# Vulnerabilities published in 2026


- [CVE-2026-68382](https://insights.sbomify.com/CVE-2026-68382/): drm/xe/guc: Hold device ref until queue teardown completes (high 7.8)
- [CVE-2026-68381](https://insights.sbomify.com/CVE-2026-68381/): ksmbd: pin conn during async oplock break notification (critical 9.8)
- [CVE-2026-68380](https://insights.sbomify.com/CVE-2026-68380/): accel/amdxdna: Fix use-after-free of mm_struct in job scheduler (high 7.8)
- [CVE-2026-68379](https://insights.sbomify.com/CVE-2026-68379/): tcp: fix TIME_WAIT socket reference leak on PSP policy failure (high 7.5)
- [CVE-2026-68378](https://insights.sbomify.com/CVE-2026-68378/): dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (not scored)
- [CVE-2026-68377](https://insights.sbomify.com/CVE-2026-68377/): net/sched: act_tunnel_key: Defer dst_release to RCU callback (high 7.8)
- [CVE-2026-68376](https://insights.sbomify.com/CVE-2026-68376/): sctp: fix auth_hmacs array size in struct sctp_cookie (high 8.1)
- [CVE-2026-68375](https://insights.sbomify.com/CVE-2026-68375/): bnxt_en: Handle partially initialized auxiliary devices (not scored)
- [CVE-2026-68374](https://insights.sbomify.com/CVE-2026-68374/): usb: core: sysfs: add lock to bos_descriptors_read() (high 7.8)
- [CVE-2026-68373](https://insights.sbomify.com/CVE-2026-68373/): wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() (high 8.1)
- [CVE-2026-68372](https://insights.sbomify.com/CVE-2026-68372/): usb: core: port: Deattach Type-C connector on component unbind (not scored)
- [CVE-2026-68371](https://insights.sbomify.com/CVE-2026-68371/): usb: musb: omap2430: Do not put borrowed of_node in probe (high 8.4)
- [CVE-2026-68370](https://insights.sbomify.com/CVE-2026-68370/): usb: gadget: dummy_hcd: prevent fifo_req reuse during giveback (high 7.8)
- [CVE-2026-6837](https://insights.sbomify.com/CVE-2026-6837/): Command injection in WAX650S firmware (high 7.2)
- [CVE-2026-68369](https://insights.sbomify.com/CVE-2026-68369/): usb: gadget: printer: fix infinite loop in printer_read() (not scored)
- [CVE-2026-68368](https://insights.sbomify.com/CVE-2026-68368/): usb: gadget: f_ncm: validate datagram bounds in ncm_unwrap_ntb() (not scored)
- [CVE-2026-68367](https://insights.sbomify.com/CVE-2026-68367/): usb: gadget: f_tcm: synchronize delayed set_alt with teardown (not scored)
- [CVE-2026-68366](https://insights.sbomify.com/CVE-2026-68366/): usb: gadget: uvc: clamp SEND_RESPONSE length to the response buffer (not scored)
- [CVE-2026-68365](https://insights.sbomify.com/CVE-2026-68365/): USB: serial: io_edgeport: cap received transmit credits (not scored)
- [CVE-2026-68364](https://insights.sbomify.com/CVE-2026-68364/): drm/amd/display: Fix ISM dc_lock deadlock during suspend (not scored)
- [CVE-2026-68363](https://insights.sbomify.com/CVE-2026-68363/): wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (not scored)
- [CVE-2026-68362](https://insights.sbomify.com/CVE-2026-68362/): wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin (not scored)
- [CVE-2026-68361](https://insights.sbomify.com/CVE-2026-68361/): hwmon: (corsair-psu) Stop device IO before calling hid_hw_stop (not scored)
- [CVE-2026-68360](https://insights.sbomify.com/CVE-2026-68360/): hwmon: (corsair-cpro) Stop device IO before calling hid_hw_stop (not scored)
- [CVE-2026-68359](https://insights.sbomify.com/CVE-2026-68359/): hwmon: (nzxt-smart2) Stop device IO before calling hid_hw_stop (not scored)
- [CVE-2026-68358](https://insights.sbomify.com/CVE-2026-68358/): hwmon: (nzxt-kraken3) Stop device IO before calling hid_hw_stop (not scored)
- [CVE-2026-68357](https://insights.sbomify.com/CVE-2026-68357/): watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() (not scored)
- [CVE-2026-68356](https://insights.sbomify.com/CVE-2026-68356/): watchdog: airoha: Prevent division by zero when clock frequency is zero (not scored)
- [CVE-2026-68355](https://insights.sbomify.com/CVE-2026-68355/): wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() (not scored)
- [CVE-2026-68354](https://insights.sbomify.com/CVE-2026-68354/): firewire: net: Fix fragmented datagram reassembly (high 8.8)
- [CVE-2026-68353](https://insights.sbomify.com/CVE-2026-68353/): wifi: ath6kl: fix OOB read from firmware num_msg in TX complete handler (high 8.1)
- [CVE-2026-68352](https://insights.sbomify.com/CVE-2026-68352/): wifi: ath6kl: fix OOB read from firmware IE lengths in connect event (high 8.3)
- [CVE-2026-68351](https://insights.sbomify.com/CVE-2026-68351/): wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read (not scored)
- [CVE-2026-68350](https://insights.sbomify.com/CVE-2026-68350/): wifi: carl9170: fix OOB read from off-by-two in TX status handler (not scored)
- [CVE-2026-6835](https://insights.sbomify.com/CVE-2026-6835/): aEnrich｜a+HCM - Arbitrary File Upload (medium 5.1)
- [CVE-2026-68349](https://insights.sbomify.com/CVE-2026-68349/): wifi: carl9170: fix buffer overflow in rx_stream failover path (not scored)
- [CVE-2026-68348](https://insights.sbomify.com/CVE-2026-68348/): ASoC: tas2781: bound firmware description string parsing (high 7.1)
- [CVE-2026-68347](https://insights.sbomify.com/CVE-2026-68347/): iommu/amd: Fix IRQ unsafe locking in gdom allocation (not scored)
- [CVE-2026-68346](https://insights.sbomify.com/CVE-2026-68346/): ALSA: hda: cs35l41: validate and free ACPI mute object (not scored)
- [CVE-2026-68345](https://insights.sbomify.com/CVE-2026-68345/): arm_mpam: guard MBWU state before adding it to garbage (not scored)
- [CVE-2026-68344](https://insights.sbomify.com/CVE-2026-68344/): usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect (not scored)
- [CVE-2026-68343](https://insights.sbomify.com/CVE-2026-68343/): smb: client: validate DFS referral PathConsumed (critical 9.1)
- [CVE-2026-68342](https://insights.sbomify.com/CVE-2026-68342/): ovpn: avoid putting unrelated P2P peer on socket release (not scored)
- [CVE-2026-68341](https://insights.sbomify.com/CVE-2026-68341/): ovpn: fix use after free in unlock_ovpn() (high 8.8)
- [CVE-2026-68340](https://insights.sbomify.com/CVE-2026-68340/): hwmon: occ: validate poll response sensor blocks (high 7.7)
- [CVE-2026-6834](https://insights.sbomify.com/CVE-2026-6834/): aEnrich｜a+HRD - Missing Authorization (high 7.1)
- [CVE-2026-68339](https://insights.sbomify.com/CVE-2026-68339/): Bluetooth: btusb: validate Realtek vendor event length (not scored)
- [CVE-2026-68338](https://insights.sbomify.com/CVE-2026-68338/): net/packet: avoid fanout hook re-registration after unregister (high 7.8)
- [CVE-2026-68337](https://insights.sbomify.com/CVE-2026-68337/): bpf: Reject redirect helpers without a bpf_net_context (not scored)
- [CVE-2026-68336](https://insights.sbomify.com/CVE-2026-68336/): bonding: fix devconf_all NULL dereference when IPv6 is disabled (not scored)
- [CVE-2026-68335](https://insights.sbomify.com/CVE-2026-68335/): rds: drop incoming messages that cross network namespace boundaries (high 7.8)
- [CVE-2026-68334](https://insights.sbomify.com/CVE-2026-68334/): rxrpc: fix io_thread race in rxrpc_wake_up_io_thread() (not scored)
- [CVE-2026-68333](https://insights.sbomify.com/CVE-2026-68333/): dpaa2-switch: put MAC endpoint device on disconnect (not scored)
- [CVE-2026-68332](https://insights.sbomify.com/CVE-2026-68332/): net: airoha: Fix potential use-after-free in airoha_ppe_deinit() (not scored)
- [CVE-2026-68331](https://insights.sbomify.com/CVE-2026-68331/): dpaa2-eth: put MAC endpoint device on disconnect (not scored)
- [CVE-2026-68330](https://insights.sbomify.com/CVE-2026-68330/): net: airoha: Fix DMA direction for NPU mailbox buffer (high 7.8)
- [CVE-2026-6833](https://insights.sbomify.com/CVE-2026-6833/): aEnrich｜a+HRD - SQL Injection (high 7.1)
- [CVE-2026-68329](https://insights.sbomify.com/CVE-2026-68329/): iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (high 8.8)
- [CVE-2026-68328](https://insights.sbomify.com/CVE-2026-68328/): nfp: Check resource mutex allocation (not scored)
- [CVE-2026-68327](https://insights.sbomify.com/CVE-2026-68327/): wan: wanxl: Only reset hardware after BAR mapping (not scored)
- [CVE-2026-68326](https://insights.sbomify.com/CVE-2026-68326/): wifi: mwifiex: bound uAP association event IEs to the event buffer (high 8.8)
- [CVE-2026-68325](https://insights.sbomify.com/CVE-2026-68325/): iommu/amd: Bound the early ACPI HID map (not scored)
- [CVE-2026-68324](https://insights.sbomify.com/CVE-2026-68324/): iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (not scored)
- [CVE-2026-68323](https://insights.sbomify.com/CVE-2026-68323/): tipc: serialize udp bearer replicast list updates (high 7.8)
- [CVE-2026-68322](https://insights.sbomify.com/CVE-2026-68322/): rds: Fix inet6_addr_lst NULL dereference when IPv6 is disabled (not scored)
- [CVE-2026-68321](https://insights.sbomify.com/CVE-2026-68321/): net: txgbe: fix FDIR filter leak on remove (not scored)
- [CVE-2026-68320](https://insights.sbomify.com/CVE-2026-68320/): sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid (high 7.3)
- [CVE-2026-6832](https://insights.sbomify.com/CVE-2026-6832/): Nesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_id (high 7.2)
- [CVE-2026-68319](https://insights.sbomify.com/CVE-2026-68319/): pds_core: fix deadlock between reset thread and remove (not scored)
- [CVE-2026-68318](https://insights.sbomify.com/CVE-2026-68318/): pds_core: fix use-after-free on workqueue during remove (not scored)
- [CVE-2026-68317](https://insights.sbomify.com/CVE-2026-68317/): pds_core: fix auxiliary device add/del races (not scored)
- [CVE-2026-68316](https://insights.sbomify.com/CVE-2026-68316/): accel: ethosu: Fix element size accounting for cmd stream validation (high 7.8)
- [CVE-2026-68315](https://insights.sbomify.com/CVE-2026-68315/): sctp: validate stream count in sctp_process_strreset_inreq() (high 7.5)
- [CVE-2026-68314](https://insights.sbomify.com/CVE-2026-68314/): net: mctp i3c: clean up notifier and buses if driver register fails (high 7.8)
- [CVE-2026-68313](https://insights.sbomify.com/CVE-2026-68313/): tipc: fix infinite loop in __tipc_nl_compat_dumpit (not scored)
- [CVE-2026-68312](https://insights.sbomify.com/CVE-2026-68312/): cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (not scored)
- [CVE-2026-68311](https://insights.sbomify.com/CVE-2026-68311/): wifi: mt76: mt7925: guard link STA in decap offload (not scored)
- [CVE-2026-68310](https://insights.sbomify.com/CVE-2026-68310/): wifi: mt76: mt7915: guard HE capability lookups (not scored)
- [CVE-2026-6831](https://insights.sbomify.com/CVE-2026-6831/): Missing authorization in Advanced Contact form 7 DB (medium 6.5)
- [CVE-2026-68309](https://insights.sbomify.com/CVE-2026-68309/): wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() (not scored)
- [CVE-2026-68308](https://insights.sbomify.com/CVE-2026-68308/): wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap() (not scored)
- [CVE-2026-68307](https://insights.sbomify.com/CVE-2026-68307/): wifi: mt76: mt7925: fix crash in reset link replay (not scored)
- [CVE-2026-68306](https://insights.sbomify.com/CVE-2026-68306/): wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht() (not scored)
- [CVE-2026-68305](https://insights.sbomify.com/CVE-2026-68305/): drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers (high 7.8)
- [CVE-2026-68304](https://insights.sbomify.com/CVE-2026-68304/): wifi: brcmfmac: fix 802.1X-SHA256 call trace warning (not scored)
- [CVE-2026-68303](https://insights.sbomify.com/CVE-2026-68303/): drm/vc4: hvs/v3d: Fix null dereference in unbind (not scored)
- [CVE-2026-68302](https://insights.sbomify.com/CVE-2026-68302/): amt: re-read skb header pointers after every pull (critical 9.8)
- [CVE-2026-68301](https://insights.sbomify.com/CVE-2026-68301/): net: hsr: fix memory leak on slave unregistration by removing synced VLANs (not scored)
- [CVE-2026-68300](https://insights.sbomify.com/CVE-2026-68300/): sctp: auth: verify auth requirement when auth_chunk is NULL (critical 9.8)
- [CVE-2026-6830](https://insights.sbomify.com/CVE-2026-6830/): Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch (medium 4.8)
- [CVE-2026-68299](https://insights.sbomify.com/CVE-2026-68299/): vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (high 7.5)
- [CVE-2026-68298](https://insights.sbomify.com/CVE-2026-68298/): drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() (high 7.8)
- [CVE-2026-68297](https://insights.sbomify.com/CVE-2026-68297/): tipc: fix u16 MTU truncation in media and bearer MTU validation (high 7.8)
- [CVE-2026-68296](https://insights.sbomify.com/CVE-2026-68296/): net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM (not scored)
- [CVE-2026-68295](https://insights.sbomify.com/CVE-2026-68295/): LoongArch: BPF: Zero-extend signed ALU32 div/mod results (high 7.8)
- [CVE-2026-68294](https://insights.sbomify.com/CVE-2026-68294/): net: qrtr: restrict socket creation to the initial network namespace (high 8.8)
- [CVE-2026-68293](https://insights.sbomify.com/CVE-2026-68293/): net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (high 7.1)
- [CVE-2026-68292](https://insights.sbomify.com/CVE-2026-68292/): ice: prevent tstamp ring allocation for non-PF VSI types (not scored)
- [CVE-2026-68291](https://insights.sbomify.com/CVE-2026-68291/): idpf: fix max_vport related crash on allocation error during init (not scored)
- [CVE-2026-68290](https://insights.sbomify.com/CVE-2026-68290/): rds: tcp: unregister sysctl before tearing down listen socket (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/444/