# Vulnerabilities published in 2026


- [CVE-2026-64104](https://insights.sbomify.com/CVE-2026-64104/): virt: sev-guest: Explicitly leak pages in unknown state (high 8.7)
- [CVE-2026-64103](https://insights.sbomify.com/CVE-2026-64103/): scsi: isci: Fix use-after-free in device removal path (high 7.8)
- [CVE-2026-64102](https://insights.sbomify.com/CVE-2026-64102/): RDMA/siw: Reject MPA FPDU length underflow before signed receive math (critical 9.8)
- [CVE-2026-64101](https://insights.sbomify.com/CVE-2026-64101/): fwctl: pds: Validate RPC input size before parsing (medium 5.5)
- [CVE-2026-64100](https://insights.sbomify.com/CVE-2026-64100/): drm/msm: Fix shrinker deadlock (medium 5.5)
- [CVE-2026-6410](https://insights.sbomify.com/CVE-2026-6410/): @fastify/static vulnerable to path traversal in directory listing (medium 5.3)
- [CVE-2026-64099](https://insights.sbomify.com/CVE-2026-64099/): drm/v3d: Fix use-after-free of CPU job query arrays on error path (high 7.8)
- [CVE-2026-64098](https://insights.sbomify.com/CVE-2026-64098/): drm/virtio: use uninterruptible resv lock for plane updates (high 7.8)
- [CVE-2026-64097](https://insights.sbomify.com/CVE-2026-64097/): drm/amd/display: Validate GPIO pin LUT table size before iterating (high 7.8)
- [CVE-2026-64096](https://insights.sbomify.com/CVE-2026-64096/): batman-adv: mcast: fix use-after-free in orig_node RCU release (high 8.8)
- [CVE-2026-64095](https://insights.sbomify.com/CVE-2026-64095/): batman-adv: bla: avoid double decrement of bla.num_requests (high 7.1)
- [CVE-2026-64094](https://insights.sbomify.com/CVE-2026-64094/): batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface (medium 5.5)
- [CVE-2026-64093](https://insights.sbomify.com/CVE-2026-64093/): batman-adv: tp_meter: directly shut down timer on cleanup (high 8.8)
- [CVE-2026-64092](https://insights.sbomify.com/CVE-2026-64092/): batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown (medium 5.5)
- [CVE-2026-64091](https://insights.sbomify.com/CVE-2026-64091/): batman-adv: tt: fix TOCTOU race for reported vlans (critical 9.8)
- [CVE-2026-64090](https://insights.sbomify.com/CVE-2026-64090/): batman-adv: tt: avoid empty VLAN responses (medium 5.5)
- [CVE-2026-6409](https://insights.sbomify.com/CVE-2026-6409/): Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input (high 7.1)
- [CVE-2026-64089](https://insights.sbomify.com/CVE-2026-64089/): batman-adv: tt: fix negative last_changeset_len (critical 9.8)
- [CVE-2026-64088](https://insights.sbomify.com/CVE-2026-64088/): batman-adv: tt: fix negative tt_buff_len (high 8.8)
- [CVE-2026-64087](https://insights.sbomify.com/CVE-2026-64087/): hwmon: (pmbus/adm1266) reject implausible blackbox record_count (medium 5.5)
- [CVE-2026-64086](https://insights.sbomify.com/CVE-2026-64086/): hwmon: (pmbus/adm1266) include PEC byte in pmbus_block_xfer read buffer (high 7.8)
- [CVE-2026-64085](https://insights.sbomify.com/CVE-2026-64085/): hwmon: (pmbus/adm1266) bounce blackbox records through a protocol-sized buffer (high 7.8)
- [CVE-2026-64084](https://insights.sbomify.com/CVE-2026-64084/): hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR (high 7.8)
- [CVE-2026-64083](https://insights.sbomify.com/CVE-2026-64083/): hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors (medium 5.5)
- [CVE-2026-64082](https://insights.sbomify.com/CVE-2026-64082/): riscv: Fix register corruption from uninitialized cregs on error (high 7.8)
- [CVE-2026-64081](https://insights.sbomify.com/CVE-2026-64081/): firmware: arm_ffa: Validate framework notification message layout (high 8.4)
- [CVE-2026-64080](https://insights.sbomify.com/CVE-2026-64080/): firmware: arm_ffa: Snapshot notifier callbacks under lock (critical 9.3)
- [CVE-2026-6408](https://insights.sbomify.com/CVE-2026-6408/): Tanium addressed an information disclosure vulnerability in Tanium Server. (low 2.7)
- [CVE-2026-64079](https://insights.sbomify.com/CVE-2026-64079/): netfilter: x_tables: allocate hook ops while under mutex (medium 5.5)
- [CVE-2026-64078](https://insights.sbomify.com/CVE-2026-64078/): netfilter: x_tables: add and use xtables_unregister_table_exit (high 7.8)
- [CVE-2026-64077](https://insights.sbomify.com/CVE-2026-64077/): netfilter: ebtables: move to two-stage removal scheme (high 7.8)
- [CVE-2026-64076](https://insights.sbomify.com/CVE-2026-64076/): netfilter: bridge: eb_tables: close module init race (high 7.8)
- [CVE-2026-64075](https://insights.sbomify.com/CVE-2026-64075/): fprobe: Fix unregister_fprobe() to wait for RCU grace period (high 7.8)
- [CVE-2026-64074](https://insights.sbomify.com/CVE-2026-64074/): fs/statmount: fix slab out-of-bounds write in statmount_mnt_idmap (high 7.8)
- [CVE-2026-64073](https://insights.sbomify.com/CVE-2026-64073/): irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT (high 7.8)
- [CVE-2026-64072](https://insights.sbomify.com/CVE-2026-64072/): nvme: fix bio leak on mapping failure (medium 5.5)
- [CVE-2026-64071](https://insights.sbomify.com/CVE-2026-64071/): nvme-pci: fix use-after-free in nvme_free_host_mem() (high 7.8)
- [CVE-2026-64070](https://insights.sbomify.com/CVE-2026-64070/): powerpc/hv-gpci: fix preempt count leak in sysfs show paths (medium 5.5)
- [CVE-2026-64069](https://insights.sbomify.com/CVE-2026-64069/): netfs: Fix cancellation of a DIO and single read subrequests (critical 9.8)
- [CVE-2026-64068](https://insights.sbomify.com/CVE-2026-64068/): netfs: Fix missing locking around retry adding new subreqs (critical 9.8)
- [CVE-2026-64067](https://insights.sbomify.com/CVE-2026-64067/): netfs: Fix missing barriers when accessing stream->subrequests locklessly (critical 9.8)
- [CVE-2026-64066](https://insights.sbomify.com/CVE-2026-64066/): netfs: Fix netfs_read_to_pagecache() to pause on subreq failure (critical 9.8)
- [CVE-2026-64065](https://insights.sbomify.com/CVE-2026-64065/): netfs: fix VM_BUG_ON_FOLIO() issue in netfs_write_begin() call (medium 5.5)
- [CVE-2026-64064](https://insights.sbomify.com/CVE-2026-64064/): netfs: Fix netfs_invalidate_folio() to clear dirty bit if all changes gone (medium 5.5)
- [CVE-2026-64063](https://insights.sbomify.com/CVE-2026-64063/): netfs: Fix streaming write being overwritten (high 7.8)
- [CVE-2026-64062](https://insights.sbomify.com/CVE-2026-64062/): netfs: Fix potential deadlock in write-through mode (medium 5.5)
- [CVE-2026-64061](https://insights.sbomify.com/CVE-2026-64061/): netfs: Fix early put of sink folio in netfs_read_gaps() (critical 9.8)
- [CVE-2026-64060](https://insights.sbomify.com/CVE-2026-64060/): netfs: Fix leak of request in netfs_write_begin() error handling (medium 5.5)
- [CVE-2026-6406](https://insights.sbomify.com/CVE-2026-6406/): Docker Desktop Enhanced Container Isolation bypass via --use-api-socket CLI flag (high 8.8)
- [CVE-2026-64059](https://insights.sbomify.com/CVE-2026-64059/): netfs: Fix folio->private handling in netfs_perform_write() (medium 5.5)
- [CVE-2026-64058](https://insights.sbomify.com/CVE-2026-64058/): netfs: Fix netfs_read_folio() to wait on writeback (high 7.8)
- [CVE-2026-64057](https://insights.sbomify.com/CVE-2026-64057/): afs: Fix the locking used by afs_get_link() (high 7.8)
- [CVE-2026-64056](https://insights.sbomify.com/CVE-2026-64056/): net: ethernet: cortina: Make RX SKB per-port (critical 9.8)
- [CVE-2026-64055](https://insights.sbomify.com/CVE-2026-64055/): net: ethernet: cortina: Carry over frag counter (critical 9.8)
- [CVE-2026-64054](https://insights.sbomify.com/CVE-2026-64054/): net: shaper: reject duplicate leaves in GROUP request (high 7.8)
- [CVE-2026-64053](https://insights.sbomify.com/CVE-2026-64053/): block: don't overwrite bip_vcnt in bio_integrity_copy_user() (high 7.8)
- [CVE-2026-64052](https://insights.sbomify.com/CVE-2026-64052/): block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() (medium 5.5)
- [CVE-2026-64051](https://insights.sbomify.com/CVE-2026-64051/): accel/qaic: Add overflow check to remap_pfn_range during mmap (high 7.8)
- [CVE-2026-64050](https://insights.sbomify.com/CVE-2026-64050/): drm/msm/dpu: don't mix devm and drmm functions (high 7.8)
- [CVE-2026-6405](https://insights.sbomify.com/CVE-2026-6405/): Anomify AI <= 0.3.6 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-64049](https://insights.sbomify.com/CVE-2026-64049/): drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx (medium 5.5)
- [CVE-2026-64048](https://insights.sbomify.com/CVE-2026-64048/): net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (high 7.5)
- [CVE-2026-64047](https://insights.sbomify.com/CVE-2026-64047/): net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (critical 9.8)
- [CVE-2026-64046](https://insights.sbomify.com/CVE-2026-64046/): net: tls: prevent chain-after-chain in plain text SG (critical 9.8)
- [CVE-2026-64045](https://insights.sbomify.com/CVE-2026-64045/): ovpn: tcp - use cached peer pointer in ovpn_tcp_close() (high 8.4)
- [CVE-2026-64044](https://insights.sbomify.com/CVE-2026-64044/): ovpn: respect peer refcount in CMD_NEW_PEER error path (high 7.8)
- [CVE-2026-64043](https://insights.sbomify.com/CVE-2026-64043/): ovpn: fix race between deleting interface and adding new peer (medium 4.7)
- [CVE-2026-64042](https://insights.sbomify.com/CVE-2026-64042/): vfio/pci: Check BAR resources before exporting a DMABUF (high 8.8)
- [CVE-2026-64041](https://insights.sbomify.com/CVE-2026-64041/): ASoC: codecs: fs210x: fix possible buffer overflow (high 7.8)
- [CVE-2026-64040](https://insights.sbomify.com/CVE-2026-64040/): cachefiles: Fix error return when vfs_mkdir() fails (medium 5.5)
- [CVE-2026-6404](https://insights.sbomify.com/CVE-2026-6404/): Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter (medium 4.4)
- [CVE-2026-64039](https://insights.sbomify.com/CVE-2026-64039/): drm/msm/snapshot: fix dumping of the unaligned regions (high 7.7)
- [CVE-2026-64038](https://insights.sbomify.com/CVE-2026-64038/): hwmon: (lm90) Stop work before releasing hwmon device (medium 4.7)
- [CVE-2026-64037](https://insights.sbomify.com/CVE-2026-64037/): wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (critical 9.8)
- [CVE-2026-64036](https://insights.sbomify.com/CVE-2026-64036/): cgroup/rstat: validate cpu before css_rstat_cpu() access (high 7.8)
- [CVE-2026-64035](https://insights.sbomify.com/CVE-2026-64035/): igc: set tx buffer type for SMD frames (critical 9.8)
- [CVE-2026-64034](https://insights.sbomify.com/CVE-2026-64034/): net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (critical 9.3)
- [CVE-2026-64033](https://insights.sbomify.com/CVE-2026-64033/): RDMA/rtrs: Fix use-after-free in path file creation cleanup (critical 9.8)
- [CVE-2026-64032](https://insights.sbomify.com/CVE-2026-64032/): bridge: mcast: Fix a possible use-after-free when removing a bridge port (high 7.8)
- [CVE-2026-64031](https://insights.sbomify.com/CVE-2026-64031/): erofs: fix managed cache race for unaligned extents (high 7.8)
- [CVE-2026-64030](https://insights.sbomify.com/CVE-2026-64030/): wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (high 8.8)
- [CVE-2026-6403](https://insights.sbomify.com/CVE-2026-6403/): Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter (high 7.5)
- [CVE-2026-64029](https://insights.sbomify.com/CVE-2026-64029/): ALSA: seq: Serialize UMP output teardown with event_input (high 7.8)
- [CVE-2026-64028](https://insights.sbomify.com/CVE-2026-64028/): tracing: Avoid NULL return from hist_field_name() on truncation (medium 5.5)
- [CVE-2026-64027](https://insights.sbomify.com/CVE-2026-64027/): net: shaper: rework the VALID marking (again) (high 7.8)
- [CVE-2026-64026](https://insights.sbomify.com/CVE-2026-64026/): rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (high 7.8)
- [CVE-2026-64025](https://insights.sbomify.com/CVE-2026-64025/): bpf, skmsg: fix verdict sk_data_ready racing with ktls rx (critical 9.8)
- [CVE-2026-64024](https://insights.sbomify.com/CVE-2026-64024/): tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (critical 9.4)
- [CVE-2026-64023](https://insights.sbomify.com/CVE-2026-64023/): gpio: aggregator: fix a potential use-after-free (high 7.8)
- [CVE-2026-64022](https://insights.sbomify.com/CVE-2026-64022/): gpio: aggregator: remove the software node when deactivating the aggregator (medium 5.5)
- [CVE-2026-64021](https://insights.sbomify.com/CVE-2026-64021/): drm/xe/oa: Fix exec_queue leak on width check in stream open (medium 5.5)
- [CVE-2026-64020](https://insights.sbomify.com/CVE-2026-64020/): nvme-pci: fix dma_vecs leak on p2p memory (high 7.5)
- [CVE-2026-6402](https://insights.sbomify.com/CVE-2026-6402/): webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins (medium 5.3)
- [CVE-2026-64019](https://insights.sbomify.com/CVE-2026-64019/): nvme-pci: fix dma mapping leak on data setup error (medium 5.5)
- [CVE-2026-64018](https://insights.sbomify.com/CVE-2026-64018/): net: mana: validate rx_req_idx to prevent out-of-bounds array access (critical 9.3)
- [CVE-2026-64017](https://insights.sbomify.com/CVE-2026-64017/): blk-mq: pop cached request if it is usable (high 7.8)
- [CVE-2026-64016](https://insights.sbomify.com/CVE-2026-64016/): ksmbd: fix durable reconnect error path file lifetime (critical 9.8)
- [CVE-2026-64015](https://insights.sbomify.com/CVE-2026-64015/): security/keys: fix missed RCU read section on lookup (high 7.8)
- [CVE-2026-64014](https://insights.sbomify.com/CVE-2026-64014/): Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size (high 7.1)
- [CVE-2026-64013](https://insights.sbomify.com/CVE-2026-64013/): ACPI: button: Fix ACPI GPE handler leak during removal (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/474/