# Vulnerabilities published in 2026


- [CVE-2026-53141](https://insights.sbomify.com/CVE-2026-53141/): drm/v3d: Fix global performance monitor reference counting (medium 5.5)
- [CVE-2026-53140](https://insights.sbomify.com/CVE-2026-53140/): drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups (medium 5.5)
- [CVE-2026-5314](https://insights.sbomify.com/CVE-2026-5314/): Nothings stb TTF File stb_truetype.h stbtt_InitFont_internal out-of-bounds (medium 5.3)
- [CVE-2026-53139](https://insights.sbomify.com/CVE-2026-53139/): drm/v3d: Skip CSD when it has zeroed workgroups (medium 5.5)
- [CVE-2026-53138](https://insights.sbomify.com/CVE-2026-53138/): drm/amd/display: Bound VBIOS record-chain walk loops (high 7.1)
- [CVE-2026-53137](https://insights.sbomify.com/CVE-2026-53137/): drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size (high 7.8)
- [CVE-2026-53136](https://insights.sbomify.com/CVE-2026-53136/): drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (high 7.8)
- [CVE-2026-53135](https://insights.sbomify.com/CVE-2026-53135/): drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs (medium 5.5)
- [CVE-2026-53134](https://insights.sbomify.com/CVE-2026-53134/): netfilter: nft_fib: fix stale stack leak via the OIFNAME register (medium 5.5)
- [CVE-2026-53133](https://insights.sbomify.com/CVE-2026-53133/): RDMA/umem: Fix truncation for block sizes >= 4G (high 7.8)
- [CVE-2026-53132](https://insights.sbomify.com/CVE-2026-53132/): vsock/virtio: fix potential unbounded skb queue (high 7.1)
- [CVE-2026-53131](https://insights.sbomify.com/CVE-2026-53131/): netfilter: require Ethernet MAC header before using eth_hdr() (critical 9.4)
- [CVE-2026-53130](https://insights.sbomify.com/CVE-2026-53130/): fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START (high 7.8)
- [CVE-2026-5313](https://insights.sbomify.com/CVE-2026-5313/): Nothings stb GIF Decoder stb_image.h stbi__gif_load_next denial of service (medium 5.3)
- [CVE-2026-53129](https://insights.sbomify.com/CVE-2026-53129/): fs/mbcache: cancel shrink work before destroying the cache (high 7.8)
- [CVE-2026-53128](https://insights.sbomify.com/CVE-2026-53128/): drbd: Balance RCU calls in drbd_adm_dump_devices() (medium 5.5)
- [CVE-2026-53127](https://insights.sbomify.com/CVE-2026-53127/): block: fix zones_cond memory leak on zone revalidation error paths (medium 5.5)
- [CVE-2026-53126](https://insights.sbomify.com/CVE-2026-53126/): blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() (medium 5.5)
- [CVE-2026-53125](https://insights.sbomify.com/CVE-2026-53125/): md: fix array_state=clear sysfs deadlock (medium 5.5)
- [CVE-2026-53124](https://insights.sbomify.com/CVE-2026-53124/): ublk: reset per-IO canceled flag on each fetch (medium 5.5)
- [CVE-2026-53123](https://insights.sbomify.com/CVE-2026-53123/): md: wake raid456 reshape waiters before suspend (medium 5.5)
- [CVE-2026-53122](https://insights.sbomify.com/CVE-2026-53122/): btrfs: fix deadlock between reflink and transaction commit when using flushoncommit (medium 5.5)
- [CVE-2026-53121](https://insights.sbomify.com/CVE-2026-53121/): amd-pstate: Fix memory leak in amd_pstate_epp_cpu_init() (medium 5.5)
- [CVE-2026-53120](https://insights.sbomify.com/CVE-2026-53120/): PCI: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-5312](https://insights.sbomify.com/CVE-2026-5312/): D-Link DNS-1550-04 dsk_mgr.cgi Get_current_raidtype access control (medium 6.9)
- [CVE-2026-53119](https://insights.sbomify.com/CVE-2026-53119/): platform/wmi: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-53118](https://insights.sbomify.com/CVE-2026-53118/): vdpa: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-53117](https://insights.sbomify.com/CVE-2026-53117/): s390/cio: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-53116](https://insights.sbomify.com/CVE-2026-53116/): s390/ap: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-53115](https://insights.sbomify.com/CVE-2026-53115/): bus: fsl-mc: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-53114](https://insights.sbomify.com/CVE-2026-53114/): perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (medium 5.5)
- [CVE-2026-53113](https://insights.sbomify.com/CVE-2026-53113/): wifi: ath11k: fix memory leaks in beacon template setup (medium 5.5)
- [CVE-2026-53112](https://insights.sbomify.com/CVE-2026-53112/): wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet (high 7.8)
- [CVE-2026-53111](https://insights.sbomify.com/CVE-2026-53111/): bpf: test_run: Fix the null pointer dereference issue in bpf_lwt_xmit_push_encap (medium 5.5)
- [CVE-2026-53110](https://insights.sbomify.com/CVE-2026-53110/): s390/bpf: Zero-extend bpf prog return values and kfunc arguments (high 7.8)
- [CVE-2026-5311](https://insights.sbomify.com/CVE-2026-5311/): D-Link DNS-1550-04 file_center.cgi Webdav_Access_List access control (medium 6.9)
- [CVE-2026-53109](https://insights.sbomify.com/CVE-2026-53109/): powerpc/pgtable-frag: Fix bad page state in pte_frag_destroy (high 7.8)
- [CVE-2026-53108](https://insights.sbomify.com/CVE-2026-53108/): powerpc/64s: Fix unmap race with PMD migration entries (medium 4.7)
- [CVE-2026-53107](https://insights.sbomify.com/CVE-2026-53107/): wifi: libertas: don't kill URBs in interrupt context (medium 5.5)
- [CVE-2026-53106](https://insights.sbomify.com/CVE-2026-53106/): bpf: Do not allow deleting local storage in NMI (medium 5.5)
- [CVE-2026-53105](https://insights.sbomify.com/CVE-2026-53105/): wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi (medium 5.5)
- [CVE-2026-53104](https://insights.sbomify.com/CVE-2026-53104/): wifi: mt76: Fix memory leak destroying device (medium 5.5)
- [CVE-2026-53103](https://insights.sbomify.com/CVE-2026-53103/): wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync (medium 5.5)
- [CVE-2026-53102](https://insights.sbomify.com/CVE-2026-53102/): wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() (medium 5.5)
- [CVE-2026-53101](https://insights.sbomify.com/CVE-2026-53101/): wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync (medium 5.5)
- [CVE-2026-53100](https://insights.sbomify.com/CVE-2026-53100/): wifi: mt76: fix deadlock in remain-on-channel (medium 5.5)
- [CVE-2026-5310](https://insights.sbomify.com/CVE-2026-5310/): Enter Software Iperius Backup IperiusAccounts.ini hard-coded key (low 2.0)
- [CVE-2026-53099](https://insights.sbomify.com/CVE-2026-53099/): bpf: Switch CONFIG_CFI_CLANG to CONFIG_CFI (medium 5.5)
- [CVE-2026-53098](https://insights.sbomify.com/CVE-2026-53098/): wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work() (high 7.8)
- [CVE-2026-53097](https://insights.sbomify.com/CVE-2026-53097/): wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work() (high 7.8)
- [CVE-2026-53096](https://insights.sbomify.com/CVE-2026-53096/): bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path (high 7.8)
- [CVE-2026-53095](https://insights.sbomify.com/CVE-2026-53095/): bpf: Fix abuse of kprobe_write_ctx via freplace (medium 5.5)
- [CVE-2026-53094](https://insights.sbomify.com/CVE-2026-53094/): bpf: Fix stale offload->prog pointer after constant blinding (high 7.8)
- [CVE-2026-53093](https://insights.sbomify.com/CVE-2026-53093/): wifi: brcmfmac: Fix error pointer dereference (medium 5.5)
- [CVE-2026-53092](https://insights.sbomify.com/CVE-2026-53092/): bpf: Fix linked reg delta tracking when src_reg == dst_reg (high 7.8)
- [CVE-2026-53091](https://insights.sbomify.com/CVE-2026-53091/): net: pull headers in qdisc_pkt_len_segs_init() (high 8.4)
- [CVE-2026-53090](https://insights.sbomify.com/CVE-2026-53090/): bpf: Fix ld_{abs,ind} failure path analysis in subprogs (high 7.8)
- [CVE-2026-5309](https://insights.sbomify.com/CVE-2026-5309/): Authorization Bypass Through User-Controlled Key in GitLab (medium 5.4)
- [CVE-2026-53089](https://insights.sbomify.com/CVE-2026-53089/): bpf: Fix use-after-free in offloaded map/prog info fill (high 7.8)
- [CVE-2026-53088](https://insights.sbomify.com/CVE-2026-53088/): net: bcmgenet: fix off-by-one in bcmgenet_put_txcb (critical 9.8)
- [CVE-2026-53087](https://insights.sbomify.com/CVE-2026-53087/): net: bcmgenet: fix leaking free_bds (high 7.5)
- [CVE-2026-53086](https://insights.sbomify.com/CVE-2026-53086/): net: bcmgenet: fix racing timeout handler (critical 9.8)
- [CVE-2026-53085](https://insights.sbomify.com/CVE-2026-53085/): bpf: fix mm lifecycle in open-coded task_vma iterator (high 7.8)
- [CVE-2026-53084](https://insights.sbomify.com/CVE-2026-53084/): bpf: return VMA snapshot from task_vma iterator (medium 5.5)
- [CVE-2026-53083](https://insights.sbomify.com/CVE-2026-53083/): bpf: Fix RCU stall in bpf_fd_array_map_clear() (medium 5.5)
- [CVE-2026-53082](https://insights.sbomify.com/CVE-2026-53082/): net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf (medium 5.5)
- [CVE-2026-53081](https://insights.sbomify.com/CVE-2026-53081/): bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars (high 7.8)
- [CVE-2026-53080](https://insights.sbomify.com/CVE-2026-53080/): net/sched: cls_fw: fix NULL dereference of "old" filters before change() (medium 5.5)
- [CVE-2026-5308](https://insights.sbomify.com/CVE-2026-5308/): Missing request body size limits on Zoom plugin HTTP endpoints (medium 4.9)
- [CVE-2026-53079](https://insights.sbomify.com/CVE-2026-53079/): net_sched: fix skb memory leak in deferred qdisc drops (medium 5.5)
- [CVE-2026-53078](https://insights.sbomify.com/CVE-2026-53078/): bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (high 7.8)
- [CVE-2026-53077](https://insights.sbomify.com/CVE-2026-53077/): net/rds: Restrict use of RDS/IB to the initial network namespace (high 7.8)
- [CVE-2026-53076](https://insights.sbomify.com/CVE-2026-53076/): bpf: Fix OOB in pcpu_init_value (high 7.1)
- [CVE-2026-53075](https://insights.sbomify.com/CVE-2026-53075/): ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (high 8.8)
- [CVE-2026-53074](https://insights.sbomify.com/CVE-2026-53074/): bpf: reject short IPv4/IPv6 inputs in bpf_prog_test_run_skb (medium 5.5)
- [CVE-2026-53073](https://insights.sbomify.com/CVE-2026-53073/): Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (medium 5.5)
- [CVE-2026-53072](https://insights.sbomify.com/CVE-2026-53072/): Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (high 8.8)
- [CVE-2026-53071](https://insights.sbomify.com/CVE-2026-53071/): Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (high 8.8)
- [CVE-2026-53070](https://insights.sbomify.com/CVE-2026-53070/): sctp: disable BH before calling udp_tunnel_xmit_skb() (high 7.5)
- [CVE-2026-53069](https://insights.sbomify.com/CVE-2026-53069/): net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master (high 7.5)
- [CVE-2026-53068](https://insights.sbomify.com/CVE-2026-53068/): drm/komeda: fix integer overflow in AFBC framebuffer size check (high 7.1)
- [CVE-2026-53067](https://insights.sbomify.com/CVE-2026-53067/): PCI: endpoint: pci-ep-msi: Fix error unwind and prevent double alloc (high 7.8)
- [CVE-2026-53066](https://insights.sbomify.com/CVE-2026-53066/): drm/sun4i: backend: fix error pointer dereference (medium 5.5)
- [CVE-2026-53065](https://insights.sbomify.com/CVE-2026-53065/): ASoC: sti: use managed regmap_field allocations (medium 5.5)
- [CVE-2026-53064](https://insights.sbomify.com/CVE-2026-53064/): dm cache: fix null-deref with concurrent writes in passthrough mode (medium 5.5)
- [CVE-2026-53063](https://insights.sbomify.com/CVE-2026-53063/): dm cache: fix write hang in passthrough mode (medium 5.5)
- [CVE-2026-53062](https://insights.sbomify.com/CVE-2026-53062/): dm cache policy smq: fix missing locks in invalidating cache blocks (high 7.8)
- [CVE-2026-53061](https://insights.sbomify.com/CVE-2026-53061/): dm cache: fix dirty mapping checking in passthrough mode switching (medium 5.5)
- [CVE-2026-53060](https://insights.sbomify.com/CVE-2026-53060/): dm cache metadata: fix memory leak on metadata abort retry (medium 5.5)
- [CVE-2026-5306](https://insights.sbomify.com/CVE-2026-5306/): Check & Log Email < 2.0.13 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2026-53059](https://insights.sbomify.com/CVE-2026-53059/): dm log: fix out-of-bounds write due to region_count overflow (high 7.8)
- [CVE-2026-53058](https://insights.sbomify.com/CVE-2026-53058/): drm/bridge: cadence: cdns-mhdp8546-core: Set the mhdp connector earlier in atomic_enable() (medium 5.5)
- [CVE-2026-53057](https://insights.sbomify.com/CVE-2026-53057/): iommu/riscv: Add IOTINVAL after updating DDT/PDT entries (high 8.8)
- [CVE-2026-53056](https://insights.sbomify.com/CVE-2026-53056/): drm/msm/dpu: fix mismatch between power and frequency (medium 5.5)
- [CVE-2026-53055](https://insights.sbomify.com/CVE-2026-53055/): crypto: hisilicon/sec2 - prevent req used-after-free for sec (critical 9.8)
- [CVE-2026-53054](https://insights.sbomify.com/CVE-2026-53054/): drm/msm: Fix VM_BIND UNMAP locking (high 7.8)
- [CVE-2026-53053](https://insights.sbomify.com/CVE-2026-53053/): iommu/amd: Fix clone_alias() to use the original device's devid (high 8.8)
- [CVE-2026-53052](https://insights.sbomify.com/CVE-2026-53052/): ASoC: qcom: qdsp6: topology: check widget type before accessing data (medium 5.5)
- [CVE-2026-53051](https://insights.sbomify.com/CVE-2026-53051/): PCI: tegra194: Fix CBB timeout caused by DBI access before core power-on (medium 5.5)
- [CVE-2026-53050](https://insights.sbomify.com/CVE-2026-53050/): quota: Fix race of dquot_scan_active() with quota deactivation (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/564/