# Vulnerabilities published in 2026


- [CVE-2026-46155](https://insights.sbomify.com/CVE-2026-46155/): smb/client: fix out-of-bounds read in smb2_compound_op() (critical 9.1)
- [CVE-2026-46154](https://insights.sbomify.com/CVE-2026-46154/): sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters (high 7.0)
- [CVE-2026-46153](https://insights.sbomify.com/CVE-2026-46153/): 8021q: delete cleared egress QoS mappings (medium 5.5)
- [CVE-2026-46152](https://insights.sbomify.com/CVE-2026-46152/): wifi: mac80211: drop stray 'static' from fast-RX rx_result (high 8.8)
- [CVE-2026-46151](https://insights.sbomify.com/CVE-2026-46151/): usb: usblp: fix heap leak in IEEE 1284 device ID via short response (medium 5.5)
- [CVE-2026-46150](https://insights.sbomify.com/CVE-2026-46150/): fanotify: fix false positive on permission events (high 7.1)
- [CVE-2026-4615](https://insights.sbomify.com/CVE-2026-4615/): SourceCodester Online Catering Reservation search.php sql injection (medium 6.9)
- [CVE-2026-46149](https://insights.sbomify.com/CVE-2026-46149/): scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (high 7.1)
- [CVE-2026-46148](https://insights.sbomify.com/CVE-2026-46148/): spi: microchip-core-qspi: control built-in cs manually (medium 5.5)
- [CVE-2026-46147](https://insights.sbomify.com/CVE-2026-46147/): KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu() (medium 5.5)
- [CVE-2026-46146](https://insights.sbomify.com/CVE-2026-46146/): ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() (medium 5.5)
- [CVE-2026-46145](https://insights.sbomify.com/CVE-2026-46145/): RDMA/mana: Validate rx_hash_key_len (high 7.8)
- [CVE-2026-46144](https://insights.sbomify.com/CVE-2026-46144/): RDMA/mana: Fix error unwind in mana_ib_create_qp_rss() (medium 5.5)
- [CVE-2026-46143](https://insights.sbomify.com/CVE-2026-46143/): ASoC: qcom: q6apm-lpass-dai: Fix multiple graph opens (medium 5.5)
- [CVE-2026-46142](https://insights.sbomify.com/CVE-2026-46142/): net: libwx: fix VF illegal register access (medium 5.5)
- [CVE-2026-46141](https://insights.sbomify.com/CVE-2026-46141/): powerpc/xive: fix kmemleak caused by incorrect chip_data lookup (medium 5.5)
- [CVE-2026-46140](https://insights.sbomify.com/CVE-2026-46140/): Bluetooth: btmtk: validate WMT event SKB length before struct access (high 7.1)
- [CVE-2026-4614](https://insights.sbomify.com/CVE-2026-4614/): itsourcecode sanitize or validate this input Parameter subjects.php sql injection (medium 5.3)
- [CVE-2026-46139](https://insights.sbomify.com/CVE-2026-46139/): smb: client: use kzalloc to zero-initialize security descriptor buffer (medium 5.5)
- [CVE-2026-46138](https://insights.sbomify.com/CVE-2026-46138/): Bluetooth: hci_event: Fix OOB read and infinite loop in hci_le_create_big_complete_evt (high 8.1)
- [CVE-2026-46137](https://insights.sbomify.com/CVE-2026-46137/): mptcp: pm: ADD_ADDR rtx: fix potential data-race (critical 9.8)
- [CVE-2026-46136](https://insights.sbomify.com/CVE-2026-46136/): wifi: mt76: mt7921: fix a potential clc buffer length underflow (high 7.8)
- [CVE-2026-46135](https://insights.sbomify.com/CVE-2026-46135/): nvmet-tcp: fix race between ICReq handling and queue teardown (critical 9.8)
- [CVE-2026-46134](https://insights.sbomify.com/CVE-2026-46134/): platform/chrome: cros_ec_typec: Init mutex in Thunderbolt registration (medium 5.5)
- [CVE-2026-46133](https://insights.sbomify.com/CVE-2026-46133/): RDMA/rxe: Reject unknown opcodes before ICRC processing (high 7.5)
- [CVE-2026-46132](https://insights.sbomify.com/CVE-2026-46132/): net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo (medium 5.5)
- [CVE-2026-46131](https://insights.sbomify.com/CVE-2026-46131/): KVM: x86: check for nEPT/nNPT in slow flush hypercalls (medium 5.5)
- [CVE-2026-46130](https://insights.sbomify.com/CVE-2026-46130/): dm-verity-fec: fix reading parity bytes split across blocks (take 3) (high 7.1)
- [CVE-2026-4613](https://insights.sbomify.com/CVE-2026-4613/): SourceCodester E-Commerce Site products.php sql injection (medium 6.9)
- [CVE-2026-46129](https://insights.sbomify.com/CVE-2026-46129/): btrfs: fix double free in create_space_info() error path (high 7.8)
- [CVE-2026-46128](https://insights.sbomify.com/CVE-2026-46128/): ipmi: Check event message buffer response for bad data (medium 5.5)
- [CVE-2026-46127](https://insights.sbomify.com/CVE-2026-46127/): RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp() (medium 5.5)
- [CVE-2026-46126](https://insights.sbomify.com/CVE-2026-46126/): RDMA/mana: Fix mana_destroy_wq_obj() cleanup in mana_ib_create_qp_rss() (medium 5.5)
- [CVE-2026-46125](https://insights.sbomify.com/CVE-2026-46125/): wifi: mac80211: remove station if connection prep fails (high 8.8)
- [CVE-2026-46124](https://insights.sbomify.com/CVE-2026-46124/): isofs: validate block number from NFS file handle in isofs_export_iget (high 7.5)
- [CVE-2026-46123](https://insights.sbomify.com/CVE-2026-46123/): Bluetooth: virtio_bt: clamp rx length before skb_put (high 7.7)
- [CVE-2026-46122](https://insights.sbomify.com/CVE-2026-46122/): wifi: b43: enforce bounds check on firmware key index in b43_rx() (high 7.8)
- [CVE-2026-46121](https://insights.sbomify.com/CVE-2026-46121/): mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock (high 7.8)
- [CVE-2026-46120](https://insights.sbomify.com/CVE-2026-46120/): ip6_gre: Use cached t->net in ip6erspan_changelink(). (high 7.8)
- [CVE-2026-4612](https://insights.sbomify.com/CVE-2026-4612/): itsourcecode Free Hotel Reservation System Parameter index.php sql injection (medium 6.9)
- [CVE-2026-46119](https://insights.sbomify.com/CVE-2026-46119/): libceph: Fix slab-out-of-bounds access in auth message processing (critical 9.1)
- [CVE-2026-46118](https://insights.sbomify.com/CVE-2026-46118/): pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() (medium 5.5)
- [CVE-2026-46117](https://insights.sbomify.com/CVE-2026-46117/): RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (high 7.8)
- [CVE-2026-46116](https://insights.sbomify.com/CVE-2026-46116/): xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (high 7.8)
- [CVE-2026-46115](https://insights.sbomify.com/CVE-2026-46115/): block: add pgmap check to biovec_phys_mergeable (critical 9.8)
- [CVE-2026-46114](https://insights.sbomify.com/CVE-2026-46114/): RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (high 7.5)
- [CVE-2026-46113](https://insights.sbomify.com/CVE-2026-46113/): KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (high 8.8)
- [CVE-2026-46112](https://insights.sbomify.com/CVE-2026-46112/): RDMA/hns: Fix unlocked call to hns_roce_qp_remove() (high 7.8)
- [CVE-2026-46111](https://insights.sbomify.com/CVE-2026-46111/): Bluetooth: hci_conn: fix potential UAF in create_big_sync (high 7.8)
- [CVE-2026-46110](https://insights.sbomify.com/CVE-2026-46110/): net: stmmac: Prevent NULL deref when RX memory exhausted (high 7.5)
- [CVE-2026-4611](https://insights.sbomify.com/CVE-2026-4611/): TOTOLINK X6000R shttpd setLanCfg privilege escalation (high 8.6)
- [CVE-2026-46109](https://insights.sbomify.com/CVE-2026-46109/): usb: ulpi: fix memory leak on ulpi_register() error paths (medium 5.5)
- [CVE-2026-46108](https://insights.sbomify.com/CVE-2026-46108/): ipmi:si: Return state to normal if message allocation fails (medium 5.5)
- [CVE-2026-46107](https://insights.sbomify.com/CVE-2026-46107/): dm-thin: fix metadata refcount underflow (high 7.8)
- [CVE-2026-46106](https://insights.sbomify.com/CVE-2026-46106/): eventfs: Hold eventfs_mutex and SRCU when remount walks events (medium 5.5)
- [CVE-2026-46105](https://insights.sbomify.com/CVE-2026-46105/): scsi: mpt3sas: Limit NVMe request size to 2 MiB (high 7.8)
- [CVE-2026-46104](https://insights.sbomify.com/CVE-2026-46104/): selinux: use sk blob accessor in socket permission helpers (medium 5.5)
- [CVE-2026-46103](https://insights.sbomify.com/CVE-2026-46103/): can: ucan: fix devres lifetime (medium 5.5)
- [CVE-2026-46102](https://insights.sbomify.com/CVE-2026-46102/): net: strparser: fix skb_head leak in strp_abort_strp() (high 7.5)
- [CVE-2026-46101](https://insights.sbomify.com/CVE-2026-46101/): netfilter: reject zero shift in nft_bitwise (medium 5.5)
- [CVE-2026-46100](https://insights.sbomify.com/CVE-2026-46100/): fs: afs: revert mmap_prepare() change (high 7.8)
- [CVE-2026-4610](https://insights.sbomify.com/CVE-2026-4610/): ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content (medium 6.4)
- [CVE-2026-46099](https://insights.sbomify.com/CVE-2026-46099/): net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (high 8.1)
- [CVE-2026-46098](https://insights.sbomify.com/CVE-2026-46098/): net: caif: clear client service pointer on teardown (medium 5.5)
- [CVE-2026-46097](https://insights.sbomify.com/CVE-2026-46097/): Input: edt-ft5x06 - fix use-after-free in debugfs teardown (high 7.8)
- [CVE-2026-46096](https://insights.sbomify.com/CVE-2026-46096/): tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public() (medium 5.5)
- [CVE-2026-46095](https://insights.sbomify.com/CVE-2026-46095/): md/md-llbitmap: raise barrier before state machine transition (medium 5.5)
- [CVE-2026-46094](https://insights.sbomify.com/CVE-2026-46094/): ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access (high 7.1)
- [CVE-2026-46093](https://insights.sbomify.com/CVE-2026-46093/): mm/vmalloc: take vmap_purge_lock in shrinker (high 7.8)
- [CVE-2026-46092](https://insights.sbomify.com/CVE-2026-46092/): wifi: rtw88: check for PCI upstream bridge existence (medium 5.5)
- [CVE-2026-46091](https://insights.sbomify.com/CVE-2026-46091/): media: rc: igorplugusb: heed coherency rules (medium 5.5)
- [CVE-2026-46090](https://insights.sbomify.com/CVE-2026-46090/): ALSA: aloop: Fix peer runtime UAF during format-change stop (high 7.8)
- [CVE-2026-4609](https://insights.sbomify.com/CVE-2026-4609/): ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining (high 7.1)
- [CVE-2026-46089](https://insights.sbomify.com/CVE-2026-46089/): zram: do not forget to endio for partial discard requests (medium 5.5)
- [CVE-2026-46088](https://insights.sbomify.com/CVE-2026-46088/): ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() (medium 5.5)
- [CVE-2026-46087](https://insights.sbomify.com/CVE-2026-46087/): mm/damon/stat: fix memory leak on damon_start() failure in damon_stat_start() (medium 5.5)
- [CVE-2026-46086](https://insights.sbomify.com/CVE-2026-46086/): net: bridge: use a stable FDB dst snapshot in RCU readers (medium 5.5)
- [CVE-2026-46085](https://insights.sbomify.com/CVE-2026-46085/): rxrpc: Fix rxkad crypto unalignment handling (high 7.5)
- [CVE-2026-46084](https://insights.sbomify.com/CVE-2026-46084/): RDMA/mana_ib: Disable RX steering on RSS QP destroy (high 7.8)
- [CVE-2026-46083](https://insights.sbomify.com/CVE-2026-46083/): spi: fix resource leaks on device setup failure (medium 5.5)
- [CVE-2026-46082](https://insights.sbomify.com/CVE-2026-46082/): KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 (medium 5.5)
- [CVE-2026-46081](https://insights.sbomify.com/CVE-2026-46081/): crypto: acomp - fix wrong pointer stored by acomp_save_req() (high 7.8)
- [CVE-2026-46080](https://insights.sbomify.com/CVE-2026-46080/): ocfs2: split transactions in dio completion to avoid credit exhaustion (medium 5.5)
- [CVE-2026-4608](https://insights.sbomify.com/CVE-2026-4608/): ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter (medium 6.5)
- [CVE-2026-46079](https://insights.sbomify.com/CVE-2026-46079/): rbd: fix null-ptr-deref when device_add_disk() fails (medium 5.5)
- [CVE-2026-46078](https://insights.sbomify.com/CVE-2026-46078/): erofs: fix the out-of-bounds nameoff handling for trailing dirents (high 7.1)
- [CVE-2026-46077](https://insights.sbomify.com/CVE-2026-46077/): crypto: atmel-tdes - fix DMA sync direction (medium 5.5)
- [CVE-2026-46076](https://insights.sbomify.com/CVE-2026-46076/): KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (high 7.9)
- [CVE-2026-46075](https://insights.sbomify.com/CVE-2026-46075/): crypto: atmel-sha204a - Fix potential UAF and memory leak in remove path (high 7.8)
- [CVE-2026-46074](https://insights.sbomify.com/CVE-2026-46074/): spi: ch341: fix memory leaks on probe failures (medium 5.5)
- [CVE-2026-46073](https://insights.sbomify.com/CVE-2026-46073/): hwmon: (powerz) Fix missing usb_kill_urb() on signal interrupt (medium 5.5)
- [CVE-2026-46072](https://insights.sbomify.com/CVE-2026-46072/): ntfs3: add buffer boundary checks to run_unpack() (medium 5.5)
- [CVE-2026-46071](https://insights.sbomify.com/CVE-2026-46071/): KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 (medium 5.5)
- [CVE-2026-46070](https://insights.sbomify.com/CVE-2026-46070/): md/raid5: validate payload size before accessing journal metadata (high 7.1)
- [CVE-2026-4607](https://insights.sbomify.com/CVE-2026-4607/): ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification (medium 4.3)
- [CVE-2026-46069](https://insights.sbomify.com/CVE-2026-46069/): wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() (high 7.8)
- [CVE-2026-46068](https://insights.sbomify.com/CVE-2026-46068/): crypto: nx - fix bounce buffer leaks in nx842_crypto_{alloc,free}_ctx (high 7.8)
- [CVE-2026-46067](https://insights.sbomify.com/CVE-2026-46067/): mm/damon/core: validate damos_quota_goal->nid for node_memcg_{used,free}_bp (high 7.1)
- [CVE-2026-46066](https://insights.sbomify.com/CVE-2026-46066/): ceph: fix num_ops off-by-one when crypto allocation fails (medium 5.5)
- [CVE-2026-46065](https://insights.sbomify.com/CVE-2026-46065/): fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/615/