# Vulnerabilities published in 2026


- [CVE-2026-64385](https://insights.sbomify.com/CVE-2026-64385/): smb: client: fix double-free in SMB2_ioctl() replay (critical 9.8)
- [CVE-2026-64384](https://insights.sbomify.com/CVE-2026-64384/): smb: client: fix change notify replay double-free (critical 9.8)
- [CVE-2026-64383](https://insights.sbomify.com/CVE-2026-64383/): smb: client: fix double-free in SMB2_flush() replay (critical 9.8)
- [CVE-2026-64382](https://insights.sbomify.com/CVE-2026-64382/): smb: client: fix double-free in SMB2_open() replay (high 8.8)
- [CVE-2026-64381](https://insights.sbomify.com/CVE-2026-64381/): smb: client: Fix next buffer leak in receive_encrypted_standard() (high 7.8)
- [CVE-2026-64380](https://insights.sbomify.com/CVE-2026-64380/): smb: client: harden POSIX SID length parsing (high 8.2)
- [CVE-2026-64379](https://insights.sbomify.com/CVE-2026-64379/): smb: client: mask server-provided mode to 07777 in modefromsid (high 7.1)
- [CVE-2026-64378](https://insights.sbomify.com/CVE-2026-64378/): writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (high 7.8)
- [CVE-2026-64377](https://insights.sbomify.com/CVE-2026-64377/): cpufreq: qcom-cpufreq-hw: Fix possible double free (high 7.8)
- [CVE-2026-64376](https://insights.sbomify.com/CVE-2026-64376/): firmware_loader: fix device reference leak in firmware_upload_register() (medium 5.5)
- [CVE-2026-64375](https://insights.sbomify.com/CVE-2026-64375/): proc: protect ptrace_may_access() with exec_update_lock (FD links) (high 7.8)
- [CVE-2026-64374](https://insights.sbomify.com/CVE-2026-64374/): sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT (high 7.5)
- [CVE-2026-64373](https://insights.sbomify.com/CVE-2026-64373/): cpufreq: Fix hotplug-suspend race during reboot (medium 4.7)
- [CVE-2026-64372](https://insights.sbomify.com/CVE-2026-64372/): cpufreq: pcc: fix use-after-free and double free in _OSC evaluation (high 7.8)
- [CVE-2026-64371](https://insights.sbomify.com/CVE-2026-64371/): proc: protect ptrace_may_access() with exec_update_lock (part 1) (medium 5.5)
- [CVE-2026-64370](https://insights.sbomify.com/CVE-2026-64370/): posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (medium 5.5)
- [CVE-2026-6437](https://insights.sbomify.com/CVE-2026-6437/): AWS EFS CSI Driver Mount Option Injection (medium 6.9)
- [CVE-2026-64369](https://insights.sbomify.com/CVE-2026-64369/): s390: Revert support for DCACHE_WORD_ACCESS (medium 5.5)
- [CVE-2026-64368](https://insights.sbomify.com/CVE-2026-64368/): mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (high 8.1)
- [CVE-2026-64367](https://insights.sbomify.com/CVE-2026-64367/): HID: hid-goodix-spi: validate report size to prevent stack buffer overflow (high 7.8)
- [CVE-2026-64366](https://insights.sbomify.com/CVE-2026-64366/): HID: wacom: fix slab-out-of-bounds write in wacom_wac_queue_insert (high 8.8)
- [CVE-2026-64365](https://insights.sbomify.com/CVE-2026-64365/): HID: letsketch: fix UAF on inrange_timer at driver unbind (high 7.8)
- [CVE-2026-64364](https://insights.sbomify.com/CVE-2026-64364/): HID: multitouch: fix out-of-bounds bit access on mt_io_flags (high 8.8)
- [CVE-2026-64363](https://insights.sbomify.com/CVE-2026-64363/): HID: appleir: fix UAF on pending key_up_timer in remove() (high 7.8)
- [CVE-2026-64362](https://insights.sbomify.com/CVE-2026-64362/): HID: lg-g15: cancel pending work on remove to fix a use-after-free (high 7.8)
- [CVE-2026-64361](https://insights.sbomify.com/CVE-2026-64361/): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length (high 7.8)
- [CVE-2026-64360](https://insights.sbomify.com/CVE-2026-64360/): hfs/hfsplus: zero-initialize buffer in hfs_bnode_read (medium 5.5)
- [CVE-2026-64359](https://insights.sbomify.com/CVE-2026-64359/): nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers (medium 5.5)
- [CVE-2026-64358](https://insights.sbomify.com/CVE-2026-64358/): media: mtk-jpeg: cancel workqueue on release for supported platforms only (medium 5.5)
- [CVE-2026-64357](https://insights.sbomify.com/CVE-2026-64357/): xfs: fix exchmaps reservation limit check (medium 5.5)
- [CVE-2026-64356](https://insights.sbomify.com/CVE-2026-64356/): xfs: fix memory leak in xfs_dqinode_metadir_create() (medium 5.5)
- [CVE-2026-64355](https://insights.sbomify.com/CVE-2026-64355/): bpf: Reject fragmented frames in devmap (critical 9.8)
- [CVE-2026-64354](https://insights.sbomify.com/CVE-2026-64354/): bpf: Validate BTF repeated field counts before expansion (high 7.8)
- [CVE-2026-64353](https://insights.sbomify.com/CVE-2026-64353/): bpf: Keep dynamic inner array lookups nullable (medium 5.5)
- [CVE-2026-64352](https://insights.sbomify.com/CVE-2026-64352/): bpf: Allow LPM map access from sleepable BPF programs (high 7.8)
- [CVE-2026-64351](https://insights.sbomify.com/CVE-2026-64351/): net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() (medium 5.5)
- [CVE-2026-64350](https://insights.sbomify.com/CVE-2026-64350/): usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info() (medium 5.5)
- [CVE-2026-64349](https://insights.sbomify.com/CVE-2026-64349/): usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (medium 5.5)
- [CVE-2026-64348](https://insights.sbomify.com/CVE-2026-64348/): usb: free iso schedules on failed submit (high 7.8)
- [CVE-2026-64347](https://insights.sbomify.com/CVE-2026-64347/): usb: gadget: composite: fix dead empty check in the USB_DT_OTG handler (medium 5.5)
- [CVE-2026-64346](https://insights.sbomify.com/CVE-2026-64346/): usb: gadget: udc: Fix use-after-free in gadget_match_driver (high 7.8)
- [CVE-2026-64345](https://insights.sbomify.com/CVE-2026-64345/): usb: gadget: f_printer: take kref only for successful open (medium 5.5)
- [CVE-2026-64344](https://insights.sbomify.com/CVE-2026-64344/): USB: idmouse: fix use-after-free on disconnect race (high 7.8)
- [CVE-2026-64343](https://insights.sbomify.com/CVE-2026-64343/): USB: ldusb: fix use-after-free on disconnect race (high 7.8)
- [CVE-2026-64342](https://insights.sbomify.com/CVE-2026-64342/): USB: iowarrior: fix use-after-free on disconnect (high 7.8)
- [CVE-2026-64341](https://insights.sbomify.com/CVE-2026-64341/): USB: iowarrior: fix use-after-free on disconnect race (high 7.8)
- [CVE-2026-64340](https://insights.sbomify.com/CVE-2026-64340/): USB: legousbtower: fix use-after-free on disconnect race (high 7.8)
- [CVE-2026-64339](https://insights.sbomify.com/CVE-2026-64339/): usb: misc: usbio: bound bulk IN response length to the received transfer (high 7.1)
- [CVE-2026-64338](https://insights.sbomify.com/CVE-2026-64338/): USB: misc: uss720: unregister parport on probe failure (medium 5.5)
- [CVE-2026-64337](https://insights.sbomify.com/CVE-2026-64337/): usb: mtu3: unmap request DMA on queue failure (medium 5.5)
- [CVE-2026-64336](https://insights.sbomify.com/CVE-2026-64336/): USB: serial: keyspan_pda: fix information leak (medium 5.5)
- [CVE-2026-64335](https://insights.sbomify.com/CVE-2026-64335/): USB: serial: digi_acceleport: fix broken rx after throttle (medium 5.5)
- [CVE-2026-64334](https://insights.sbomify.com/CVE-2026-64334/): USB: serial: digi_acceleport: fix hard lockup on disconnect (medium 5.5)
- [CVE-2026-64333](https://insights.sbomify.com/CVE-2026-64333/): USB: serial: digi_acceleport: fix write buffer corruption (high 7.8)
- [CVE-2026-64332](https://insights.sbomify.com/CVE-2026-64332/): USB: ulpi: fix memory leak on registration failure (medium 5.5)
- [CVE-2026-64331](https://insights.sbomify.com/CVE-2026-64331/): usbip: vudc: fix NULL deref in vep_dequeue() (medium 5.5)
- [CVE-2026-64330](https://insights.sbomify.com/CVE-2026-64330/): usb: typec: tcpm: Validate SVID index in svdm_consume_modes() (high 7.8)
- [CVE-2026-6433](https://insights.sbomify.com/CVE-2026-6433/): Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE (high 7.3)
- [CVE-2026-64329](https://insights.sbomify.com/CVE-2026-64329/): usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove (high 7.8)
- [CVE-2026-64328](https://insights.sbomify.com/CVE-2026-64328/): usb: gadget: f_fs: Fix DMA fence leak (medium 5.5)
- [CVE-2026-64327](https://insights.sbomify.com/CVE-2026-64327/): usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks (medium 5.5)
- [CVE-2026-64326](https://insights.sbomify.com/CVE-2026-64326/): block: skip sync_blockdev() on surprise removal in bdev_mark_dead() (medium 5.5)
- [CVE-2026-64325](https://insights.sbomify.com/CVE-2026-64325/): wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon (medium 5.5)
- [CVE-2026-64324](https://insights.sbomify.com/CVE-2026-64324/): udf: validate free block extents against the partition length (high 7.8)
- [CVE-2026-64323](https://insights.sbomify.com/CVE-2026-64323/): udf: validate VAT header length against the VAT inode size (high 7.1)
- [CVE-2026-64322](https://insights.sbomify.com/CVE-2026-64322/): udf: validate sparing table length as an entry count, not a byte count (high 7.8)
- [CVE-2026-64321](https://insights.sbomify.com/CVE-2026-64321/): nvme: target: rdma: fix ndev refcount leak on queue connect (medium 5.5)
- [CVE-2026-64320](https://insights.sbomify.com/CVE-2026-64320/): nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (critical 9.1)
- [CVE-2026-6432](https://insights.sbomify.com/CVE-2026-6432/): Improper bounds validation in EmberZNet SDK (medium 5.3)
- [CVE-2026-64319](https://insights.sbomify.com/CVE-2026-64319/): nvmet-auth: validate reply message payload bounds against transfer length (critical 9.1)
- [CVE-2026-64318](https://insights.sbomify.com/CVE-2026-64318/): partitions: aix: bound the pp_count scan to the ppe array (high 7.1)
- [CVE-2026-64317](https://insights.sbomify.com/CVE-2026-64317/): isofs: bound Rock Ridge symlink components to the SL record (high 7.1)
- [CVE-2026-64316](https://insights.sbomify.com/CVE-2026-64316/): crypto: caam - use print_hex_dump_devel to guard key hex dumps (medium 5.5)
- [CVE-2026-64315](https://insights.sbomify.com/CVE-2026-64315/): crypto: caam - use print_hex_dump_devel to guard key hex dumps (high 7.0)
- [CVE-2026-64314](https://insights.sbomify.com/CVE-2026-64314/): crypto: chacha20poly1305 - validate poly1305 template argument (medium 5.5)
- [CVE-2026-64313](https://insights.sbomify.com/CVE-2026-64313/): crypto: ecc - Fix carry overflow in vli multiplication (high 8.8)
- [CVE-2026-64312](https://insights.sbomify.com/CVE-2026-64312/): crypto: pcrypt - restore callback for non-parallel fallback (high 7.5)
- [CVE-2026-64311](https://insights.sbomify.com/CVE-2026-64311/): crypto: loongson - Remove broken and unused loongson-rng (high 7.8)
- [CVE-2026-64310](https://insights.sbomify.com/CVE-2026-64310/): crypto: ccp - Do not initialize SNP for SEV ioctls (medium 5.5)
- [CVE-2026-6431](https://insights.sbomify.com/CVE-2026-6431/): User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field (high 7.2)
- [CVE-2026-64309](https://insights.sbomify.com/CVE-2026-64309/): crypto: ccp - Do not initialize SNP for ioctl(SNP_COMMIT) (medium 5.5)
- [CVE-2026-64308](https://insights.sbomify.com/CVE-2026-64308/): crypto: ccp - Do not initialize SNP for ioctl(SNP_VLEK_LOAD) (medium 5.5)
- [CVE-2026-64307](https://insights.sbomify.com/CVE-2026-64307/): crypto: ccp - Do not initialize SNP for ioctl(SNP_CONFIG) (medium 5.5)
- [CVE-2026-64306](https://insights.sbomify.com/CVE-2026-64306/): crypto: drbg - Fix returning success on failure in CTR_DRBG (medium 5.5)
- [CVE-2026-64305](https://insights.sbomify.com/CVE-2026-64305/): crypto: qat - protect service table iterations with service_lock (high 7.8)
- [CVE-2026-64304](https://insights.sbomify.com/CVE-2026-64304/): crypto: qat - validate RSA CRT component lengths (high 7.8)
- [CVE-2026-64303](https://insights.sbomify.com/CVE-2026-64303/): spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (critical 9.8)
- [CVE-2026-64302](https://insights.sbomify.com/CVE-2026-64302/): x86/mm: Fix freeing of PMD-sized vmemmap pages (medium 5.5)
- [CVE-2026-64301](https://insights.sbomify.com/CVE-2026-64301/): regulator: scmi: fix of_node refcount leak in scmi_regulator_probe() (medium 5.5)
- [CVE-2026-64300](https://insights.sbomify.com/CVE-2026-64300/): perf/aux: Fix page UAF in map_range() (high 7.8)
- [CVE-2026-64299](https://insights.sbomify.com/CVE-2026-64299/): tracing: Prevent out-of-bounds read in glob matching (high 7.1)
- [CVE-2026-64298](https://insights.sbomify.com/CVE-2026-64298/): NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (high 7.1)
- [CVE-2026-64297](https://insights.sbomify.com/CVE-2026-64297/): module: decompress: check return value of module_extend_max_pages() (medium 5.5)
- [CVE-2026-64296](https://insights.sbomify.com/CVE-2026-64296/): exfat: bound uniname advance in exfat_find_dir_entry() (high 7.8)
- [CVE-2026-64295](https://insights.sbomify.com/CVE-2026-64295/): mm: page_ext: add count limit to page_ext_iter_next to prevent invalid PFN access (medium 5.5)
- [CVE-2026-64294](https://insights.sbomify.com/CVE-2026-64294/): mm: do file ownership checks with the proper mount idmap (medium 5.5)
- [CVE-2026-64293](https://insights.sbomify.com/CVE-2026-64293/): iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (high 7.8)
- [CVE-2026-64292](https://insights.sbomify.com/CVE-2026-64292/): iommufd: Move vevent memory allocation outside spinlock (medium 5.5)
- [CVE-2026-64291](https://insights.sbomify.com/CVE-2026-64291/): iommufd: Set veventq_depth upper bound (medium 5.5)
- [CVE-2026-64290](https://insights.sbomify.com/CVE-2026-64290/): iommufd: Break the loop on failure in iommufd_fault_fops_read() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/471/