# Vulnerabilities published in 2026


- [CVE-2026-64012](https://insights.sbomify.com/CVE-2026-64012/): net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked (medium 5.5)
- [CVE-2026-64011](https://insights.sbomify.com/CVE-2026-64011/): nfc: llcp: Fix use-after-free in llcp_sock_release() (high 7.8)
- [CVE-2026-64010](https://insights.sbomify.com/CVE-2026-64010/): nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() (high 8.8)
- [CVE-2026-6401](https://insights.sbomify.com/CVE-2026-6401/): Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-64009](https://insights.sbomify.com/CVE-2026-64009/): xfrm: Check for underflow in xfrm_state_mtu (high 7.8)
- [CVE-2026-64008](https://insights.sbomify.com/CVE-2026-64008/): accel/rocket: fix UAF via dangling GEM handle in create_bo (high 7.8)
- [CVE-2026-64007](https://insights.sbomify.com/CVE-2026-64007/): netfilter: synproxy: refresh tcphdr after skb_ensure_writable (critical 9.8)
- [CVE-2026-64006](https://insights.sbomify.com/CVE-2026-64006/): netfilter: nf_tables: fix dst corruption in same register operation (medium 5.5)
- [CVE-2026-64005](https://insights.sbomify.com/CVE-2026-64005/): net/smc: Do not re-initialize smc hashtables (high 7.8)
- [CVE-2026-64004](https://insights.sbomify.com/CVE-2026-64004/): net/iucv: fix locking in .getsockopt (high 7.8)
- [CVE-2026-64003](https://insights.sbomify.com/CVE-2026-64003/): scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (high 7.5)
- [CVE-2026-64002](https://insights.sbomify.com/CVE-2026-64002/): ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (high 7.8)
- [CVE-2026-64001](https://insights.sbomify.com/CVE-2026-64001/): ALSA: pcm: oss: Fix setup list UAF on proc write error (high 7.8)
- [CVE-2026-64000](https://insights.sbomify.com/CVE-2026-64000/): net: hsr: fix potential OOB access in supervision frame handling (critical 9.8)
- [CVE-2026-6400](https://insights.sbomify.com/CVE-2026-6400/): Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form (medium 4.3)
- [CVE-2026-63999](https://insights.sbomify.com/CVE-2026-63999/): ethtool: rss: fix indir_table and hkey leak on get_rxfh failure (medium 5.5)
- [CVE-2026-63998](https://insights.sbomify.com/CVE-2026-63998/): ethtool: module: call ethnl_ops_complete() on module flash errors (medium 5.5)
- [CVE-2026-63997](https://insights.sbomify.com/CVE-2026-63997/): ethtool: module: avoid leaking a netdev ref on module flash errors (medium 5.5)
- [CVE-2026-63996](https://insights.sbomify.com/CVE-2026-63996/): ethtool: cmis: require exact CDB reply length (high 7.8)
- [CVE-2026-63995](https://insights.sbomify.com/CVE-2026-63995/): ethtool: cmis: validate start_cmd_payload_size from module (high 7.8)
- [CVE-2026-63994](https://insights.sbomify.com/CVE-2026-63994/): tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (critical 9.8)
- [CVE-2026-63993](https://insights.sbomify.com/CVE-2026-63993/): vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (critical 9.8)
- [CVE-2026-63992](https://insights.sbomify.com/CVE-2026-63992/): tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (critical 9.1)
- [CVE-2026-63991](https://insights.sbomify.com/CVE-2026-63991/): Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (medium 5.5)
- [CVE-2026-63990](https://insights.sbomify.com/CVE-2026-63990/): bonding: refuse to enslave CAN devices (medium 5.5)
- [CVE-2026-6399](https://insights.sbomify.com/CVE-2026-6399/): General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter (medium 4.4)
- [CVE-2026-63989](https://insights.sbomify.com/CVE-2026-63989/): bridge: Fix sleep in atomic context in netlink path (medium 5.5)
- [CVE-2026-63988](https://insights.sbomify.com/CVE-2026-63988/): bridge: Fix sleep in atomic context in sysfs path (medium 5.5)
- [CVE-2026-63987](https://insights.sbomify.com/CVE-2026-63987/): ethtool: coalesce: cap profile updates at NET_DIM_PARAMS_NUM_PROFILES (high 7.8)
- [CVE-2026-63986](https://insights.sbomify.com/CVE-2026-63986/): ethtool: tsinfo: don't pass ERR_PTR to genlmsg_cancel on prepare failure (medium 5.5)
- [CVE-2026-63985](https://insights.sbomify.com/CVE-2026-63985/): ethtool: eeprom: add more safeties to EEPROM Netlink fallback (high 7.8)
- [CVE-2026-63984](https://insights.sbomify.com/CVE-2026-63984/): ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (critical 9.8)
- [CVE-2026-63983](https://insights.sbomify.com/CVE-2026-63983/): net/sched: fix packet loop on netem when duplicate is on (not scored)
- [CVE-2026-63982](https://insights.sbomify.com/CVE-2026-63982/): net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop (not scored)
- [CVE-2026-63981](https://insights.sbomify.com/CVE-2026-63981/): net/sched: act_mirred: Fix blockcast recursion bypass leading to stack overflow (not scored)
- [CVE-2026-63980](https://insights.sbomify.com/CVE-2026-63980/): net/handshake: Use spin_lock_bh for hn_lock (high 7.5)
- [CVE-2026-63979](https://insights.sbomify.com/CVE-2026-63979/): net/handshake: hand off the pinned file reference to accept_doit (critical 9.8)
- [CVE-2026-63978](https://insights.sbomify.com/CVE-2026-63978/): net/handshake: Drain pending requests at net namespace exit (critical 9.8)
- [CVE-2026-63977](https://insights.sbomify.com/CVE-2026-63977/): dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (high 7.8)
- [CVE-2026-63976](https://insights.sbomify.com/CVE-2026-63976/): Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (high 8.8)
- [CVE-2026-63975](https://insights.sbomify.com/CVE-2026-63975/): Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (high 8.8)
- [CVE-2026-63974](https://insights.sbomify.com/CVE-2026-63974/): Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (high 8.8)
- [CVE-2026-63973](https://insights.sbomify.com/CVE-2026-63973/): net: mana: Add NULL guards in teardown path to prevent panic on attach failure (medium 5.5)
- [CVE-2026-63972](https://insights.sbomify.com/CVE-2026-63972/): net: mana: Skip redundant detach on already-detached port (high 7.5)
- [CVE-2026-63971](https://insights.sbomify.com/CVE-2026-63971/): sctp: fix race between sctp_wait_for_connect and peeloff (high 7.8)
- [CVE-2026-63970](https://insights.sbomify.com/CVE-2026-63970/): vsock/virtio: bind uarg before filling zerocopy skb (high 7.8)
- [CVE-2026-6397](https://insights.sbomify.com/CVE-2026-6397/): Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute (medium 6.4)
- [CVE-2026-63969](https://insights.sbomify.com/CVE-2026-63969/): ipv6: fix possible infinite loop in rt6_fill_node() (not scored)
- [CVE-2026-63968](https://insights.sbomify.com/CVE-2026-63968/): ipv6: fix possible infinite loop in fib6_select_path() (high 7.5)
- [CVE-2026-63967](https://insights.sbomify.com/CVE-2026-63967/): iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer (not scored)
- [CVE-2026-63966](https://insights.sbomify.com/CVE-2026-63966/): iio: imu: adis16550: fix stack leak in trigger handler (not scored)
- [CVE-2026-63965](https://insights.sbomify.com/CVE-2026-63965/): iio: pressure: bmp280: fix stack leak in bmp580 trigger handler (not scored)
- [CVE-2026-63964](https://insights.sbomify.com/CVE-2026-63964/): usb: typec: ucsi: ccg: reject firmware images without a ':' record header (not scored)
- [CVE-2026-63963](https://insights.sbomify.com/CVE-2026-63963/): usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (not scored)
- [CVE-2026-63962](https://insights.sbomify.com/CVE-2026-63962/): usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (not scored)
- [CVE-2026-63961](https://insights.sbomify.com/CVE-2026-63961/): usb: typec: altmodes/displayport: validate count before reading Status Update VDO (not scored)
- [CVE-2026-63960](https://insights.sbomify.com/CVE-2026-63960/): usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer() (not scored)
- [CVE-2026-6396](https://insights.sbomify.com/CVE-2026-6396/): Cross-site request forgery in Fast & Fancy Filter – 3F (medium 4.3)
- [CVE-2026-63959](https://insights.sbomify.com/CVE-2026-63959/): usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT (not scored)
- [CVE-2026-63958](https://insights.sbomify.com/CVE-2026-63958/): usb: typec: ucsi: validate connector number in ucsi_connector_change() (not scored)
- [CVE-2026-63957](https://insights.sbomify.com/CVE-2026-63957/): USB: serial: safe_serial: fix memory corruption with small endpoint (not scored)
- [CVE-2026-63956](https://insights.sbomify.com/CVE-2026-63956/): USB: serial: cypress_m8: fix memory corruption with small endpoint (not scored)
- [CVE-2026-63955](https://insights.sbomify.com/CVE-2026-63955/): mm/vmalloc: do not trigger BUG() on BH disabled context (high 7.5)
- [CVE-2026-63954](https://insights.sbomify.com/CVE-2026-63954/): hpfs: fix a crash if hpfs_map_dnode_bitmap fails (high 7.8)
- [CVE-2026-63953](https://insights.sbomify.com/CVE-2026-63953/): mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page (not scored)
- [CVE-2026-63952](https://insights.sbomify.com/CVE-2026-63952/): memfd: deny writeable mappings when implying SEAL_WRITE (high 8.4)
- [CVE-2026-63951](https://insights.sbomify.com/CVE-2026-63951/): zram: fix use-after-free in zram_writeback_endio (high 7.8)
- [CVE-2026-63950](https://insights.sbomify.com/CVE-2026-63950/): mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one (high 7.8)
- [CVE-2026-6395](https://insights.sbomify.com/CVE-2026-6395/): Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page (medium 6.1)
- [CVE-2026-63949](https://insights.sbomify.com/CVE-2026-63949/): auxdisplay: line-display: fix OOB read on zero-length message_store() (not scored)
- [CVE-2026-63948](https://insights.sbomify.com/CVE-2026-63948/): Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (not scored)
- [CVE-2026-63947](https://insights.sbomify.com/CVE-2026-63947/): Bluetooth: HIDP: fix missing length checks in hidp_input_report() (high 8.8)
- [CVE-2026-63946](https://insights.sbomify.com/CVE-2026-63946/): Bluetooth: ISO: fix UAF in iso_recv_frame (high 8.8)
- [CVE-2026-63945](https://insights.sbomify.com/CVE-2026-63945/): Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (high 7.8)
- [CVE-2026-63944](https://insights.sbomify.com/CVE-2026-63944/): Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (high 8.8)
- [CVE-2026-63943](https://insights.sbomify.com/CVE-2026-63943/): Input: xpad - fix out-of-bounds access for Share button (not scored)
- [CVE-2026-63942](https://insights.sbomify.com/CVE-2026-63942/): parport: Fix race between port and client registration (high 7.8)
- [CVE-2026-63941](https://insights.sbomify.com/CVE-2026-63941/): KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor (high 8.8)
- [CVE-2026-63940](https://insights.sbomify.com/CVE-2026-63940/): KVM: SEV: Ignore Port I/O requests of length '0' (critical 9.3)
- [CVE-2026-6394](https://insights.sbomify.com/CVE-2026-6394/): Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter (medium 5.4)
- [CVE-2026-63939](https://insights.sbomify.com/CVE-2026-63939/): KVM: SEV: Compute the correct max length of the in-GHCB scratch area (critical 9.3)
- [CVE-2026-63938](https://insights.sbomify.com/CVE-2026-63938/): KVM: SEV: Check PSC request indices against the actual size of the buffer (critical 9.3)
- [CVE-2026-63937](https://insights.sbomify.com/CVE-2026-63937/): KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (high 8.8)
- [CVE-2026-63936](https://insights.sbomify.com/CVE-2026-63936/): iio: adc: mt6359: fix unchecked return value in mt6358_read_imp (not scored)
- [CVE-2026-63935](https://insights.sbomify.com/CVE-2026-63935/): iio: adc: nxp-sar-adc: fix division by zero in write_raw (not scored)
- [CVE-2026-63934](https://insights.sbomify.com/CVE-2026-63934/): iio: gyro: itg3200: fix i2c read into the wrong stack location (not scored)
- [CVE-2026-63933](https://insights.sbomify.com/CVE-2026-63933/): iio: gyro: adis16260: fix division by zero in write_raw (not scored)
- [CVE-2026-63932](https://insights.sbomify.com/CVE-2026-63932/): iio: chemical: mhz19b: reject oversized serial replies (not scored)
- [CVE-2026-63931](https://insights.sbomify.com/CVE-2026-63931/): iio: chemical: scd30: fix division by zero in write_raw (not scored)
- [CVE-2026-63930](https://insights.sbomify.com/CVE-2026-63930/): iio: buffer: hw-consumer: fix use-after-free in error path (high 7.8)
- [CVE-2026-6393](https://insights.sbomify.com/CVE-2026-6393/): BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage (medium 4.3)
- [CVE-2026-63929](https://insights.sbomify.com/CVE-2026-63929/): iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (not scored)
- [CVE-2026-63928](https://insights.sbomify.com/CVE-2026-63928/): USB: serial: omninet: fix memory corruption with small endpoint (not scored)
- [CVE-2026-63927](https://insights.sbomify.com/CVE-2026-63927/): usb: dwc2: Fix use after free in debug code (high 7.8)
- [CVE-2026-63926](https://insights.sbomify.com/CVE-2026-63926/): bpf: sockmap: fix tail fragment offset in bpf_msg_push_data (high 8.4)
- [CVE-2026-63925](https://insights.sbomify.com/CVE-2026-63925/): macsec: fix replay protection at XPN lower-PN wrap (high 8.1)
- [CVE-2026-63924](https://insights.sbomify.com/CVE-2026-63924/): ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (critical 9.8)
- [CVE-2026-63923](https://insights.sbomify.com/CVE-2026-63923/): octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (high 8.8)
- [CVE-2026-63922](https://insights.sbomify.com/CVE-2026-63922/): ipv6: exthdrs: refresh nh after handling HAO option (critical 9.8)
- [CVE-2026-63921](https://insights.sbomify.com/CVE-2026-63921/): ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/475/