# Vulnerabilities published in 2026


- [CVE-2026-64476](https://insights.sbomify.com/CVE-2026-64476/): vfio/pci: Latch disable_idle_d3 per device (not scored)
- [CVE-2026-64475](https://insights.sbomify.com/CVE-2026-64475/): vfio/pci: Release the VGA arbiter client on register_device() failure (high 8.8)
- [CVE-2026-64474](https://insights.sbomify.com/CVE-2026-64474/): vfio: prevent infinite loop in vfio_mig_get_next_state() on blocked arc (not scored)
- [CVE-2026-64473](https://insights.sbomify.com/CVE-2026-64473/): vfio: Remove device debugfs before releasing devres (not scored)
- [CVE-2026-64472](https://insights.sbomify.com/CVE-2026-64472/): vfio/mlx5: Fix racy bitfields and tighten struct layout (not scored)
- [CVE-2026-64471](https://insights.sbomify.com/CVE-2026-64471/): Bluetooth: btusb: fix use-after-free on registration failure (not scored)
- [CVE-2026-64470](https://insights.sbomify.com/CVE-2026-64470/): Bluetooth: btusb: fix use-after-free on marvell probe failure (not scored)
- [CVE-2026-6447](https://insights.sbomify.com/CVE-2026-6447/): Cross-site scripting in Call for Price for WooCommerce (medium 4.4)
- [CVE-2026-64469](https://insights.sbomify.com/CVE-2026-64469/): binder: fix UAF in binder_thread_release() (high 7.8)
- [CVE-2026-64468](https://insights.sbomify.com/CVE-2026-64468/): binder: fix UAF in binder_free_transaction() (high 7.8)
- [CVE-2026-64467](https://insights.sbomify.com/CVE-2026-64467/): rust_binder: use a u64 stride when cleaning up the offsets array (high 8.8)
- [CVE-2026-64466](https://insights.sbomify.com/CVE-2026-64466/): rust_binder: clear freeze listener on node removal (not scored)
- [CVE-2026-64465](https://insights.sbomify.com/CVE-2026-64465/): usb: xhci: Fix sleep in atomic context in xhci_free_streams() (not scored)
- [CVE-2026-64464](https://insights.sbomify.com/CVE-2026-64464/): xhci: sideband: fix ring sg table pages leak (not scored)
- [CVE-2026-64463](https://insights.sbomify.com/CVE-2026-64463/): usb: typec: tcpci_rt1711h: unregister TCPCI port with devres (high 7.8)
- [CVE-2026-64462](https://insights.sbomify.com/CVE-2026-64462/): PCI: altera: Fix resource leaks on probe failure (not scored)
- [CVE-2026-64461](https://insights.sbomify.com/CVE-2026-64461/): PCI: mediatek: Fix IRQ domain leak when port fails to enable (not scored)
- [CVE-2026-64460](https://insights.sbomify.com/CVE-2026-64460/): PCI/IOV: Skip VF Resizable BAR restore on read error (high 7.0)
- [CVE-2026-6446](https://insights.sbomify.com/CVE-2026-6446/): Missing authorization in My Social Feeds – Social Feeds Embedder Plugin for WordPress (medium 5.4)
- [CVE-2026-64459](https://insights.sbomify.com/CVE-2026-64459/): tcp: restore RCU grace period in tcp_ao_destroy_sock (critical 9.8)
- [CVE-2026-64458](https://insights.sbomify.com/CVE-2026-64458/): mm/damon/ops-common: handle extreme intervals in damon_hot_score() (not scored)
- [CVE-2026-64457](https://insights.sbomify.com/CVE-2026-64457/): virtio_pci: fix vq info pointer lookup via wrong index (not scored)
- [CVE-2026-64456](https://insights.sbomify.com/CVE-2026-64456/): hwrng: virtio: clamp device-reported used.len at copy_data() (high 7.7)
- [CVE-2026-64455](https://insights.sbomify.com/CVE-2026-64455/): USB: chaoskey: Fix slab-use-after-free in chaoskey_release() (not scored)
- [CVE-2026-64454](https://insights.sbomify.com/CVE-2026-64454/): usb: dwc3: run gadget disconnect from sleepable suspend context (not scored)
- [CVE-2026-64453](https://insights.sbomify.com/CVE-2026-64453/): usb: misc: usbio: fix disconnect UAF in client teardown (high 7.8)
- [CVE-2026-64452](https://insights.sbomify.com/CVE-2026-64452/): 6lowpan: fix NHC entry use-after-free on error path (high 7.1)
- [CVE-2026-64451](https://insights.sbomify.com/CVE-2026-64451/): tracing: Fix NULL pointer dereference in func_set_flag() (medium 5.5)
- [CVE-2026-64450](https://insights.sbomify.com/CVE-2026-64450/): tipc: fix out-of-bounds read in broadcast Gap ACK blocks (critical 9.1)
- [CVE-2026-6445](https://insights.sbomify.com/CVE-2026-6445/): Information disclosure in FlashArray (high 8.7)
- [CVE-2026-64449](https://insights.sbomify.com/CVE-2026-64449/): staging: vme_user: bound slave read/write to the kern_buf size (high 7.8)
- [CVE-2026-64448](https://insights.sbomify.com/CVE-2026-64448/): smb: client: restrict implied bcc[0] exemption to responses without data area (high 8.2)
- [CVE-2026-64447](https://insights.sbomify.com/CVE-2026-64447/): staging: media: ipu7: fix double-free and use-after-free in error paths (high 7.8)
- [CVE-2026-64446](https://insights.sbomify.com/CVE-2026-64446/): staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() (high 7.8)
- [CVE-2026-64445](https://insights.sbomify.com/CVE-2026-64445/): staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() (high 8.8)
- [CVE-2026-64444](https://insights.sbomify.com/CVE-2026-64444/): staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop (high 8.1)
- [CVE-2026-64443](https://insights.sbomify.com/CVE-2026-64443/): staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop (high 8.1)
- [CVE-2026-64442](https://insights.sbomify.com/CVE-2026-64442/): staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() (high 8.1)
- [CVE-2026-64441](https://insights.sbomify.com/CVE-2026-64441/): staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() (high 8.8)
- [CVE-2026-64440](https://insights.sbomify.com/CVE-2026-64440/): staging: rtl8723bs: fix OOB write in HT_caps_handler() (high 8.1)
- [CVE-2026-6444](https://insights.sbomify.com/CVE-2026-6444/): Missing authorization in FlashArray (high 8.6)
- [CVE-2026-64439](https://insights.sbomify.com/CVE-2026-64439/): crypto: krb5 - filter out async aead implementations at alloc (critical 9.8)
- [CVE-2026-64438](https://insights.sbomify.com/CVE-2026-64438/): crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (high 8.8)
- [CVE-2026-64437](https://insights.sbomify.com/CVE-2026-64437/): ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL (high 8.8)
- [CVE-2026-64436](https://insights.sbomify.com/CVE-2026-64436/): net: af_key: initialize alg_key_len for IPComp states (high 7.1)
- [CVE-2026-64435](https://insights.sbomify.com/CVE-2026-64435/): audit: Fix data races of skb_queue_len() readers on audit_queue (high 8.2)
- [CVE-2026-64434](https://insights.sbomify.com/CVE-2026-64434/): Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref (high 8.8)
- [CVE-2026-64433](https://insights.sbomify.com/CVE-2026-64433/): Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete (high 7.8)
- [CVE-2026-64432](https://insights.sbomify.com/CVE-2026-64432/): fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns (high 7.8)
- [CVE-2026-64431](https://insights.sbomify.com/CVE-2026-64431/): ntfs: avoid calling post_write_mst_fixup() for invalid index_block (high 7.8)
- [CVE-2026-64430](https://insights.sbomify.com/CVE-2026-64430/): NTB: epf: Avoid calling pci_irq_vector() from hardirq context (high 7.5)
- [CVE-2026-6443](https://insights.sbomify.com/CVE-2026-6443/): Essentialplugin Plugins (Various Versions) - Injected Backdoor (critical 9.8)
- [CVE-2026-64429](https://insights.sbomify.com/CVE-2026-64429/): gpio: eic-sprd: use raw_spinlock_t in the irq startup path (medium 5.5)
- [CVE-2026-64428](https://insights.sbomify.com/CVE-2026-64428/): gpio: sch: use raw_spinlock_t in the irq startup path (medium 5.5)
- [CVE-2026-64427](https://insights.sbomify.com/CVE-2026-64427/): HID: logitech-dj: Fix maxfield check in DJ short report validation (medium 5.5)
- [CVE-2026-64426](https://insights.sbomify.com/CVE-2026-64426/): io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE (medium 5.5)
- [CVE-2026-64425](https://insights.sbomify.com/CVE-2026-64425/): io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item (medium 5.5)
- [CVE-2026-64424](https://insights.sbomify.com/CVE-2026-64424/): netpoll: fix a use-after-free on shutdown path (high 7.8)
- [CVE-2026-64423](https://insights.sbomify.com/CVE-2026-64423/): ipv4: igmp: remove multicast group from hash table on device destruction (high 7.8)
- [CVE-2026-64422](https://insights.sbomify.com/CVE-2026-64422/): net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes (high 7.1)
- [CVE-2026-64421](https://insights.sbomify.com/CVE-2026-64421/): media: nxp: imx8-isi: Fix use-after-free on remove (high 7.8)
- [CVE-2026-64420](https://insights.sbomify.com/CVE-2026-64420/): mfd: cros_ec: Delay dev_set_drvdata() until probe success (high 7.0)
- [CVE-2026-6442](https://insights.sbomify.com/CVE-2026-6442/): Improper Command Detection Logic Allows RCE in Cortex Code Command-Line Interface (high 8.3)
- [CVE-2026-64419](https://insights.sbomify.com/CVE-2026-64419/): mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show() (medium 5.5)
- [CVE-2026-64418](https://insights.sbomify.com/CVE-2026-64418/): mm: shrinker: fix shrinker_info teardown race with expansion (high 7.8)
- [CVE-2026-64417](https://insights.sbomify.com/CVE-2026-64417/): mm: shrinker: fix NULL pointer dereference in debugfs (medium 5.5)
- [CVE-2026-64416](https://insights.sbomify.com/CVE-2026-64416/): mm: swap_cgroup: fix NULL deref in lookup_swap_cgroup_id on swapless host (medium 5.5)
- [CVE-2026-64415](https://insights.sbomify.com/CVE-2026-64415/): mm/swap: add cond_resched() in swap_reclaim_full_clusters to prevent softlockup (medium 5.5)
- [CVE-2026-64414](https://insights.sbomify.com/CVE-2026-64414/): netfilter: handle unreadable frags (high 7.5)
- [CVE-2026-64413](https://insights.sbomify.com/CVE-2026-64413/): netfilter: ebtables: zero chainstack array (high 7.0)
- [CVE-2026-64412](https://insights.sbomify.com/CVE-2026-64412/): netfilter: ebtables: module names must be null-terminated (high 7.1)
- [CVE-2026-64411](https://insights.sbomify.com/CVE-2026-64411/): netfilter: ebtables: terminate table name before find_table_lock() (high 7.1)
- [CVE-2026-64410](https://insights.sbomify.com/CVE-2026-64410/): netfilter: flowtable: IPIP tunnel hardware offload is not yet support (critical 9.8)
- [CVE-2026-6441](https://insights.sbomify.com/CVE-2026-6441/): Canto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification (medium 4.3)
- [CVE-2026-64409](https://insights.sbomify.com/CVE-2026-64409/): Bluetooth: btmtksdio: fix infinite loop in btmtksdio_txrx_work() (medium 5.5)
- [CVE-2026-64408](https://insights.sbomify.com/CVE-2026-64408/): Bluetooth: bnep: pin L2CAP connection during netdev registration (high 8.8)
- [CVE-2026-64407](https://insights.sbomify.com/CVE-2026-64407/): Bluetooth: btnxpuart: Fix out-of-bounds firmware read in nxp_recv_fw_req_v3() (high 7.1)
- [CVE-2026-64406](https://insights.sbomify.com/CVE-2026-64406/): Bluetooth: fix UAF in bt_accept_dequeue() (high 8.0)
- [CVE-2026-64405](https://insights.sbomify.com/CVE-2026-64405/): Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() (medium 5.5)
- [CVE-2026-64404](https://insights.sbomify.com/CVE-2026-64404/): Bluetooth: ISO: avoid NULL deref of conn in iso_conn_big_sync() (medium 5.5)
- [CVE-2026-64403](https://insights.sbomify.com/CVE-2026-64403/): Bluetooth: L2CAP: validate option length before reading conf opt value (high 7.1)
- [CVE-2026-64402](https://insights.sbomify.com/CVE-2026-64402/): coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() (high 7.8)
- [CVE-2026-64401](https://insights.sbomify.com/CVE-2026-64401/): smb: client: resolve SWN tcon from live registrations (high 7.8)
- [CVE-2026-64400](https://insights.sbomify.com/CVE-2026-64400/): ksmbd: prevent path traversal bypass by restricting caseless retry (high 8.6)
- [CVE-2026-6440](https://insights.sbomify.com/CVE-2026-6440/): Cross-site request forgery in GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference (medium 4.3)
- [CVE-2026-64399](https://insights.sbomify.com/CVE-2026-64399/): ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE (critical 9.8)
- [CVE-2026-64398](https://insights.sbomify.com/CVE-2026-64398/): ksmbd: add a permission check for FSCTL_SET_ZERO_DATA (high 8.1)
- [CVE-2026-64397](https://insights.sbomify.com/CVE-2026-64397/): ksmbd: serialize QUERY_DIRECTORY requests per file (critical 9.8)
- [CVE-2026-64396](https://insights.sbomify.com/CVE-2026-64396/): ksmbd: fix UAF of struct file_lock in SMB2_LOCK deferred-lock cancellation (high 8.8)
- [CVE-2026-64395](https://insights.sbomify.com/CVE-2026-64395/): ksmbd: require source read access for duplicate extents (high 7.5)
- [CVE-2026-64394](https://insights.sbomify.com/CVE-2026-64394/): ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY (high 8.8)
- [CVE-2026-64393](https://insights.sbomify.com/CVE-2026-64393/): ksmbd: run set info with opener credentials (critical 9.1)
- [CVE-2026-64392](https://insights.sbomify.com/CVE-2026-64392/): ksmbd: use opener credentials for delete-on-close (critical 9.1)
- [CVE-2026-64391](https://insights.sbomify.com/CVE-2026-64391/): ksmbd: use opener credentials for ADS I/O (critical 9.8)
- [CVE-2026-64390](https://insights.sbomify.com/CVE-2026-64390/): ksmbd: track the connection owning a byte-range lock (high 8.8)
- [CVE-2026-6439](https://insights.sbomify.com/CVE-2026-6439/): Cross-site scripting in VideoZen (medium 4.4)
- [CVE-2026-64389](https://insights.sbomify.com/CVE-2026-64389/): ksmbd: validate NTLMv2 response before updating session key (high 8.2)
- [CVE-2026-64388](https://insights.sbomify.com/CVE-2026-64388/): smb/client: fix chown/chgrp with SMB3 POSIX Extensions (high 7.8)
- [CVE-2026-64387](https://insights.sbomify.com/CVE-2026-64387/): smb: client: fix query directory replay double-free (critical 9.8)
- [CVE-2026-64386](https://insights.sbomify.com/CVE-2026-64386/): smb: client: fix query_info() replay double-free (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/470/