# Vulnerabilities published in 2026


- [CVE-2026-68473](https://insights.sbomify.com/CVE-2026-68473/): powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address() (high 7.8)
- [CVE-2026-68472](https://insights.sbomify.com/CVE-2026-68472/): wifi: cfg80211: validate EHT MLE before MLD ID read (high 8.1)
- [CVE-2026-68471](https://insights.sbomify.com/CVE-2026-68471/): wifi: ieee80211: validate MLE common info length (high 8.8)
- [CVE-2026-68470](https://insights.sbomify.com/CVE-2026-68470/): wifi: mac80211: validate extension-frame layout before RX (high 8.8)
- [CVE-2026-6847](https://insights.sbomify.com/CVE-2026-6847/): Unauthenticated Remote Code Execution in ThemisNETPanel (critical 9.3)
- [CVE-2026-68469](https://insights.sbomify.com/CVE-2026-68469/): wifi: mwifiex: fix permanently busy scans after multiple roam iterations (not scored)
- [CVE-2026-68468](https://insights.sbomify.com/CVE-2026-68468/): mtd: virt-concat: free duplicate generated name (not scored)
- [CVE-2026-68467](https://insights.sbomify.com/CVE-2026-68467/): mtd: mchp23k256: use SPI match data for chip caps (high 7.8)
- [CVE-2026-68466](https://insights.sbomify.com/CVE-2026-68466/): mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout (high 8.8)
- [CVE-2026-68465](https://insights.sbomify.com/CVE-2026-68465/): mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (not scored)
- [CVE-2026-68464](https://insights.sbomify.com/CVE-2026-68464/): mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (not scored)
- [CVE-2026-68463](https://insights.sbomify.com/CVE-2026-68463/): mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (not scored)
- [CVE-2026-68462](https://insights.sbomify.com/CVE-2026-68462/): bpf: Reject negative const offsets for buffer pointers (high 7.8)
- [CVE-2026-68461](https://insights.sbomify.com/CVE-2026-68461/): device property: initialize the remaining fields of fwnode_handle in fwnode_init() (high 7.8)
- [CVE-2026-68460](https://insights.sbomify.com/CVE-2026-68460/): f2fs: fix potential deadlock in f2fs_balance_fs() (not scored)
- [CVE-2026-6846](https://insights.sbomify.com/CVE-2026-6846/): Binutils: binutils: arbitrary code execution via malformed xcoff object file processing (high 7.8)
- [CVE-2026-68459](https://insights.sbomify.com/CVE-2026-68459/): f2fs: fix potential deadlock in gc_merge path of f2fs_balance_fs() (not scored)
- [CVE-2026-68458](https://insights.sbomify.com/CVE-2026-68458/): binder: cache secctx size before release zeroes it (high 7.8)
- [CVE-2026-68457](https://insights.sbomify.com/CVE-2026-68457/): ksmbd: use opener credentials for FSCTL mutations (critical 9.1)
- [CVE-2026-68456](https://insights.sbomify.com/CVE-2026-68456/): usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect() (not scored)
- [CVE-2026-68455](https://insights.sbomify.com/CVE-2026-68455/): liveupdate: validate session type before performing operation (not scored)
- [CVE-2026-68454](https://insights.sbomify.com/CVE-2026-68454/): KVM: s390: pci: Fix handling of AIF enable without AISB (high 8.8)
- [CVE-2026-68453](https://insights.sbomify.com/CVE-2026-68453/): s390/zcrypt: Fix buffer over-read in cca_cipher2protkey (high 7.1)
- [CVE-2026-68452](https://insights.sbomify.com/CVE-2026-68452/): s390/zcrypt: Validate length for CCA AES cipher key requests (high 7.8)
- [CVE-2026-68451](https://insights.sbomify.com/CVE-2026-68451/): s390/zcrypt: Validate length for CCA ECC private key requests (high 7.8)
- [CVE-2026-68450](https://insights.sbomify.com/CVE-2026-68450/): btrfs: free mapping node on duplicate reloc root insert (not scored)
- [CVE-2026-6845](https://insights.sbomify.com/CVE-2026-6845/): Binutils: binutils: denial of service via crafted elf file (medium 5.0)
- [CVE-2026-68449](https://insights.sbomify.com/CVE-2026-68449/): ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning (not scored)
- [CVE-2026-68448](https://insights.sbomify.com/CVE-2026-68448/): ovl: check access to copy_file_range source with src mounter creds (not scored)
- [CVE-2026-68447](https://insights.sbomify.com/CVE-2026-68447/): drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (high 7.1)
- [CVE-2026-68446](https://insights.sbomify.com/CVE-2026-68446/): drm/vmwgfx: Validate vmw_surface_metadata::array_size (high 7.8)
- [CVE-2026-68445](https://insights.sbomify.com/CVE-2026-68445/): drm/vc4: Prevent shader BO mappings from becoming writable (high 7.8)
- [CVE-2026-68444](https://insights.sbomify.com/CVE-2026-68444/): firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() (not scored)
- [CVE-2026-68443](https://insights.sbomify.com/CVE-2026-68443/): hwmon: (gigabyte_waterforce) Stop device IO before calling hid_hw_stop (not scored)
- [CVE-2026-68442](https://insights.sbomify.com/CVE-2026-68442/): btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps (high 7.8)
- [CVE-2026-68441](https://insights.sbomify.com/CVE-2026-68441/): net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains (not scored)
- [CVE-2026-68440](https://insights.sbomify.com/CVE-2026-68440/): net: txgbe: fix heap overflow when reading module EEPROM (high 7.8)
- [CVE-2026-6844](https://insights.sbomify.com/CVE-2026-6844/): Binutils: binutils: denial of service vulnerabilities in readelf via crafted elf files (medium 5.5)
- [CVE-2026-68439](https://insights.sbomify.com/CVE-2026-68439/): wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() (not scored)
- [CVE-2026-68438](https://insights.sbomify.com/CVE-2026-68438/): smp: Make CSD lock acquisition atomic for debug mode (not scored)
- [CVE-2026-68437](https://insights.sbomify.com/CVE-2026-68437/): drm/imagination: Fit paired fragment job in the correct CCCB (not scored)
- [CVE-2026-68436](https://insights.sbomify.com/CVE-2026-68436/): drm/amd/display: use kvzalloc to allocate struct dc (not scored)
- [CVE-2026-68435](https://insights.sbomify.com/CVE-2026-68435/): LoongArch: Fix address space mismatch in kexec command line lookup (not scored)
- [CVE-2026-68434](https://insights.sbomify.com/CVE-2026-68434/): serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms (not scored)
- [CVE-2026-68433](https://insights.sbomify.com/CVE-2026-68433/): libceph: bound get_version reply decode to front len (high 8.6)
- [CVE-2026-68432](https://insights.sbomify.com/CVE-2026-68432/): vxlan: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-68431](https://insights.sbomify.com/CVE-2026-68431/): ksmbd: validate minimum PDU size for transform requests (critical 9.1)
- [CVE-2026-68430](https://insights.sbomify.com/CVE-2026-68430/): drm/amdgpu/gfx8: drop unecessary BUG_ON() (not scored)
- [CVE-2026-6843](https://insights.sbomify.com/CVE-2026-6843/): Nano: nano: format string vulnerability leads to denial of service (medium 5.5)
- [CVE-2026-68429](https://insights.sbomify.com/CVE-2026-68429/): drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() (not scored)
- [CVE-2026-68428](https://insights.sbomify.com/CVE-2026-68428/): KVM: x86/mmu: Fix use-after-free on vendor module reload (not scored)
- [CVE-2026-68427](https://insights.sbomify.com/CVE-2026-68427/): gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings (high 7.8)
- [CVE-2026-68426](https://insights.sbomify.com/CVE-2026-68426/): xfrm: fix stale skb->prev after async crypto steals a GSO segment (critical 9.8)
- [CVE-2026-68425](https://insights.sbomify.com/CVE-2026-68425/): IB/mad: Drop unmatched RMPP responses before reassembly (high 7.1)
- [CVE-2026-68424](https://insights.sbomify.com/CVE-2026-68424/): mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() (not scored)
- [CVE-2026-68423](https://insights.sbomify.com/CVE-2026-68423/): mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() (not scored)
- [CVE-2026-68422](https://insights.sbomify.com/CVE-2026-68422/): btrfs: fix root leak if its reloc root is unexpected in merge_reloc_roots() (not scored)
- [CVE-2026-68421](https://insights.sbomify.com/CVE-2026-68421/): sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx() (not scored)
- [CVE-2026-68420](https://insights.sbomify.com/CVE-2026-68420/): xfrm: reject optional IPTFS templates in outbound policies (high 7.1)
- [CVE-2026-6842](https://insights.sbomify.com/CVE-2026-6842/): Nano: nano: local attacker can inject malicious .desktop launcher due to insecure directory permissions (low 2.5)
- [CVE-2026-68419](https://insights.sbomify.com/CVE-2026-68419/): RDMA/irdma: Prevent rereg_mr for non-mem regions (high 7.8)
- [CVE-2026-68418](https://insights.sbomify.com/CVE-2026-68418/): RDMA/irdma: Prevent user-triggered null deref on QP create (not scored)
- [CVE-2026-68417](https://insights.sbomify.com/CVE-2026-68417/): RDMA/siw: publish QP after initialization (high 7.8)
- [CVE-2026-68416](https://insights.sbomify.com/CVE-2026-68416/): mtd: fix double free and WARN_ON in add_mtd_device() error paths (not scored)
- [CVE-2026-68415](https://insights.sbomify.com/CVE-2026-68415/): xfrm: clear mode callbacks after failed mode setup (high 7.8)
- [CVE-2026-68414](https://insights.sbomify.com/CVE-2026-68414/): wifi: cfg80211: cancel sched scan results work on unregister (high 7.5)
- [CVE-2026-68413](https://insights.sbomify.com/CVE-2026-68413/): wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() (not scored)
- [CVE-2026-68412](https://insights.sbomify.com/CVE-2026-68412/): wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan() (not scored)
- [CVE-2026-68411](https://insights.sbomify.com/CVE-2026-68411/): wifi: mac80211_hwsim: clamp virtio RX length before skb_put (not scored)
- [CVE-2026-68410](https://insights.sbomify.com/CVE-2026-68410/): wifi: libertas: fix memory leak in helper_firmware_cb() (not scored)
- [CVE-2026-6841](https://insights.sbomify.com/CVE-2026-6841/): Reflected XSS in Request Tracker (medium 5.1)
- [CVE-2026-68409](https://insights.sbomify.com/CVE-2026-68409/): wifi: mac80211: defer link RX stats percpu free to RCU (high 8.8)
- [CVE-2026-68408](https://insights.sbomify.com/CVE-2026-68408/): wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (not scored)
- [CVE-2026-68407](https://insights.sbomify.com/CVE-2026-68407/): wifi: nl80211: free RNR data on MBSSID mismatch (not scored)
- [CVE-2026-68406](https://insights.sbomify.com/CVE-2026-68406/): wifi: cfg80211: validate PMSR FTM preamble range (not scored)
- [CVE-2026-68405](https://insights.sbomify.com/CVE-2026-68405/): wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock (not scored)
- [CVE-2026-68404](https://insights.sbomify.com/CVE-2026-68404/): wifi: cfg80211: use wiphy work for socket owner autodisconnect (high 7.8)
- [CVE-2026-68403](https://insights.sbomify.com/CVE-2026-68403/): wifi: brcmfmac: initialize SDIO data work before cleanup (not scored)
- [CVE-2026-68402](https://insights.sbomify.com/CVE-2026-68402/): wifi: cfg80211: bound element ID read when checking non-inheritance (high 7.1)
- [CVE-2026-68401](https://insights.sbomify.com/CVE-2026-68401/): firmware: arm_ffa: Fix out-of-bound writes in ffa_setup_and_transmit() (high 7.8)
- [CVE-2026-68400](https://insights.sbomify.com/CVE-2026-68400/): firmware: arm_ffa: Fix Endpoint Memory Access Descriptor offset calculation (high 7.8)
- [CVE-2026-6840](https://insights.sbomify.com/CVE-2026-6840/): Memory corruption in ONE (medium 5.5)
- [CVE-2026-68399](https://insights.sbomify.com/CVE-2026-68399/): bpf: Fix UAF in sock clone early bailouts (high 7.8)
- [CVE-2026-68398](https://insights.sbomify.com/CVE-2026-68398/): ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (high 7.8)
- [CVE-2026-68397](https://insights.sbomify.com/CVE-2026-68397/): net/iucv: take a reference on the socket found in afiucv_hs_rcv() (high 8.8)
- [CVE-2026-68396](https://insights.sbomify.com/CVE-2026-68396/): scsi: core: wake eh reliably when using scsi_schedule_eh (not scored)
- [CVE-2026-68395](https://insights.sbomify.com/CVE-2026-68395/): ata: sata_dwc_460ex: enable SATA interrupts only after IRQ handler is registered (not scored)
- [CVE-2026-68394](https://insights.sbomify.com/CVE-2026-68394/): Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update (high 7.8)
- [CVE-2026-68393](https://insights.sbomify.com/CVE-2026-68393/): Bluetooth: hci_sync: extend conn_hash lookup critical sections (high 8.8)
- [CVE-2026-68392](https://insights.sbomify.com/CVE-2026-68392/): Bluetooth: mgmt: fix locking in unpair_device/disconnect_sync (high 7.8)
- [CVE-2026-68391](https://insights.sbomify.com/CVE-2026-68391/): Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (high 7.8)
- [CVE-2026-68390](https://insights.sbomify.com/CVE-2026-68390/): Bluetooth: hci_sync: hold hdev->lock for hci_conn_params lookups (high 8.8)
- [CVE-2026-6839](https://insights.sbomify.com/CVE-2026-6839/): Memory corruption in ONE (medium 6.6)
- [CVE-2026-68389](https://insights.sbomify.com/CVE-2026-68389/): Bluetooth: hci_qca: Clear memdump state on invalid dump size (high 8.8)
- [CVE-2026-68388](https://insights.sbomify.com/CVE-2026-68388/): smb/client: handle overlapping allocated ranges in fallocate (critical 9.8)
- [CVE-2026-68387](https://insights.sbomify.com/CVE-2026-68387/): can: raw: add locking for raw flags bitfield (high 7.8)
- [CVE-2026-68386](https://insights.sbomify.com/CVE-2026-68386/): bpf, sockmap: Reject unhashed UDP sockets on sockmap update (not scored)
- [CVE-2026-68385](https://insights.sbomify.com/CVE-2026-68385/): s390/checksum: Fix csum_partial() without vector facility (critical 9.8)
- [CVE-2026-68384](https://insights.sbomify.com/CVE-2026-68384/): drm/xe/vf: Fix VF CCS attach/detach race with in-flight BO moves (high 7.8)
- [CVE-2026-68383](https://insights.sbomify.com/CVE-2026-68383/): drm/xe/guc: Keep scheduler timeline name alive (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/443/