# Vulnerabilities published in 2026


- [CVE-2026-6429](https://insights.sbomify.com/CVE-2026-6429/): netrc credential leak with reused proxy connection (medium 5.3)
- [CVE-2026-64289](https://insights.sbomify.com/CVE-2026-64289/): iommufd: Set upper bounds on cache invalidation entry_num and entry_len (medium 5.5)
- [CVE-2026-64288](https://insights.sbomify.com/CVE-2026-64288/): KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB (medium 5.5)
- [CVE-2026-64287](https://insights.sbomify.com/CVE-2026-64287/): KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (high 8.2)
- [CVE-2026-64286](https://insights.sbomify.com/CVE-2026-64286/): KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU (high 8.2)
- [CVE-2026-64285](https://insights.sbomify.com/CVE-2026-64285/): KVM: SEV: Pin source page for write when adding CPUID data for SNP guest (medium 5.5)
- [CVE-2026-64284](https://insights.sbomify.com/CVE-2026-64284/): KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits (high 7.1)
- [CVE-2026-64283](https://insights.sbomify.com/CVE-2026-64283/): KVM: guest_memfd: Treat memslot binding offset+size as unsigned values (high 7.0)
- [CVE-2026-64282](https://insights.sbomify.com/CVE-2026-64282/): KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifier (medium 4.7)
- [CVE-2026-64281](https://insights.sbomify.com/CVE-2026-64281/): svcrdma: wake sq waiters when the transport closes (high 7.5)
- [CVE-2026-64280](https://insights.sbomify.com/CVE-2026-64280/): fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() (high 8.8)
- [CVE-2026-6428](https://insights.sbomify.com/CVE-2026-6428/): Koha SQL Injection in reports/catalogue_out.pl via Filter URL Parameter (medium 5.6)
- [CVE-2026-64279](https://insights.sbomify.com/CVE-2026-64279/): i2c: core: fix adapter deregistration race (high 7.8)
- [CVE-2026-64278](https://insights.sbomify.com/CVE-2026-64278/): i2c: imx-lpi2c: mark I2C adapter when hardware is powered down (medium 5.5)
- [CVE-2026-64277](https://insights.sbomify.com/CVE-2026-64277/): Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (high 7.8)
- [CVE-2026-64276](https://insights.sbomify.com/CVE-2026-64276/): Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (high 7.8)
- [CVE-2026-64275](https://insights.sbomify.com/CVE-2026-64275/): Input: elan_i2c - prevent division by zero and arithmetic underflow (medium 5.5)
- [CVE-2026-64274](https://insights.sbomify.com/CVE-2026-64274/): Input: goodix - clamp the device-reported contact count (high 7.8)
- [CVE-2026-64273](https://insights.sbomify.com/CVE-2026-64273/): Input: iforce - bound the device-reported force-feedback effect index (high 7.8)
- [CVE-2026-64272](https://insights.sbomify.com/CVE-2026-64272/): Input: mms114 - fix touch indexing for MMS134S and MMS136 (high 7.8)
- [CVE-2026-64271](https://insights.sbomify.com/CVE-2026-64271/): Input: touchwin - reset the packet index on every complete packet (high 7.8)
- [CVE-2026-64270](https://insights.sbomify.com/CVE-2026-64270/): Input: mms114 - reject an oversized device packet size (high 7.8)
- [CVE-2026-6427](https://insights.sbomify.com/CVE-2026-6427/): a3 Lazy Load <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Element (medium 6.4)
- [CVE-2026-64269](https://insights.sbomify.com/CVE-2026-64269/): RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg (critical 9.1)
- [CVE-2026-64268](https://insights.sbomify.com/CVE-2026-64268/): RDMA/siw: bound Read Response placement to the RREAD length (critical 9.8)
- [CVE-2026-64267](https://insights.sbomify.com/CVE-2026-64267/): fuse: avoid 32-bit prune notification count wrap (medium 5.5)
- [CVE-2026-64266](https://insights.sbomify.com/CVE-2026-64266/): fuse: re-lock request before returning from fuse_ref_folio() (high 7.8)
- [CVE-2026-64265](https://insights.sbomify.com/CVE-2026-64265/): fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (high 7.8)
- [CVE-2026-64264](https://insights.sbomify.com/CVE-2026-64264/): fuse-uring: fix EFAULT clobber in fuse_uring_commit (medium 5.5)
- [CVE-2026-64263](https://insights.sbomify.com/CVE-2026-64263/): fuse-uring: fix moving cancelled entry to ent_in_userspace list (medium 5.5)
- [CVE-2026-64262](https://insights.sbomify.com/CVE-2026-64262/): fuse-uring: end fuse_req on io-uring cancel task work (medium 5.5)
- [CVE-2026-64261](https://insights.sbomify.com/CVE-2026-64261/): fuse-uring: Avoid use-after-free in fuse_uring_async_stop_queues (high 7.8)
- [CVE-2026-64260](https://insights.sbomify.com/CVE-2026-64260/): fuse-uring: Avoid queue->stopped races and set/read that value under lock (high 7.8)
- [CVE-2026-6426](https://insights.sbomify.com/CVE-2026-6426/): Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access (medium 4.4)
- [CVE-2026-64259](https://insights.sbomify.com/CVE-2026-64259/): fuse-uring: make a fuse_req on SQE commit only findable after memcpy (high 7.8)
- [CVE-2026-64258](https://insights.sbomify.com/CVE-2026-64258/): fuse-uring: remove request-less entries from ent_w_req_queue to fix NULL deref (medium 5.5)
- [CVE-2026-64257](https://insights.sbomify.com/CVE-2026-64257/): smb: client: reject overlapping data areas in SMB2 responses (critical 9.1)
- [CVE-2026-64256](https://insights.sbomify.com/CVE-2026-64256/): xfs: don't wrap around quota ids in dqiterate (medium 5.5)
- [CVE-2026-64255](https://insights.sbomify.com/CVE-2026-64255/): wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (high 8.8)
- [CVE-2026-64254](https://insights.sbomify.com/CVE-2026-64254/): NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR (medium 5.5)
- [CVE-2026-64253](https://insights.sbomify.com/CVE-2026-64253/): kernel/fork: clear PF_BLOCK_TS in copy_process() (medium 5.5)
- [CVE-2026-64252](https://insights.sbomify.com/CVE-2026-64252/): MIPS: DEC: Prevent initial console buffer from landing in XKPHYS (medium 5.5)
- [CVE-2026-64251](https://insights.sbomify.com/CVE-2026-64251/): pwrseq: core: fix use-after-free in pwrseq_debugfs_seq_next() (high 7.8)
- [CVE-2026-64250](https://insights.sbomify.com/CVE-2026-64250/): LoongArch: Report dying CPU to RCU in stop_this_cpu() (medium 5.5)
- [CVE-2026-64249](https://insights.sbomify.com/CVE-2026-64249/): fpga: region: fix use-after-free in child_regions_with_firmware() (high 7.8)
- [CVE-2026-64248](https://insights.sbomify.com/CVE-2026-64248/): MIPS: smp: report dying CPU to RCU in stop_this_cpu() (medium 5.5)
- [CVE-2026-64247](https://insights.sbomify.com/CVE-2026-64247/): KVM: x86: hyper-v: Bound the bank index when querying sparse banks (high 8.4)
- [CVE-2026-64246](https://insights.sbomify.com/CVE-2026-64246/): power: reset: linkstation-poweroff: fix use-after-free in the linkstation_poweroff_init() (high 7.8)
- [CVE-2026-64245](https://insights.sbomify.com/CVE-2026-64245/): fbdev: modedb: fix a possible UAF in fb_find_mode() (high 7.8)
- [CVE-2026-64244](https://insights.sbomify.com/CVE-2026-64244/): drivers/base/memory: set mem->altmap after successful device registration (medium 5.5)
- [CVE-2026-64243](https://insights.sbomify.com/CVE-2026-64243/): ASoC: codecs: simple-mux: Fix enum control bounds check (high 7.1)
- [CVE-2026-64242](https://insights.sbomify.com/CVE-2026-64242/): usb: gadget: net2280: Fix double free in probe error path (high 7.8)
- [CVE-2026-64241](https://insights.sbomify.com/CVE-2026-64241/): gpio: rockchip: teardown bugs and resource leaks (medium 5.5)
- [CVE-2026-64240](https://insights.sbomify.com/CVE-2026-64240/): media: rc: igorplugusb: fix control request setup packet (medium 5.5)
- [CVE-2026-6424](https://insights.sbomify.com/CVE-2026-6424/): Use-after-free vulnerability in ESET security products for Linux (medium 6.7)
- [CVE-2026-64239](https://insights.sbomify.com/CVE-2026-64239/): mm/damon/sysfs-schemes: delete tried region in regions_rmdirs() (high 7.8)
- [CVE-2026-64238](https://insights.sbomify.com/CVE-2026-64238/): gpio: shared: fix deadlock on shared proxy's parent removal (medium 5.5)
- [CVE-2026-64237](https://insights.sbomify.com/CVE-2026-64237/): Input: elan_i2c - validate firmware size before use (high 7.1)
- [CVE-2026-64236](https://insights.sbomify.com/CVE-2026-64236/): i2c: davinci: fix division by zero on missing clock-frequency (medium 5.5)
- [CVE-2026-64235](https://insights.sbomify.com/CVE-2026-64235/): x86/ftrace: Relocate %rip-relative percpu refs in dynamic trampolines (high 8.1)
- [CVE-2026-64234](https://insights.sbomify.com/CVE-2026-64234/): tty: serial: pch_uart: add check for dma_alloc_coherent() (medium 5.5)
- [CVE-2026-64233](https://insights.sbomify.com/CVE-2026-64233/): usb: gadget: uvc: hold opts->lock across XU walks in uvc_function_bind (medium 5.5)
- [CVE-2026-64232](https://insights.sbomify.com/CVE-2026-64232/): block: recompute nr_integrity_segments in blk_insert_cloned_request (critical 9.8)
- [CVE-2026-64231](https://insights.sbomify.com/CVE-2026-64231/): drm/msm/dsi: don't dump registers past the mapped region (medium 5.5)
- [CVE-2026-64230](https://insights.sbomify.com/CVE-2026-64230/): regulator: tps65219: fix irq_data.rdev not being assigned (medium 5.5)
- [CVE-2026-6423](https://insights.sbomify.com/CVE-2026-6423/): Local privilege escalation via unauthenticated ALPC in ESET Inspect Connector (high 8.5)
- [CVE-2026-64229](https://insights.sbomify.com/CVE-2026-64229/): x86/mm: Disable broadcast TLB flush when PCID is disabled (medium 5.5)
- [CVE-2026-64228](https://insights.sbomify.com/CVE-2026-64228/): net: ethtool: phy: avoid NULL deref when PHY driver is unbound (medium 5.5)
- [CVE-2026-64227](https://insights.sbomify.com/CVE-2026-64227/): ACPI: driver: Check ACPI_COMPANION() against NULL during probe (medium 5.5)
- [CVE-2026-64226](https://insights.sbomify.com/CVE-2026-64226/): sched_ext: Avoid UAF in scx_root_enable_workfn() init failure path (high 7.8)
- [CVE-2026-64225](https://insights.sbomify.com/CVE-2026-64225/): octeontx2-af: CGX: add bounds check to cgx_speed_mbps index (high 7.8)
- [CVE-2026-64224](https://insights.sbomify.com/CVE-2026-64224/): octeontx2-pf: fix double free in rvu_rep_rsrc_init() (high 7.8)
- [CVE-2026-64223](https://insights.sbomify.com/CVE-2026-64223/): wifi: mac80211: consume only present negotiated TTLM maps (high 8.1)
- [CVE-2026-64222](https://insights.sbomify.com/CVE-2026-64222/): octeontx2-pf: avoid double free of pool->stack on AQ init failure (high 7.0)
- [CVE-2026-64221](https://insights.sbomify.com/CVE-2026-64221/): spi: ti-qspi: fix use-after-free after DMA setup failure (high 7.8)
- [CVE-2026-64220](https://insights.sbomify.com/CVE-2026-64220/): device property: set fwnode->secondary to NULL in fwnode_init() (medium 5.5)
- [CVE-2026-64219](https://insights.sbomify.com/CVE-2026-64219/): drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (high 7.0)
- [CVE-2026-64218](https://insights.sbomify.com/CVE-2026-64218/): batman-adv: bla: fix report_work leak on backbone_gw purge (high 7.8)
- [CVE-2026-64217](https://insights.sbomify.com/CVE-2026-64217/): netfs: Fix overrun check in netfs_extract_user_iter() (high 7.8)
- [CVE-2026-64216](https://insights.sbomify.com/CVE-2026-64216/): netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() (critical 9.8)
- [CVE-2026-64215](https://insights.sbomify.com/CVE-2026-64215/): drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table (medium 5.5)
- [CVE-2026-64214](https://insights.sbomify.com/CVE-2026-64214/): powerpc/time: Remove redundant preempt_disable|enable() calls from arch_irq_work_raise() (medium 5.5)
- [CVE-2026-64213](https://insights.sbomify.com/CVE-2026-64213/): hwmon: (lm90) Add lock protection to lm90_alert (medium 5.5)
- [CVE-2026-64212](https://insights.sbomify.com/CVE-2026-64212/): wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it (medium 5.5)
- [CVE-2026-64211](https://insights.sbomify.com/CVE-2026-64211/): srcu: Don't queue workqueue handlers to never-online CPUs (medium 5.5)
- [CVE-2026-64210](https://insights.sbomify.com/CVE-2026-64210/): net/mlx5e: xsk: Fix unlocked writing to ICOSQ (high 7.5)
- [CVE-2026-6421](https://insights.sbomify.com/CVE-2026-6421/): Mobatek MobaXterm Home Edition msimg32.dll uncontrolled search path (high 7.3)
- [CVE-2026-64209](https://insights.sbomify.com/CVE-2026-64209/): phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config (high 7.1)
- [CVE-2026-64208](https://insights.sbomify.com/CVE-2026-64208/): crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (high 7.5)
- [CVE-2026-64207](https://insights.sbomify.com/CVE-2026-64207/): net/sched: dualpi2: fix GSO backlog accounting (medium 5.5)
- [CVE-2026-64206](https://insights.sbomify.com/CVE-2026-64206/): Bluetooth: L2CAP: cancel pending_rx_work before taking conn->lock (high 8.8)
- [CVE-2026-64205](https://insights.sbomify.com/CVE-2026-64205/): i2c: i801: fix hardware state machine corruption in error path (medium 5.5)
- [CVE-2026-64204](https://insights.sbomify.com/CVE-2026-64204/): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-64203](https://insights.sbomify.com/CVE-2026-64203/): Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-64202](https://insights.sbomify.com/CVE-2026-64202/): Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-64201](https://insights.sbomify.com/CVE-2026-64201/): Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-64200](https://insights.sbomify.com/CVE-2026-64200/): Out Of Bounds Read in during string conversionwhen parsing a .DSB file in DASYLab (high 8.5)
- [CVE-2026-6420](https://insights.sbomify.com/CVE-2026-6420/): Keylime: keylime: security bypass due to hardcoded tpm quote nonce (medium 6.3)
- [CVE-2026-64199](https://insights.sbomify.com/CVE-2026-64199/): Out Of Bounds Read outside the bounds of an allocated data structure when parsing a .DSB file in DASYLab (high 8.6)
- [CVE-2026-64198](https://insights.sbomify.com/CVE-2026-64198/): Out Of Bounds Read in file handling when parsing a .DSB file in DASYLab (high 8.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/472/