# Vulnerabilities published in 2026


- [CVE-2026-64567](https://insights.sbomify.com/CVE-2026-64567/): btrfs: reject free space cache with more entries than pages (high 7.8)
- [CVE-2026-64566](https://insights.sbomify.com/CVE-2026-64566/): xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags() (critical 9.8)
- [CVE-2026-64565](https://insights.sbomify.com/CVE-2026-64565/): Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() (not scored)
- [CVE-2026-64564](https://insights.sbomify.com/CVE-2026-64564/): sctp: don't free the ASCONF's own transport in DEL-IP processing (critical 9.8)
- [CVE-2026-64563](https://insights.sbomify.com/CVE-2026-64563/): rhashtable: clear stale iter->p on table restart (high 7.8)
- [CVE-2026-64562](https://insights.sbomify.com/CVE-2026-64562/): KVM: nVMX: Hide shadow VMCS right after VMCLEAR (high 8.8)
- [CVE-2026-64561](https://insights.sbomify.com/CVE-2026-64561/): KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (high 8.8)
- [CVE-2026-64560](https://insights.sbomify.com/CVE-2026-64560/): posix-cpu-timers: Prevent UAF caused by non-leader exec() race (high 7.8)
- [CVE-2026-6456](https://insights.sbomify.com/CVE-2026-6456/): Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation (high 8.8)
- [CVE-2026-64559](https://insights.sbomify.com/CVE-2026-64559/): s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (high 7.8)
- [CVE-2026-64558](https://insights.sbomify.com/CVE-2026-64558/): s390/pkey: Check length in pkey_pckmo handler implementation (high 7.8)
- [CVE-2026-64557](https://insights.sbomify.com/CVE-2026-64557/): Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (high 8.8)
- [CVE-2026-64556](https://insights.sbomify.com/CVE-2026-64556/): perf/core: Detach event groups during remove_on_exec (high 7.8)
- [CVE-2026-64555](https://insights.sbomify.com/CVE-2026-64555/): KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() (high 8.8)
- [CVE-2026-64554](https://insights.sbomify.com/CVE-2026-64554/): netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (high 8.8)
- [CVE-2026-64553](https://insights.sbomify.com/CVE-2026-64553/): net: psample: fix info leak in PSAMPLE_ATTR_DATA (not scored)
- [CVE-2026-64552](https://insights.sbomify.com/CVE-2026-64552/): virtio-net: fix len check in receive_big() (high 8.4)
- [CVE-2026-64551](https://insights.sbomify.com/CVE-2026-64551/): sctp: validate STALE_COOKIE cause length before reading staleness (critical 9.1)
- [CVE-2026-64550](https://insights.sbomify.com/CVE-2026-64550/): net: qualcomm: rmnet: validate MAP frame length before ingress parsing (high 7.3)
- [CVE-2026-6455](https://insights.sbomify.com/CVE-2026-6455/): Cross-site request forgery in WP Contact Form 7 DB Handler (high 8.1)
- [CVE-2026-64549](https://insights.sbomify.com/CVE-2026-64549/): Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup() (not scored)
- [CVE-2026-64548](https://insights.sbomify.com/CVE-2026-64548/): bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() (high 8.4)
- [CVE-2026-64547](https://insights.sbomify.com/CVE-2026-64547/): net: usb: net1080: validate packet_len before pad-byte access in rx_fixup (high 8.1)
- [CVE-2026-64546](https://insights.sbomify.com/CVE-2026-64546/): drm/edid: fix OOB read in drm_parse_tiled_block() (high 7.1)
- [CVE-2026-64545](https://insights.sbomify.com/CVE-2026-64545/): net, bpf: check master for NULL in xdp_master_redirect() (high 7.5)
- [CVE-2026-64544](https://insights.sbomify.com/CVE-2026-64544/): crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents (not scored)
- [CVE-2026-64543](https://insights.sbomify.com/CVE-2026-64543/): tipc: fix use-after-free of the discoverer in tipc_disc_rcv() (high 7.8)
- [CVE-2026-64542](https://insights.sbomify.com/CVE-2026-64542/): ipv6: ndisc: fix NULL deref in accept_untracked_na() (not scored)
- [CVE-2026-64541](https://insights.sbomify.com/CVE-2026-64541/): net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (critical 9.8)
- [CVE-2026-64540](https://insights.sbomify.com/CVE-2026-64540/): usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (high 8.1)
- [CVE-2026-6454](https://insights.sbomify.com/CVE-2026-6454/): Cross-site scripting in Firelight Lightbox (medium 6.4)
- [CVE-2026-64539](https://insights.sbomify.com/CVE-2026-64539/): Bluetooth: eir: Fix stack OOB write when prepending the Flags AD (high 7.8)
- [CVE-2026-64538](https://insights.sbomify.com/CVE-2026-64538/): ipv6: Fix null-ptr-deref in fib6_nh_mtu_change(). (not scored)
- [CVE-2026-64537](https://insights.sbomify.com/CVE-2026-64537/): bridge: cfm: reject invalid CCM interval at configuration time (not scored)
- [CVE-2026-64536](https://insights.sbomify.com/CVE-2026-64536/): staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop (high 8.1)
- [CVE-2026-64535](https://insights.sbomify.com/CVE-2026-64535/): nvmet-tcp: Fix potential UAF when ddgst mismatch (critical 9.8)
- [CVE-2026-64534](https://insights.sbomify.com/CVE-2026-64534/): nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (critical 9.8)
- [CVE-2026-64533](https://insights.sbomify.com/CVE-2026-64533/): fs/ntfs3: validate lcns_follow in log_replay conversion (high 7.8)
- [CVE-2026-64532](https://insights.sbomify.com/CVE-2026-64532/): fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} (high 7.8)
- [CVE-2026-64531](https://insights.sbomify.com/CVE-2026-64531/): net: openvswitch: reject oversized nested action attrs (high 7.8)
- [CVE-2026-64530](https://insights.sbomify.com/CVE-2026-64530/): net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (critical 9.8)
- [CVE-2026-6453](https://insights.sbomify.com/CVE-2026-6453/): CubeWP Framework <= 1.1.30 - Authenticated (Subscriber+) SQL Injection via 'relation_id' Parameter (medium 6.5)
- [CVE-2026-64529](https://insights.sbomify.com/CVE-2026-64529/): crypto: qat - remove unused character device and IOCTLs (high 7.8)
- [CVE-2026-64528](https://insights.sbomify.com/CVE-2026-64528/): tty: serial: samsung: Remove redundant port lock acquisition in rx helpers (not scored)
- [CVE-2026-64527](https://insights.sbomify.com/CVE-2026-64527/): drm/hyperv: validate VMBus packet size in receive callback (not scored)
- [CVE-2026-64526](https://insights.sbomify.com/CVE-2026-64526/): ethtool: tsconfig: fix missing ethnl_ops_complete() (not scored)
- [CVE-2026-64525](https://insights.sbomify.com/CVE-2026-64525/): xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit (not scored)
- [CVE-2026-64524](https://insights.sbomify.com/CVE-2026-64524/): drm/hyperv: validate resolution_count and fix WIN8 fallback (high 7.7)
- [CVE-2026-64523](https://insights.sbomify.com/CVE-2026-64523/): net/handshake: Take a long-lived file reference at submit (critical 9.8)
- [CVE-2026-64522](https://insights.sbomify.com/CVE-2026-64522/): net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (high 8.8)
- [CVE-2026-64521](https://insights.sbomify.com/CVE-2026-64521/): pinctrl: meson: amlogic-a4: fix deadlock issue (not scored)
- [CVE-2026-64520](https://insights.sbomify.com/CVE-2026-64520/): firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies (high 8.4)
- [CVE-2026-6452](https://insights.sbomify.com/CVE-2026-6452/): Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update (medium 4.3)
- [CVE-2026-64519](https://insights.sbomify.com/CVE-2026-64519/): NFSD: Fix infinite loop in layout state revocation (not scored)
- [CVE-2026-64518](https://insights.sbomify.com/CVE-2026-64518/): tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (not scored)
- [CVE-2026-64517](https://insights.sbomify.com/CVE-2026-64517/): drm/xe/gsc: Fix double-free of managed BO in error path (not scored)
- [CVE-2026-64516](https://insights.sbomify.com/CVE-2026-64516/): drm/amdgpu/vce1: Fix VCE 1 firmware size and offsets (high 8.8)
- [CVE-2026-64515](https://insights.sbomify.com/CVE-2026-64515/): wifi: mac80211: fix MLE defragmentation (high 8.3)
- [CVE-2026-64514](https://insights.sbomify.com/CVE-2026-64514/): userfaultfd: gate must_wait writability check on pte_present() (not scored)
- [CVE-2026-64513](https://insights.sbomify.com/CVE-2026-64513/): KVM: x86: Unconditionally recompute CR8 intercept on PPR update (not scored)
- [CVE-2026-64512](https://insights.sbomify.com/CVE-2026-64512/): ACPI: CPPC: Suppress UBSAN warning caused by field misuse (not scored)
- [CVE-2026-64511](https://insights.sbomify.com/CVE-2026-64511/): ACPI: NFIT: core: Fix possible NULL pointer dereference (not scored)
- [CVE-2026-64510](https://insights.sbomify.com/CVE-2026-64510/): ACPI: NFIT: core: Fix acpi_nfit_init() error cleanup (high 7.0)
- [CVE-2026-6451](https://insights.sbomify.com/CVE-2026-6451/): CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-64509](https://insights.sbomify.com/CVE-2026-64509/): rust: block: fix GenDisk cleanup paths (not scored)
- [CVE-2026-64508](https://insights.sbomify.com/CVE-2026-64508/): bpf: Support for hardening against JIT spraying (not scored)
- [CVE-2026-64507](https://insights.sbomify.com/CVE-2026-64507/): x86/bugs: Enable IBPB flush on BPF JIT allocation (not scored)
- [CVE-2026-64506](https://insights.sbomify.com/CVE-2026-64506/): wifi: rtw89: correct drop logic for malformed AMPDU frames (not scored)
- [CVE-2026-64505](https://insights.sbomify.com/CVE-2026-64505/): usb: gadget: function: rndis: add length check for header (not scored)
- [CVE-2026-64504](https://insights.sbomify.com/CVE-2026-64504/): iio: accel: bmc150: clamp the device-reported FIFO frame count (not scored)
- [CVE-2026-64503](https://insights.sbomify.com/CVE-2026-64503/): iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error (not scored)
- [CVE-2026-64502](https://insights.sbomify.com/CVE-2026-64502/): iio: adc: ad_sigma_delta: fix clear_pending_event for registerless devices (high 7.8)
- [CVE-2026-64501](https://insights.sbomify.com/CVE-2026-64501/): iio: adc: ad_sigma_delta: fix CS held asserted and state leaks (high 7.1)
- [CVE-2026-64500](https://insights.sbomify.com/CVE-2026-64500/): iio: adc: lpc32xx: Initialize completion before requesting IRQ (not scored)
- [CVE-2026-6450](https://insights.sbomify.com/CVE-2026-6450/): CRL critical extension bypass in ParseCRL_Extensions (low 1.0)
- [CVE-2026-64499](https://insights.sbomify.com/CVE-2026-64499/): iio: adc: ti-ads1119: fix PM reference leak in buffer preenable (not scored)
- [CVE-2026-64498](https://insights.sbomify.com/CVE-2026-64498/): iio: buffer: hw-consumer: free scan_mask on buffer release (not scored)
- [CVE-2026-64497](https://insights.sbomify.com/CVE-2026-64497/): iio: chemical: scd30: Cleanup initializations and fix sign-extension bug (not scored)
- [CVE-2026-64496](https://insights.sbomify.com/CVE-2026-64496/): iio: event: Fix event FIFO reset race (high 7.1)
- [CVE-2026-64495](https://insights.sbomify.com/CVE-2026-64495/): iio: gyro: bmg160: bail out when bandwidth/filter is not in table (not scored)
- [CVE-2026-64494](https://insights.sbomify.com/CVE-2026-64494/): iio: light: gp2ap002: fix runtime PM leak on read error (not scored)
- [CVE-2026-64493](https://insights.sbomify.com/CVE-2026-64493/): iio: pressure: mpl115: fix runtime PM leak on read error (not scored)
- [CVE-2026-64492](https://insights.sbomify.com/CVE-2026-64492/): iio: temperature: tmp006: use devm_iio_trigger_register (not scored)
- [CVE-2026-64491](https://insights.sbomify.com/CVE-2026-64491/): ALSA: usx2y: us144mkii: fix work UAF on disconnect (not scored)
- [CVE-2026-64490](https://insights.sbomify.com/CVE-2026-64490/): ALSA: virtio: Validate control metadata from the device (high 8.4)
- [CVE-2026-6449](https://insights.sbomify.com/CVE-2026-6449/): Missing authorization in Booking for Appointments and Events Calendar – Amelia (medium 5.3)
- [CVE-2026-64489](https://insights.sbomify.com/CVE-2026-64489/): ALSA: ymfpci: check snd_ctl_new1() return value (not scored)
- [CVE-2026-64488](https://insights.sbomify.com/CVE-2026-64488/): ALSA: aoa: check snd_ctl_new1() return value (not scored)
- [CVE-2026-64487](https://insights.sbomify.com/CVE-2026-64487/): ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser (not scored)
- [CVE-2026-64486](https://insights.sbomify.com/CVE-2026-64486/): ALSA: cmipci: check snd_ctl_new1() return value (not scored)
- [CVE-2026-64485](https://insights.sbomify.com/CVE-2026-64485/): ALSA: compress: Fix task creation error unwind (high 7.8)
- [CVE-2026-64484](https://insights.sbomify.com/CVE-2026-64484/): ALSA: es1938: check snd_ctl_new1() return value (not scored)
- [CVE-2026-64483](https://insights.sbomify.com/CVE-2026-64483/): ALSA: firewire: isight: bound the sample count to the packet payload (not scored)
- [CVE-2026-64482](https://insights.sbomify.com/CVE-2026-64482/): ALSA: gus: check snd_ctl_new1() return value (not scored)
- [CVE-2026-64481](https://insights.sbomify.com/CVE-2026-64481/): ALSA: hda/cs35l41: Fix firmware load work teardown (high 7.8)
- [CVE-2026-64480](https://insights.sbomify.com/CVE-2026-64480/): ALSA: ice1712: check snd_ctl_new1() return value (not scored)
- [CVE-2026-6448](https://insights.sbomify.com/CVE-2026-6448/): Quiz and Survey Master (QSM) <= 11.1.2 - Authenticated (Admin+) SQL Injection via 'order' and 'limit' Parameters (medium 4.9)
- [CVE-2026-64479](https://insights.sbomify.com/CVE-2026-64479/): ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup() (not scored)
- [CVE-2026-64478](https://insights.sbomify.com/CVE-2026-64478/): ALSA: usb-audio: avoid kobject path lookup in DualSense match (not scored)
- [CVE-2026-64477](https://insights.sbomify.com/CVE-2026-64477/): x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/469/