# Vulnerabilities published in 2026


- [CVE-2026-68197](https://insights.sbomify.com/CVE-2026-68197/): wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper (not scored)
- [CVE-2026-68196](https://insights.sbomify.com/CVE-2026-68196/): wifi: wilc1000: validate assoc response length before subtracting header (high 8.3)
- [CVE-2026-68195](https://insights.sbomify.com/CVE-2026-68195/): wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses (not scored)
- [CVE-2026-68194](https://insights.sbomify.com/CVE-2026-68194/): wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses (not scored)
- [CVE-2026-68193](https://insights.sbomify.com/CVE-2026-68193/): wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (not scored)
- [CVE-2026-68192](https://insights.sbomify.com/CVE-2026-68192/): wifi: brcmfmac: make release_scratchbuffers idempotent (high 8.8)
- [CVE-2026-68191](https://insights.sbomify.com/CVE-2026-68191/): wifi: ath12k: fix NULL pointer dereference in rhash table destroy (not scored)
- [CVE-2026-68190](https://insights.sbomify.com/CVE-2026-68190/): staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() (not scored)
- [CVE-2026-6819](https://insights.sbomify.com/CVE-2026-6819/): HKUDS OpenHarness Plugin Management Command Exposure (high 8.7)
- [CVE-2026-68189](https://insights.sbomify.com/CVE-2026-68189/): Bluetooth: hci_sync: Protect UUID list traversal (high 7.8)
- [CVE-2026-68188](https://insights.sbomify.com/CVE-2026-68188/): Bluetooth: RFCOMM: Fix session UAF in set_termios (not scored)
- [CVE-2026-68187](https://insights.sbomify.com/CVE-2026-68187/): exec: fix unsigned loop counter wrap in transfer_args_to_stack() (not scored)
- [CVE-2026-68186](https://insights.sbomify.com/CVE-2026-68186/): binfmt_misc: set have_execfd only once the interpreter is opened (not scored)
- [CVE-2026-68185](https://insights.sbomify.com/CVE-2026-68185/): LoongArch: Move jump_label_init() before parse_early_param() (not scored)
- [CVE-2026-68184](https://insights.sbomify.com/CVE-2026-68184/): cdrom: fix stack out-of-bounds read in CDROMVOLCTRL (not scored)
- [CVE-2026-68183](https://insights.sbomify.com/CVE-2026-68183/): firmware: stratix10-svc: fix memory leaks and list corruption bugs (not scored)
- [CVE-2026-68182](https://insights.sbomify.com/CVE-2026-68182/): comedi: comedi_parport: deal with premature interrupt (not scored)
- [CVE-2026-68181](https://insights.sbomify.com/CVE-2026-68181/): mei: bus: access mei_device under device_lock on cleanup (not scored)
- [CVE-2026-68180](https://insights.sbomify.com/CVE-2026-68180/): intel_th: fix MSC output device reference leak (not scored)
- [CVE-2026-6818](https://insights.sbomify.com/CVE-2026-6818/): Cross-site scripting in VikBooking Hotel Booking Engine & PMS (high 7.2)
- [CVE-2026-68179](https://insights.sbomify.com/CVE-2026-68179/): misc: nsm: only unlock nsm_dev on post-lock error paths (high 8.4)
- [CVE-2026-68178](https://insights.sbomify.com/CVE-2026-68178/): misc: nsm: pin the module while the device is open (high 7.8)
- [CVE-2026-68177](https://insights.sbomify.com/CVE-2026-68177/): tracing: Delay module ref count for "enable_event" trigger (high 7.8)
- [CVE-2026-68176](https://insights.sbomify.com/CVE-2026-68176/): tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev (not scored)
- [CVE-2026-68175](https://insights.sbomify.com/CVE-2026-68175/): tracing: Fix resource leak on mmiotrace trace_pipe close (not scored)
- [CVE-2026-68174](https://insights.sbomify.com/CVE-2026-68174/): tracing: Fix union collision of module and refcnt for dynamic events (not scored)
- [CVE-2026-68173](https://insights.sbomify.com/CVE-2026-68173/): ublk: wait on ublk_dev_ready() instead of ub->completion (high 7.1)
- [CVE-2026-68172](https://insights.sbomify.com/CVE-2026-68172/): arm64: make huge_ptep_get handled unaligned addresses (high 7.1)
- [CVE-2026-68170](https://insights.sbomify.com/CVE-2026-68170/): mptcp: fix stale skb->sk reference on subflow close (critical 9.8)
- [CVE-2026-6817](https://insights.sbomify.com/CVE-2026-6817/): Quiz Maker by AYS <= 6.7.1.29 - Unauthenticated Stored Cross-Site Scripting via 'rate_reason' (medium 5.8)
- [CVE-2026-68169](https://insights.sbomify.com/CVE-2026-68169/): mptcp: pm: userspace: fix use-after-free in get_local_id (not scored)
- [CVE-2026-68168](https://insights.sbomify.com/CVE-2026-68168/): afs: Fix afs_edit_dir_remove() to get, not find, block 0 (not scored)
- [CVE-2026-68167](https://insights.sbomify.com/CVE-2026-68167/): btrfs: do not try compression for data reloc inodes (not scored)
- [CVE-2026-68166](https://insights.sbomify.com/CVE-2026-68166/): userfaultfd: prevent registration of special VMAs (not scored)
- [CVE-2026-68165](https://insights.sbomify.com/CVE-2026-68165/): mm/damon/core: validate ranges in damon_set_regions() (not scored)
- [CVE-2026-68164](https://insights.sbomify.com/CVE-2026-68164/): mm/damon/core: disallow overlapping input ranges for damon_set_regions() (not scored)
- [CVE-2026-68163](https://insights.sbomify.com/CVE-2026-68163/): mm/page_vma_mapped: fix device-private PMD handling (high 7.8)
- [CVE-2026-68162](https://insights.sbomify.com/CVE-2026-68162/): sctp: avoid auth_enable sysctl UAF during netns teardown (high 7.8)
- [CVE-2026-68161](https://insights.sbomify.com/CVE-2026-68161/): sctp: close UDP tunnel sockets during netns teardown (critical 9.8)
- [CVE-2026-68160](https://insights.sbomify.com/CVE-2026-68160/): ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() (critical 9.8)
- [CVE-2026-6816](https://insights.sbomify.com/CVE-2026-6816/): TFA Basic Plugins - Access Bypass (medium 5.1)
- [CVE-2026-68159](https://insights.sbomify.com/CVE-2026-68159/): libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (critical 9.8)
- [CVE-2026-68158](https://insights.sbomify.com/CVE-2026-68158/): libceph: Fix multiplication overflow in decode_new_up_state_weight() (critical 9.8)
- [CVE-2026-68157](https://insights.sbomify.com/CVE-2026-68157/): libceph: guard missing CRUSH type name lookup (high 7.5)
- [CVE-2026-68156](https://insights.sbomify.com/CVE-2026-68156/): libceph: refresh auth->authorizer_buf{,_len} after authorizer update (critical 9.8)
- [CVE-2026-68155](https://insights.sbomify.com/CVE-2026-68155/): libceph: Reject monmaps advertising zero monitors (high 7.5)
- [CVE-2026-68154](https://insights.sbomify.com/CVE-2026-68154/): libceph: reject zero bucket types in crush_decode (critical 9.8)
- [CVE-2026-68153](https://insights.sbomify.com/CVE-2026-68153/): libceph: remove debugfs files before client teardown (high 7.8)
- [CVE-2026-68152](https://insights.sbomify.com/CVE-2026-68152/): amt: fix use-after-free in AMT delayed works (high 7.8)
- [CVE-2026-68151](https://insights.sbomify.com/CVE-2026-68151/): binfmt_elf_fdpic: only honour the first PT_INTERP (not scored)
- [CVE-2026-68150](https://insights.sbomify.com/CVE-2026-68150/): fs/super: fix emergency thaw double-unlock of s_umount (not scored)
- [CVE-2026-6815](https://insights.sbomify.com/CVE-2026-6815/): CVE-2026-6815 (medium 5.9)
- [CVE-2026-68149](https://insights.sbomify.com/CVE-2026-68149/): fs: preserve ACL_DONT_CACHE state in forget_cached_acl() (high 8.4)
- [CVE-2026-68148](https://insights.sbomify.com/CVE-2026-68148/): fscrypt: Add missing superblock check in find_or_insert_direct_key() (high 7.8)
- [CVE-2026-68147](https://insights.sbomify.com/CVE-2026-68147/): fscrypt: Avoid dynamic allocation in fscrypt_get_devices() (high 7.8)
- [CVE-2026-68146](https://insights.sbomify.com/CVE-2026-68146/): ftrace: Add global mutex to serialize trace_parser access (not scored)
- [CVE-2026-68145](https://insights.sbomify.com/CVE-2026-68145/): iomap: fix out-of-bounds bitmap_set() with zero-length range (high 7.8)
- [CVE-2026-68144](https://insights.sbomify.com/CVE-2026-68144/): phonet: pep: fix use-after-free in pep_get_sb() (critical 9.8)
- [CVE-2026-68143](https://insights.sbomify.com/CVE-2026-68143/): net: slip: serialize receive against buffer reallocation (high 7.8)
- [CVE-2026-68142](https://insights.sbomify.com/CVE-2026-68142/): geneve: require CAP_NET_ADMIN in the device netns for changelink (high 8.8)
- [CVE-2026-68141](https://insights.sbomify.com/CVE-2026-68141/): net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() (high 7.5)
- [CVE-2026-68140](https://insights.sbomify.com/CVE-2026-68140/): net/iucv: fix use-after-free of a severed iucv_path (high 8.8)
- [CVE-2026-68139](https://insights.sbomify.com/CVE-2026-68139/): net/mlx5e: Use sender devcom for MPV master-up (not scored)
- [CVE-2026-68138](https://insights.sbomify.com/CVE-2026-68138/): net/sched: serialize qdisc_rtab_list against concurrent get/put (high 7.8)
- [CVE-2026-68137](https://insights.sbomify.com/CVE-2026-68137/): net/x25: fix use-after-free in x25_kill_by_neigh() (critical 9.8)
- [CVE-2026-68136](https://insights.sbomify.com/CVE-2026-68136/): net: gro: fix double aggregation of flush-marked skbs (critical 9.8)
- [CVE-2026-68135](https://insights.sbomify.com/CVE-2026-68135/): net: hip04: fix RX buffer leak on build_skb failure (not scored)
- [CVE-2026-68134](https://insights.sbomify.com/CVE-2026-68134/): ptp: ptp_s390: Add missing facility check (high 7.3)
- [CVE-2026-68133](https://insights.sbomify.com/CVE-2026-68133/): ice: fix PTP Call Trace during PTP release (not scored)
- [CVE-2026-68132](https://insights.sbomify.com/CVE-2026-68132/): super: fix emergency thaw deadlock on frozen block devices (not scored)
- [CVE-2026-68131](https://insights.sbomify.com/CVE-2026-68131/): rbd: Reset positive result codes to zero in object map update path (high 7.5)
- [CVE-2026-68130](https://insights.sbomify.com/CVE-2026-68130/): ksmbd: defer destroy_previous_session() until after NTLM authentication (not scored)
- [CVE-2026-6813](https://insights.sbomify.com/CVE-2026-6813/): Cross-site scripting in Continually (medium 4.4)
- [CVE-2026-68129](https://insights.sbomify.com/CVE-2026-68129/): gve: fix Rx queue stall on alloc failure (high 7.5)
- [CVE-2026-68128](https://insights.sbomify.com/CVE-2026-68128/): ice: reject out-of-range ptype in ice_parser_profile_init (high 8.8)
- [CVE-2026-68127](https://insights.sbomify.com/CVE-2026-68127/): ila: reload IPv6 header after pskb_may_pull in checksum adjust (critical 9.8)
- [CVE-2026-68126](https://insights.sbomify.com/CVE-2026-68126/): mac802154: hold an interface reference across the scan worker (not scored)
- [CVE-2026-68125](https://insights.sbomify.com/CVE-2026-68125/): mac802154: llsec: reject frames shorter than the authentication tag (high 8.8)
- [CVE-2026-68124](https://insights.sbomify.com/CVE-2026-68124/): mctp: serial: handle zero-length frames to prevent rx buffer overflow (critical 9.6)
- [CVE-2026-68123](https://insights.sbomify.com/CVE-2026-68123/): openvswitch: fix GSO userspace truncation underflow (critical 9.8)
- [CVE-2026-68122](https://insights.sbomify.com/CVE-2026-68122/): ovpn: fix peer refcount leak in TCP error paths (not scored)
- [CVE-2026-68121](https://insights.sbomify.com/CVE-2026-68121/): pppoe: reload header pointer after dev_hard_header() (high 7.8)
- [CVE-2026-68120](https://insights.sbomify.com/CVE-2026-68120/): rtase: Workaround for TX hang caused by hardware packet parsing (high 7.5)
- [CVE-2026-6812](https://insights.sbomify.com/CVE-2026-6812/): Ona <= 1.26 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'download_link' Parameter (medium 4.4)
- [CVE-2026-68119](https://insights.sbomify.com/CVE-2026-68119/): tcp: initialize standalone TCP-AO response padding (high 7.5)
- [CVE-2026-68118](https://insights.sbomify.com/CVE-2026-68118/): tcp: challenge ACK for non-exact RST in SYN-RECEIVED (high 8.2)
- [CVE-2026-68117](https://insights.sbomify.com/CVE-2026-68117/): tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (critical 9.8)
- [CVE-2026-68116](https://insights.sbomify.com/CVE-2026-68116/): vxlan: mdb: Fix source list corruption on a failed replace (high 7.9)
- [CVE-2026-68115](https://insights.sbomify.com/CVE-2026-68115/): drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68114](https://insights.sbomify.com/CVE-2026-68114/): drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68113](https://insights.sbomify.com/CVE-2026-68113/): drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68112](https://insights.sbomify.com/CVE-2026-68112/): drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68111](https://insights.sbomify.com/CVE-2026-68111/): drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68110](https://insights.sbomify.com/CVE-2026-68110/): drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-6811](https://insights.sbomify.com/CVE-2026-6811/): PHP Stack Exhaustion (medium 6.0)
- [CVE-2026-68109](https://insights.sbomify.com/CVE-2026-68109/): drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON() (not scored)
- [CVE-2026-68108](https://insights.sbomify.com/CVE-2026-68108/): drm/amdgpu/vce: fix integer overflow in image size (high 8.8)
- [CVE-2026-68107](https://insights.sbomify.com/CVE-2026-68107/): drm/amdgpu/vcn4: avoid rereading IB param length (high 8.8)
- [CVE-2026-68106](https://insights.sbomify.com/CVE-2026-68106/): drm/amdgpu: fix division by zero with invalid uvd dimensions (high 7.8)
- [CVE-2026-68105](https://insights.sbomify.com/CVE-2026-68105/): drm/amdgpu: Fix kernel panic during driver load failure (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/446/