# Vulnerabilities published in 2026


- [CVE-2026-72313](https://insights.sbomify.com/CVE-2026-72313/): drm/fb-helper: Only consider active CRTCs for vblank sync (not scored)
- [CVE-2026-72312](https://insights.sbomify.com/CVE-2026-72312/): octeontx2-af: fix VF bringup affecting PF promiscuous state (high 7.9)
- [CVE-2026-72311](https://insights.sbomify.com/CVE-2026-72311/): drm/xe: free madvise VMA array on L2 flush failure (not scored)
- [CVE-2026-72310](https://insights.sbomify.com/CVE-2026-72310/): smb: client: fix overflow in passthrough ioctl bounds check (high 8.1)
- [CVE-2026-72309](https://insights.sbomify.com/CVE-2026-72309/): tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path (not scored)
- [CVE-2026-72308](https://insights.sbomify.com/CVE-2026-72308/): mlxsw: fix refcount leak in mlxsw_sp_port_lag_join() (not scored)
- [CVE-2026-72307](https://insights.sbomify.com/CVE-2026-72307/): mlxsw: fix refcount leak in mlxsw_sp_vrs_lpm_tree_replace() (not scored)
- [CVE-2026-72306](https://insights.sbomify.com/CVE-2026-72306/): vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter (not scored)
- [CVE-2026-72305](https://insights.sbomify.com/CVE-2026-72305/): VDUSE: avoid leaking information to userspace (not scored)
- [CVE-2026-72304](https://insights.sbomify.com/CVE-2026-72304/): ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (high 7.8)
- [CVE-2026-72303](https://insights.sbomify.com/CVE-2026-72303/): ASoC: SOF: ipc4-control: Validate notification payload size (high 7.8)
- [CVE-2026-72302](https://insights.sbomify.com/CVE-2026-72302/): ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (high 7.8)
- [CVE-2026-72301](https://insights.sbomify.com/CVE-2026-72301/): ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (high 7.8)
- [CVE-2026-72300](https://insights.sbomify.com/CVE-2026-72300/): ASoC: SOF: topology: validate vendor array size before parsing (not scored)
- [CVE-2026-7230](https://insights.sbomify.com/CVE-2026-7230/): SourceCodester Safety Anger Pad cross site scripting (medium 5.3)
- [CVE-2026-72299](https://insights.sbomify.com/CVE-2026-72299/): tipc: restrict socket queue dumps in enqueue tracepoints (critical 9.8)
- [CVE-2026-72298](https://insights.sbomify.com/CVE-2026-72298/): net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (high 8.4)
- [CVE-2026-72297](https://insights.sbomify.com/CVE-2026-72297/): net: atm: reject out-of-range traffic classes in QoS validation (high 7.1)
- [CVE-2026-72296](https://insights.sbomify.com/CVE-2026-72296/): net: ife: require ETH_HLEN to be pullable in ife_decode() (critical 9.1)
- [CVE-2026-72295](https://insights.sbomify.com/CVE-2026-72295/): LoongArch: KVM: Validate irqchip index in irqfd routing (high 8.8)
- [CVE-2026-72294](https://insights.sbomify.com/CVE-2026-72294/): LoongArch: KVM: Check irq validity in kvm_vcpu_ioctl_interrupt() (high 8.8)
- [CVE-2026-72293](https://insights.sbomify.com/CVE-2026-72293/): KVM: s390: vsie: Add missing radix_tree_preload() in _gaccess_shadow_fault() (not scored)
- [CVE-2026-72292](https://insights.sbomify.com/CVE-2026-72292/): KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory (not scored)
- [CVE-2026-72291](https://insights.sbomify.com/CVE-2026-72291/): KVM: s390: Fix unlikely race in try_get_locked_pte() (critical 9.3)
- [CVE-2026-72290](https://insights.sbomify.com/CVE-2026-72290/): KVM: s390: pci: Fix GISC refcount leak on AIF enable failure (not scored)
- [CVE-2026-7229](https://insights.sbomify.com/CVE-2026-7229/): code-projects Coaching Management System POST reply.php sql injection (medium 5.3)
- [CVE-2026-72289](https://insights.sbomify.com/CVE-2026-72289/): KVM: arm64: vgic: Check the interrupt is still ours before migrating it (critical 9.3)
- [CVE-2026-72288](https://insights.sbomify.com/CVE-2026-72288/): KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (critical 9.3)
- [CVE-2026-72287](https://insights.sbomify.com/CVE-2026-72287/): KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checks (high 7.8)
- [CVE-2026-72286](https://insights.sbomify.com/CVE-2026-72286/): KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs (high 8.8)
- [CVE-2026-72285](https://insights.sbomify.com/CVE-2026-72285/): KVM: TDX: Reject concurrent change to CPUID entry count (high 7.8)
- [CVE-2026-72284](https://insights.sbomify.com/CVE-2026-72284/): KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs (high 7.1)
- [CVE-2026-72283](https://insights.sbomify.com/CVE-2026-72283/): KVM: x86: Nullify irqfd->producer if updating IRTE for bypass fails (high 8.8)
- [CVE-2026-72282](https://insights.sbomify.com/CVE-2026-72282/): KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers (high 7.8)
- [CVE-2026-72281](https://insights.sbomify.com/CVE-2026-72281/): KVM: arm64: account pKVM reclaim against the VM mm (not scored)
- [CVE-2026-72280](https://insights.sbomify.com/CVE-2026-72280/): KVM: arm64: nv: Drop bogus WARN for write to ZCR_EL2 (high 7.1)
- [CVE-2026-7228](https://insights.sbomify.com/CVE-2026-7228/): SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection (medium 6.9)
- [CVE-2026-72279](https://insights.sbomify.com/CVE-2026-72279/): KVM: arm64: nv: Respect read-only PFN when mapping L1 VNCR (critical 9.0)
- [CVE-2026-72278](https://insights.sbomify.com/CVE-2026-72278/): KVM: arm64: nv: Re-translate VNCR before injecting abort (critical 9.3)
- [CVE-2026-72277](https://insights.sbomify.com/CVE-2026-72277/): KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory (critical 9.3)
- [CVE-2026-72276](https://insights.sbomify.com/CVE-2026-72276/): fbdev: metronomefb: fix potential memory leak in metronomefb_probe() (not scored)
- [CVE-2026-72275](https://insights.sbomify.com/CVE-2026-72275/): fbdev: broadsheetfb: fix potential memory leak in broadsheetfb_probe() (not scored)
- [CVE-2026-72274](https://insights.sbomify.com/CVE-2026-72274/): fbdev: hecubafb: fix potential memory leak in hecubafb_probe() (not scored)
- [CVE-2026-72273](https://insights.sbomify.com/CVE-2026-72273/): fbdev: efifb: fix memory leak in efifb_probe() (not scored)
- [CVE-2026-72272](https://insights.sbomify.com/CVE-2026-72272/): fbdev: radeon: fix potential memory leak in radeonfb_pci_register() (not scored)
- [CVE-2026-72271](https://insights.sbomify.com/CVE-2026-72271/): fbdev: i740fb: fix potential memory leak in i740fb_probe() (not scored)
- [CVE-2026-72270](https://insights.sbomify.com/CVE-2026-72270/): fbdev: s3fb: fix potential memory leak in s3_pci_probe() (not scored)
- [CVE-2026-7227](https://insights.sbomify.com/CVE-2026-7227/): SourceCodester Pizzafy Ecommerce System ajax.php login sql injection (medium 6.9)
- [CVE-2026-72269](https://insights.sbomify.com/CVE-2026-72269/): fbdev: uvesafb: fix potential memory leak in uvesafb_probe() (not scored)
- [CVE-2026-72268](https://insights.sbomify.com/CVE-2026-72268/): fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe() (not scored)
- [CVE-2026-72267](https://insights.sbomify.com/CVE-2026-72267/): fbdev: carminefb: fix potential memory leak in alloc_carmine_fb() (not scored)
- [CVE-2026-72266](https://insights.sbomify.com/CVE-2026-72266/): fbdev: vesafb: fix memory leak in vesafb_probe() (not scored)
- [CVE-2026-72265](https://insights.sbomify.com/CVE-2026-72265/): fbdev: nvidia: fix potential memory leak in nvidiafb_probe() (not scored)
- [CVE-2026-72264](https://insights.sbomify.com/CVE-2026-72264/): fbdev: tridentfb: fix potential memory leak in trident_pci_probe() (not scored)
- [CVE-2026-72263](https://insights.sbomify.com/CVE-2026-72263/): ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (not scored)
- [CVE-2026-72262](https://insights.sbomify.com/CVE-2026-72262/): ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (high 7.8)
- [CVE-2026-72261](https://insights.sbomify.com/CVE-2026-72261/): ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (high 7.8)
- [CVE-2026-72260](https://insights.sbomify.com/CVE-2026-72260/): ASoC: mediatek: mt8192: Check runtime resume during probe (not scored)
- [CVE-2026-7226](https://insights.sbomify.com/CVE-2026-7226/): SourceCodester Pizzafy Ecommerce System ajax.php login2 sql injection (medium 6.9)
- [CVE-2026-72259](https://insights.sbomify.com/CVE-2026-72259/): ASoC: mediatek: mt8192: Release reserved memory on cleanup (not scored)
- [CVE-2026-72258](https://insights.sbomify.com/CVE-2026-72258/): ASoC: mediatek: mt8183: Release reserved memory on cleanup (not scored)
- [CVE-2026-72257](https://insights.sbomify.com/CVE-2026-72257/): ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (not scored)
- [CVE-2026-72256](https://insights.sbomify.com/CVE-2026-72256/): netfilter: xt_cluster: reject template conntracks in hash match (not scored)
- [CVE-2026-72255](https://insights.sbomify.com/CVE-2026-72255/): netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (high 7.8)
- [CVE-2026-72254](https://insights.sbomify.com/CVE-2026-72254/): netfilter: nft_fib: reject fib expression on the netdev egress hook (high 7.5)
- [CVE-2026-72253](https://insights.sbomify.com/CVE-2026-72253/): netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (high 7.5)
- [CVE-2026-72252](https://insights.sbomify.com/CVE-2026-72252/): netfilter: nft_set_pipapo: don't leak bad clone into future transaction (high 7.8)
- [CVE-2026-72251](https://insights.sbomify.com/CVE-2026-72251/): netfilter: nf_nat_sip: reload possible stale data pointer (critical 9.8)
- [CVE-2026-72250](https://insights.sbomify.com/CVE-2026-72250/): netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (high 7.8)
- [CVE-2026-7225](https://insights.sbomify.com/CVE-2026-7225/): SourceCodester Pizzafy Ecommerce System ajax.php delete_menu sql injection (medium 6.9)
- [CVE-2026-72249](https://insights.sbomify.com/CVE-2026-72249/): netfilter: flowtable: use dst in this direction when pushing IPIP header (critical 9.8)
- [CVE-2026-72248](https://insights.sbomify.com/CVE-2026-72248/): netfilter: flowtable: support IPIP tunnel with direct xmit (critical 9.8)
- [CVE-2026-72247](https://insights.sbomify.com/CVE-2026-72247/): netfilter: nf_conncount: fix zone comparison in tuple dedup (high 7.5)
- [CVE-2026-72245](https://insights.sbomify.com/CVE-2026-72245/): gpu: host1x: Fix device reference leak in host1x_device_parse_dt() error path (not scored)
- [CVE-2026-72244](https://insights.sbomify.com/CVE-2026-72244/): gpu/buddy: bail out of try_harder when alignment cannot be honoured (high 7.8)
- [CVE-2026-72243](https://insights.sbomify.com/CVE-2026-72243/): selinux: check connect-related permissions on TCP Fast Open (high 8.4)
- [CVE-2026-72242](https://insights.sbomify.com/CVE-2026-72242/): selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (high 7.5)
- [CVE-2026-72241](https://insights.sbomify.com/CVE-2026-72241/): leds: uleds: Fix potential buffer overread (not scored)
- [CVE-2026-72240](https://insights.sbomify.com/CVE-2026-72240/): mfd: sm501: Fix reference leak on failed device registration (not scored)
- [CVE-2026-7224](https://insights.sbomify.com/CVE-2026-7224/): SourceCodester Pizzafy Ecommerce System ajax.php delete_cart sql injection (medium 6.9)
- [CVE-2026-72239](https://insights.sbomify.com/CVE-2026-72239/): x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN" (critical 9.3)
- [CVE-2026-72238](https://insights.sbomify.com/CVE-2026-72238/): x86/boot: Validate console=uart8250 baud rate to fix early boot hang (not scored)
- [CVE-2026-72237](https://insights.sbomify.com/CVE-2026-72237/): perf/x86/amd/brs: Fix kernel address leakage (not scored)
- [CVE-2026-72236](https://insights.sbomify.com/CVE-2026-72236/): s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init() (not scored)
- [CVE-2026-72235](https://insights.sbomify.com/CVE-2026-72235/): batman-adv: retrieve ethhdr after potential skb realloc on RX (high 8.8)
- [CVE-2026-72234](https://insights.sbomify.com/CVE-2026-72234/): batman-adv: access unicast_ttvn skb->data only after skb realloc (critical 9.8)
- [CVE-2026-72233](https://insights.sbomify.com/CVE-2026-72233/): batman-adv: bla: reacquire gw address after skb realloc (high 8.8)
- [CVE-2026-72232](https://insights.sbomify.com/CVE-2026-72232/): batman-adv: ensure minimal ethernet header on TX (high 7.8)
- [CVE-2026-72231](https://insights.sbomify.com/CVE-2026-72231/): batman-adv: tt: avoid request storms during pending request (high 7.5)
- [CVE-2026-72230](https://insights.sbomify.com/CVE-2026-72230/): batman-adv: frag: free unfragmentable packet (not scored)
- [CVE-2026-7223](https://insights.sbomify.com/CVE-2026-7223/): BigSweetPotatoStudio HyperChat AI Proxy Middleware aiProxyMiddleware.mts fetch server-side request forgery (medium 6.9)
- [CVE-2026-72229](https://insights.sbomify.com/CVE-2026-72229/): batman-adv: clean untagged VLAN on netdev registration failure (not scored)
- [CVE-2026-72228](https://insights.sbomify.com/CVE-2026-72228/): batman-adv: frag: fix primary_if leak on failed linearization (not scored)
- [CVE-2026-72227](https://insights.sbomify.com/CVE-2026-72227/): batman-adv: mcast: avoid OOB read of num_dests header (high 8.1)
- [CVE-2026-72226](https://insights.sbomify.com/CVE-2026-72226/): batman-adv: tt: prevent TVLV OOB check overflow (critical 9.8)
- [CVE-2026-72225](https://insights.sbomify.com/CVE-2026-72225/): jbd2: fix integer underflow in jbd2_journal_initialize_fast_commit() (high 7.8)
- [CVE-2026-72224](https://insights.sbomify.com/CVE-2026-72224/): nvdimm/btt: Free arenas on btt_init() error paths (not scored)
- [CVE-2026-72223](https://insights.sbomify.com/CVE-2026-72223/): nvdimm/btt: Free arena sub-allocations on discover_arenas() error path (not scored)
- [CVE-2026-72222](https://insights.sbomify.com/CVE-2026-72222/): sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (critical 9.8)
- [CVE-2026-72221](https://insights.sbomify.com/CVE-2026-72221/): sunrpc: wait for in-flight TLS handshake callback when cancel loses race (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/412/