookup: fix catchall element handling with inverted lookups (critical 9.1)
- [CVE-2026-7232](https://insights.sbomify.com/CVE-2026-7232/): FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters (high 7.2)
- [CVE-2026-72319](https://insights.sbomify.com/CVE-2026-72319/): ipvs: ensure inner headers in ICMP errors are in headroom (critical 9.8)
- [CVE-2026-72318](https://insights.sbomify.com/CVE-2026-72318/): cifs: validate DFS referral string offsets (critical 9.4)
- [CVE-2026-72317](https://insights.sbomify.com/CVE-2026-72317/): SUNRPC: pin upper rpc_clnt across the TLS connect_worker (critical 9.8)
- [CVE-2026-72316](https://insights.sbomify.com/CVE-2026-72316/): dm era: fix NULL pointer dereference in metadata_open() (not scored)
- [CVE-2026-72315](https://insights.sbomify.com/CVE-2026-72315/): smb: client: fix busy dentry warning on unmount after DIO (high 7.8)
- [CVE-2026-72314](https://insights.sbomify.com/CVE-2026-72314/): regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/411/