# Vulnerabilities published in 2026


- [CVE-2026-63920](https://insights.sbomify.com/CVE-2026-63920/): ipv6: validate extension header length before copying to cmsg (high 7.1)
- [CVE-2026-6392](https://insights.sbomify.com/CVE-2026-6392/): Tanium addressed an information disclosure vulnerability in Threat Response. (low 2.7)
- [CVE-2026-63919](https://insights.sbomify.com/CVE-2026-63919/): xfrm: input: hold netns during deferred transport reinjection (high 8.8)
- [CVE-2026-63918](https://insights.sbomify.com/CVE-2026-63918/): l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (high 7.8)
- [CVE-2026-63917](https://insights.sbomify.com/CVE-2026-63917/): ip6: vti: Use ip6_tnl.net in vti6_changelink(). (high 8.8)
- [CVE-2026-63916](https://insights.sbomify.com/CVE-2026-63916/): HID: wacom: Fix OOB write in wacom_hid_set_device_mode() (high 8.8)
- [CVE-2026-63915](https://insights.sbomify.com/CVE-2026-63915/): nfc: hci: fix out-of-bounds read in HCP header parsing (high 8.8)
- [CVE-2026-63914](https://insights.sbomify.com/CVE-2026-63914/): xfrm: route MIGRATE notifications to caller's netns (high 7.3)
- [CVE-2026-63913](https://insights.sbomify.com/CVE-2026-63913/): netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (high 8.2)
- [CVE-2026-63912](https://insights.sbomify.com/CVE-2026-63912/): xfrm: esp: restore combined single-frag length gate (critical 9.8)
- [CVE-2026-63911](https://insights.sbomify.com/CVE-2026-63911/): xfrm: iptfs: reset runtime state when cloning SAs (high 7.8)
- [CVE-2026-63910](https://insights.sbomify.com/CVE-2026-63910/): dma-buf: fix UAF in dma_buf_fd() tracepoint (high 7.8)
- [CVE-2026-6391](https://insights.sbomify.com/CVE-2026-6391/): Cross-site request forgery in Sentence To SEO (keywords, description and tags) (medium 6.1)
- [CVE-2026-63909](https://insights.sbomify.com/CVE-2026-63909/): ksmbd: OOB read regression in smb_check_perm_dacl() ACE-walk loops (high 8.1)
- [CVE-2026-63908](https://insights.sbomify.com/CVE-2026-63908/): Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem (not scored)
- [CVE-2026-63907](https://insights.sbomify.com/CVE-2026-63907/): uio: uio_pci_generic_sva: fix double free of devm_kzalloc() memory (not scored)
- [CVE-2026-63906](https://insights.sbomify.com/CVE-2026-63906/): usb: musb: omap2430: Fix use-after-free in omap2430_probe() (high 8.4)
- [CVE-2026-63905](https://insights.sbomify.com/CVE-2026-63905/): usbip: vudc: Fix use after free bug in vudc_remove due to race condition (not scored)
- [CVE-2026-63904](https://insights.sbomify.com/CVE-2026-63904/): usb: usbtmc: check URB actual_length for interrupt-IN notifications (not scored)
- [CVE-2026-63903](https://insights.sbomify.com/CVE-2026-63903/): USB: serial: belkin_sa: validate interrupt status length (not scored)
- [CVE-2026-63902](https://insights.sbomify.com/CVE-2026-63902/): USB: serial: cypress_m8: validate interrupt packet headers (not scored)
- [CVE-2026-63901](https://insights.sbomify.com/CVE-2026-63901/): USB: serial: digi_acceleport: fix memory corruption with small endpoints (not scored)
- [CVE-2026-63900](https://insights.sbomify.com/CVE-2026-63900/): USB: serial: keyspan: fix missing indat transfer sanity check (not scored)
- [CVE-2026-6390](https://insights.sbomify.com/CVE-2026-6390/): Memory corruption in Red Hat Enterprise Linux 10 (medium 6.8)
- [CVE-2026-63899](https://insights.sbomify.com/CVE-2026-63899/): USB: serial: mxuport: fix memory corruption with small endpoint (not scored)
- [CVE-2026-63898](https://insights.sbomify.com/CVE-2026-63898/): USB: serial: mct_u232: fix memory corruption with small endpoint (not scored)
- [CVE-2026-63897](https://insights.sbomify.com/CVE-2026-63897/): USB: serial: mct_u232: fix missing interrupt-in transfer sanity check (not scored)
- [CVE-2026-63896](https://insights.sbomify.com/CVE-2026-63896/): usb: gadget: composite: fix integer underflow in WebUSB GET_URL handling (not scored)
- [CVE-2026-63895](https://insights.sbomify.com/CVE-2026-63895/): usb: gadget: f_fs: copy only received bytes on short ep0 read (not scored)
- [CVE-2026-63894](https://insights.sbomify.com/CVE-2026-63894/): usb: gadget: f_fs: serialize DMABUF cancel against request completion (high 7.8)
- [CVE-2026-63893](https://insights.sbomify.com/CVE-2026-63893/): thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() (high 8.1)
- [CVE-2026-63892](https://insights.sbomify.com/CVE-2026-63892/): thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow (not scored)
- [CVE-2026-63891](https://insights.sbomify.com/CVE-2026-63891/): thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() (not scored)
- [CVE-2026-63890](https://insights.sbomify.com/CVE-2026-63890/): scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (not scored)
- [CVE-2026-6389](https://insights.sbomify.com/CVE-2026-6389/): Misconfiguration in Turbonomic prometurbo agent (high 8.8)
- [CVE-2026-63889](https://insights.sbomify.com/CVE-2026-63889/): scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (high 8.1)
- [CVE-2026-63888](https://insights.sbomify.com/CVE-2026-63888/): scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (critical 9.8)
- [CVE-2026-63887](https://insights.sbomify.com/CVE-2026-63887/): scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (critical 9.8)
- [CVE-2026-63886](https://insights.sbomify.com/CVE-2026-63886/): scsi: target: iscsi: Validate CHAP_R length before base64 decode (critical 9.8)
- [CVE-2026-63885](https://insights.sbomify.com/CVE-2026-63885/): drm/gem: fix race between change_handle and handle_delete (high 8.8)
- [CVE-2026-63884](https://insights.sbomify.com/CVE-2026-63884/): drm/i915: Fix potential UAF in TTM object purge (high 7.8)
- [CVE-2026-63883](https://insights.sbomify.com/CVE-2026-63883/): serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ (high 7.3)
- [CVE-2026-63882](https://insights.sbomify.com/CVE-2026-63882/): drm/amdkfd: fix NULL pointer bug in svm_range_set_attr (not scored)
- [CVE-2026-63881](https://insights.sbomify.com/CVE-2026-63881/): drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger (high 7.8)
- [CVE-2026-63880](https://insights.sbomify.com/CVE-2026-63880/): drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO (not scored)
- [CVE-2026-6388](https://insights.sbomify.com/CVE-2026-6388/): Argocd-image-updater: argocd image updater: cross-namespace privilege escalation via insufficient namespace validation (critical 9.1)
- [CVE-2026-63879](https://insights.sbomify.com/CVE-2026-63879/): drm/amdgpu: fix amdgpu_hmm_range_get_pages (high 7.8)
- [CVE-2026-63878](https://insights.sbomify.com/CVE-2026-63878/): drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO (not scored)
- [CVE-2026-63877](https://insights.sbomify.com/CVE-2026-63877/): serial: dz: Convert to use a platform device (not scored)
- [CVE-2026-63876](https://insights.sbomify.com/CVE-2026-63876/): serial: zs: Convert to use a platform device (not scored)
- [CVE-2026-63875](https://insights.sbomify.com/CVE-2026-63875/): arm64: tlb: Flush walk cache when unsharing PMD tables (high 7.8)
- [CVE-2026-63874](https://insights.sbomify.com/CVE-2026-63874/): net: mctp: usb: fix race between urb completion and rx_retry cancellation (high 7.8)
- [CVE-2026-63873](https://insights.sbomify.com/CVE-2026-63873/): accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() (not scored)
- [CVE-2026-63871](https://insights.sbomify.com/CVE-2026-63871/): Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (not scored)
- [CVE-2026-63870](https://insights.sbomify.com/CVE-2026-63870/): ieee802154: 6lowpan: only accept IPv6 packets in lowpan_xmit() (high 7.8)
- [CVE-2026-6387](https://insights.sbomify.com/CVE-2026-6387/): Auth bypass in System Update (high 7.3)
- [CVE-2026-63869](https://insights.sbomify.com/CVE-2026-63869/): wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (high 7.6)
- [CVE-2026-63868](https://insights.sbomify.com/CVE-2026-63868/): net: garp: fix unsigned integer underflow in garp_pdu_parse_attr (medium 5.5)
- [CVE-2026-63867](https://insights.sbomify.com/CVE-2026-63867/): mptcp: close TOCTOU race while computing rcv_wnd (high 8.2)
- [CVE-2026-63866](https://insights.sbomify.com/CVE-2026-63866/): wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link() (high 8.8)
- [CVE-2026-63865](https://insights.sbomify.com/CVE-2026-63865/): bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks (high 8.8)
- [CVE-2026-63864](https://insights.sbomify.com/CVE-2026-63864/): bpf: Propagate error from visit_tailcall_insn (high 8.4)
- [CVE-2026-63863](https://insights.sbomify.com/CVE-2026-63863/): drm/gpusvm: Fix unbalanced unlock in drm_gpusvm_scan_mm() (high 8.8)
- [CVE-2026-63862](https://insights.sbomify.com/CVE-2026-63862/): PCI: mediatek-gen3: Prevent leaking IRQ domains when IRQ not found (medium 5.5)
- [CVE-2026-63861](https://insights.sbomify.com/CVE-2026-63861/): spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback (medium 5.5)
- [CVE-2026-63860](https://insights.sbomify.com/CVE-2026-63860/): RDMA/core: Prefer NLA_NUL_STRING (high 8.4)
- [CVE-2026-6386](https://insights.sbomify.com/CVE-2026-6386/): Missing large page handling in pmap_pkru_update_range() (medium 6.2)
- [CVE-2026-63859](https://insights.sbomify.com/CVE-2026-63859/): net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue() (medium 5.5)
- [CVE-2026-63858](https://insights.sbomify.com/CVE-2026-63858/): netfilter: nf_tables: add hook transactions for device deletions (high 7.8)
- [CVE-2026-63857](https://insights.sbomify.com/CVE-2026-63857/): net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() (critical 9.8)
- [CVE-2026-63856](https://insights.sbomify.com/CVE-2026-63856/): drm/amdgpu/vcn: set no_user_fence for VCN v2.0 enc/dec rings (high 7.8)
- [CVE-2026-63855](https://insights.sbomify.com/CVE-2026-63855/): drm/amdgpu/vcn: set no_user_fence for VCN v2.5 enc/dec rings (high 7.8)
- [CVE-2026-63854](https://insights.sbomify.com/CVE-2026-63854/): drm/amdgpu/vcn: set no_user_fence for VCN v3.0 enc/dec rings (high 7.8)
- [CVE-2026-63853](https://insights.sbomify.com/CVE-2026-63853/): drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring (high 7.8)
- [CVE-2026-63852](https://insights.sbomify.com/CVE-2026-63852/): drm/amdgpu/vcn: set no_user_fence for VCN v4.0.3 enc ring (high 7.8)
- [CVE-2026-63851](https://insights.sbomify.com/CVE-2026-63851/): drm/amdgpu/vcn: set no_user_fence for VCN v4.0.5 enc ring (high 7.8)
- [CVE-2026-63850](https://insights.sbomify.com/CVE-2026-63850/): drm/amdgpu/vcn: set no_user_fence for VCN v5.0.0 enc ring (high 7.8)
- [CVE-2026-6385](https://insights.sbomify.com/CVE-2026-6385/): Integer overflow in Lightspeed Core (medium 6.5)
- [CVE-2026-63849](https://insights.sbomify.com/CVE-2026-63849/): drm/amdgpu/vcn: set no_user_fence for VCN v5.0.1 enc ring (high 7.8)
- [CVE-2026-63848](https://insights.sbomify.com/CVE-2026-63848/): drm/amdgpu/jpeg: set no_user_fence for JPEG v2.0 ring (high 7.8)
- [CVE-2026-63847](https://insights.sbomify.com/CVE-2026-63847/): drm/amdgpu/jpeg: set no_user_fence for JPEG v2.5 ring (high 7.8)
- [CVE-2026-63846](https://insights.sbomify.com/CVE-2026-63846/): drm/amdgpu/jpeg: set no_user_fence for JPEG v3.0 ring (high 7.8)
- [CVE-2026-63845](https://insights.sbomify.com/CVE-2026-63845/): drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring (high 7.8)
- [CVE-2026-63844](https://insights.sbomify.com/CVE-2026-63844/): drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.3 ring (high 7.8)
- [CVE-2026-63843](https://insights.sbomify.com/CVE-2026-63843/): drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0.5 ring (high 7.8)
- [CVE-2026-63842](https://insights.sbomify.com/CVE-2026-63842/): drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.0 ring (high 7.8)
- [CVE-2026-63841](https://insights.sbomify.com/CVE-2026-63841/): drm/amdgpu/jpeg: set no_user_fence for JPEG v5.0.1 ring (high 7.8)
- [CVE-2026-63840](https://insights.sbomify.com/CVE-2026-63840/): drm/amdgpu/jpeg: set no_user_fence for JPEG v5.3.0 ring (high 7.8)
- [CVE-2026-6384](https://insights.sbomify.com/CVE-2026-6384/): Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing (high 7.3)
- [CVE-2026-63839](https://insights.sbomify.com/CVE-2026-63839/): platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() (not scored)
- [CVE-2026-63838](https://insights.sbomify.com/CVE-2026-63838/): ASoC: rsnd: Fix potential out-of-bounds access of component_dais[] (not scored)
- [CVE-2026-63837](https://insights.sbomify.com/CVE-2026-63837/): net: ena: PHC: Check return code before setting timestamp output (not scored)
- [CVE-2026-63836](https://insights.sbomify.com/CVE-2026-63836/): batman-adv: tp_meter: avoid divide-by-zero for dec_cwnd (not scored)
- [CVE-2026-63835](https://insights.sbomify.com/CVE-2026-63835/): batman-adv: v: prevent OGM aggregation on disabled hardif (not scored)
- [CVE-2026-63834](https://insights.sbomify.com/CVE-2026-63834/): batman-adv: tp_meter: restrict number of unacked list entries (not scored)
- [CVE-2026-63833](https://insights.sbomify.com/CVE-2026-63833/): ntfs3: reject direct userspace writes to reserved $LX* xattrs (high 7.1)
- [CVE-2026-63832](https://insights.sbomify.com/CVE-2026-63832/): wifi: mt76: add wcid publish check in mt76_sta_add (high 8.8)
- [CVE-2026-63831](https://insights.sbomify.com/CVE-2026-63831/): mac802154: llsec: add skb_cow_data() before in-place crypto (high 8.8)
- [CVE-2026-63830](https://insights.sbomify.com/CVE-2026-63830/): net: skmsg: preserve sg.copy across SG transforms (critical 9.4)
- [CVE-2026-6383](https://insights.sbomify.com/CVE-2026-6383/): Kubevirt: kubevirt: unauthorized subresource access due to improper rbac evaluation (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/476/