# Vulnerabilities published in 2026


- [CVE-2026-43489](https://insights.sbomify.com/CVE-2026-43489/): liveupdate: luo_file: remember retrieve() status (medium 5.5)
- [CVE-2026-43488](https://insights.sbomify.com/CVE-2026-43488/): usb: xhci: Prevent interrupt storm on host controller error (HCE) (medium 5.5)
- [CVE-2026-43487](https://insights.sbomify.com/CVE-2026-43487/): ata: libata-core: Disable LPM on ST1000DM010-2EP102 (medium 5.5)
- [CVE-2026-43486](https://insights.sbomify.com/CVE-2026-43486/): arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults (medium 5.5)
- [CVE-2026-43485](https://insights.sbomify.com/CVE-2026-43485/): nouveau/gsp: drop WARN_ON in ACPI probes (medium 5.5)
- [CVE-2026-43484](https://insights.sbomify.com/CVE-2026-43484/): mmc: core: Avoid bitfield RMW for claim/retune flags (medium 5.5)
- [CVE-2026-43483](https://insights.sbomify.com/CVE-2026-43483/): KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (medium 5.5)
- [CVE-2026-43482](https://insights.sbomify.com/CVE-2026-43482/): sched_ext: Disable preemption between scx_claim_exit() and kicking helper work (medium 5.5)
- [CVE-2026-43481](https://insights.sbomify.com/CVE-2026-43481/): net-shapers: don't free reply skb after genlmsg_reply() (high 7.8)
- [CVE-2026-43480](https://insights.sbomify.com/CVE-2026-43480/): ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition (medium 5.5)
- [CVE-2026-4348](https://insights.sbomify.com/CVE-2026-4348/): BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter (high 7.5)
- [CVE-2026-43479](https://insights.sbomify.com/CVE-2026-43479/): net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect (medium 5.5)
- [CVE-2026-43478](https://insights.sbomify.com/CVE-2026-43478/): ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put (medium 5.5)
- [CVE-2026-43477](https://insights.sbomify.com/CVE-2026-43477/): drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL (medium 5.5)
- [CVE-2026-43476](https://insights.sbomify.com/CVE-2026-43476/): iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() (high 7.8)
- [CVE-2026-43475](https://insights.sbomify.com/CVE-2026-43475/): scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT (medium 5.5)
- [CVE-2026-43474](https://insights.sbomify.com/CVE-2026-43474/): fs: init flags_valid before calling vfs_fileattr_get (medium 5.5)
- [CVE-2026-43473](https://insights.sbomify.com/CVE-2026-43473/): scsi: mpi3mr: Add NULL checks when resetting request and reply queues (medium 5.5)
- [CVE-2026-43472](https://insights.sbomify.com/CVE-2026-43472/): unshare: fix unshare_fs() handling (medium 5.5)
- [CVE-2026-43471](https://insights.sbomify.com/CVE-2026-43471/): scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() (medium 5.5)
- [CVE-2026-43470](https://insights.sbomify.com/CVE-2026-43470/): nfs: return EISDIR on nfs3_proc_create if d_alias is a dir (medium 5.5)
- [CVE-2026-4347](https://insights.sbomify.com/CVE-2026-4347/): MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir (high 8.1)
- [CVE-2026-43469](https://insights.sbomify.com/CVE-2026-43469/): xprtrdma: Decrement re_receiving on the early exit paths (high 7.5)
- [CVE-2026-43468](https://insights.sbomify.com/CVE-2026-43468/): net/mlx5: Fix deadlock between devlink lock and esw->wq (medium 5.5)
- [CVE-2026-43467](https://insights.sbomify.com/CVE-2026-43467/): net/mlx5: Fix crash when moving to switchdev mode (medium 5.5)
- [CVE-2026-43466](https://insights.sbomify.com/CVE-2026-43466/): net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (high 8.2)
- [CVE-2026-43465](https://insights.sbomify.com/CVE-2026-43465/): net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (critical 9.8)
- [CVE-2026-43464](https://insights.sbomify.com/CVE-2026-43464/): net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (high 7.5)
- [CVE-2026-43463](https://insights.sbomify.com/CVE-2026-43463/): rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() (medium 5.5)
- [CVE-2026-43462](https://insights.sbomify.com/CVE-2026-43462/): net: spacemit: Fix error handling in emac_tx_mem_map() (high 7.5)
- [CVE-2026-43461](https://insights.sbomify.com/CVE-2026-43461/): spi: amlogic: spifc-a4: Fix DMA mapping error handling (high 7.8)
- [CVE-2026-43460](https://insights.sbomify.com/CVE-2026-43460/): spi: rockchip-sfc: Fix double-free in remove() callback (high 7.8)
- [CVE-2026-4346](https://insights.sbomify.com/CVE-2026-4346/): Cleartext Storage of Administrative and Wi-Fi Credentials via Accessible Serial Interface in TP Link's TL-WR850N (medium 5.1)
- [CVE-2026-43459](https://insights.sbomify.com/CVE-2026-43459/): ASoC: soc-core: flush delayed work before removing DAIs and widgets (high 7.3)
- [CVE-2026-43458](https://insights.sbomify.com/CVE-2026-43458/): serial: caif: hold tty->link reference in ldisc_open and ser_release (high 7.8)
- [CVE-2026-43457](https://insights.sbomify.com/CVE-2026-43457/): mctp: i2c: fix skb memory leak in receive path (medium 5.5)
- [CVE-2026-43456](https://insights.sbomify.com/CVE-2026-43456/): bonding: fix type confusion in bond_setup_by_slave() (high 7.8)
- [CVE-2026-43455](https://insights.sbomify.com/CVE-2026-43455/): mctp: route: hold key->lock in mctp_flow_prepare_output() (medium 5.5)
- [CVE-2026-43454](https://insights.sbomify.com/CVE-2026-43454/): netfilter: nf_tables: Fix for duplicate device in netdev hooks (high 7.8)
- [CVE-2026-43453](https://insights.sbomify.com/CVE-2026-43453/): netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (high 7.1)
- [CVE-2026-43452](https://insights.sbomify.com/CVE-2026-43452/): netfilter: x_tables: guard option walkers against 1-byte tail reads (high 8.2)
- [CVE-2026-43451](https://insights.sbomify.com/CVE-2026-43451/): netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (medium 5.5)
- [CVE-2026-43450](https://insights.sbomify.com/CVE-2026-43450/): netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (high 7.1)
- [CVE-2026-4345](https://insights.sbomify.com/CVE-2026-4345/): Stored Cross-Site Scripting (XSS) Vulnerability in Design Name (high 7.1)
- [CVE-2026-43449](https://insights.sbomify.com/CVE-2026-43449/): nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set (high 7.1)
- [CVE-2026-43448](https://insights.sbomify.com/CVE-2026-43448/): nvme-pci: Fix race bug in nvme_poll_irqdisable() (medium 4.7)
- [CVE-2026-43447](https://insights.sbomify.com/CVE-2026-43447/): iavf: fix PTP use-after-free during reset (high 7.8)
- [CVE-2026-43446](https://insights.sbomify.com/CVE-2026-43446/): accel/amdxdna: Fix runtime suspend deadlock when there is pending job (medium 5.5)
- [CVE-2026-43445](https://insights.sbomify.com/CVE-2026-43445/): e1000/e1000e: Fix leak in DMA error cleanup (medium 5.5)
- [CVE-2026-43444](https://insights.sbomify.com/CVE-2026-43444/): drm/amdkfd: Unreserve bo if queue update failed (medium 5.5)
- [CVE-2026-43443](https://insights.sbomify.com/CVE-2026-43443/): ASoC: amd: acp-mach-common: Add missing error check for clock acquisition (medium 5.5)
- [CVE-2026-43442](https://insights.sbomify.com/CVE-2026-43442/): io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops (high 7.1)
- [CVE-2026-43441](https://insights.sbomify.com/CVE-2026-43441/): net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled (high 7.5)
- [CVE-2026-43440](https://insights.sbomify.com/CVE-2026-43440/): net/mana: Null service_wq on setup error to prevent double destroy (high 7.8)
- [CVE-2026-4344](https://insights.sbomify.com/CVE-2026-4344/): Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Component Name (high 7.1)
- [CVE-2026-43439](https://insights.sbomify.com/CVE-2026-43439/): cgroup: fix race between task migration and iteration (medium 4.7)
- [CVE-2026-43438](https://insights.sbomify.com/CVE-2026-43438/): sched_ext: Remove redundant css_put() in scx_cgroup_init() (high 7.8)
- [CVE-2026-43437](https://insights.sbomify.com/CVE-2026-43437/): ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() (high 7.8)
- [CVE-2026-43436](https://insights.sbomify.com/CVE-2026-43436/): ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces (medium 5.5)
- [CVE-2026-43435](https://insights.sbomify.com/CVE-2026-43435/): rust_binder: fix oneway spam detection (medium 5.5)
- [CVE-2026-43434](https://insights.sbomify.com/CVE-2026-43434/): rust_binder: check ownership before using vma (high 7.8)
- [CVE-2026-43433](https://insights.sbomify.com/CVE-2026-43433/): rust_binder: avoid reading the written value in offsets array (high 7.8)
- [CVE-2026-43432](https://insights.sbomify.com/CVE-2026-43432/): usb: xhci: Fix memory leak in xhci_disable_slot() (medium 5.5)
- [CVE-2026-43431](https://insights.sbomify.com/CVE-2026-43431/): xhci: Fix NULL pointer dereference when reading portli debugfs files (medium 5.5)
- [CVE-2026-43430](https://insights.sbomify.com/CVE-2026-43430/): usb: yurex: fix race in probe (medium 4.7)
- [CVE-2026-43429](https://insights.sbomify.com/CVE-2026-43429/): USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (medium 5.5)
- [CVE-2026-43428](https://insights.sbomify.com/CVE-2026-43428/): USB: core: Limit the length of unkillable synchronous timeouts (medium 5.5)
- [CVE-2026-43427](https://insights.sbomify.com/CVE-2026-43427/): usb: class: cdc-wdm: fix reordering issue in read code path (high 7.1)
- [CVE-2026-43426](https://insights.sbomify.com/CVE-2026-43426/): usb: renesas_usbhs: fix use-after-free in ISR during device removal (high 7.8)
- [CVE-2026-43425](https://insights.sbomify.com/CVE-2026-43425/): usb: image: mdc800: kill download URB on timeout (medium 5.5)
- [CVE-2026-43424](https://insights.sbomify.com/CVE-2026-43424/): usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling (medium 5.5)
- [CVE-2026-43421](https://insights.sbomify.com/CVE-2026-43421/): usb: gadget: f_ncm: Fix net_device lifecycle with device_move (medium 5.5)
- [CVE-2026-43420](https://insights.sbomify.com/CVE-2026-43420/): ceph: fix i_nlink underrun during async unlink (medium 4.7)
- [CVE-2026-4342](https://insights.sbomify.com/CVE-2026-4342/): ingress-nginx comment-based nginx configuration injection (high 8.8)
- [CVE-2026-43419](https://insights.sbomify.com/CVE-2026-43419/): ceph: fix memory leaks in ceph_mdsc_build_path() (medium 5.5)
- [CVE-2026-43418](https://insights.sbomify.com/CVE-2026-43418/): sched/mmcid: Prevent CID stalls due to concurrent forks (medium 5.5)
- [CVE-2026-43417](https://insights.sbomify.com/CVE-2026-43417/): sched/mmcid: Handle vfork()/CLONE_VM correctly (medium 5.5)
- [CVE-2026-43416](https://insights.sbomify.com/CVE-2026-43416/): powerpc, perf: Check that current->mm is alive before getting user callchain (medium 5.5)
- [CVE-2026-43415](https://insights.sbomify.com/CVE-2026-43415/): scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend (medium 4.7)
- [CVE-2026-43414](https://insights.sbomify.com/CVE-2026-43414/): scsi: qla2xxx: Completely fix fcport double free (critical 9.8)
- [CVE-2026-43413](https://insights.sbomify.com/CVE-2026-43413/): scsi: hisi_sas: Fix NULL pointer exception during user_scan() (medium 5.5)
- [CVE-2026-43412](https://insights.sbomify.com/CVE-2026-43412/): ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start (medium 5.5)
- [CVE-2026-43411](https://insights.sbomify.com/CVE-2026-43411/): tipc: fix divide-by-zero in tipc_sk_filter_connect() (medium 5.5)
- [CVE-2026-43410](https://insights.sbomify.com/CVE-2026-43410/): firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled (medium 5.5)
- [CVE-2026-4341](https://insights.sbomify.com/CVE-2026-4341/): Prime Slider <= 4.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'follow_us_text' Parameter (medium 6.4)
- [CVE-2026-43409](https://insights.sbomify.com/CVE-2026-43409/): kprobes: avoid crash when rmmod/insmod after ftrace killed (medium 5.5)
- [CVE-2026-43408](https://insights.sbomify.com/CVE-2026-43408/): ceph: add a bunch of missing ceph_path_info initializers (high 7.8)
- [CVE-2026-43407](https://insights.sbomify.com/CVE-2026-43407/): libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() (critical 9.1)
- [CVE-2026-43406](https://insights.sbomify.com/CVE-2026-43406/): libceph: prevent potential out-of-bounds reads in process_message_header() (critical 9.1)
- [CVE-2026-43405](https://insights.sbomify.com/CVE-2026-43405/): libceph: Use u32 for non-negative values in ceph_monmap_decode() (high 7.5)
- [CVE-2026-43404](https://insights.sbomify.com/CVE-2026-43404/): mm: Fix a hmm_range_fault() livelock / starvation problem (medium 5.5)
- [CVE-2026-43403](https://insights.sbomify.com/CVE-2026-43403/): nsfs: tighten permission checks for ns iteration ioctls (high 8.8)
- [CVE-2026-43402](https://insights.sbomify.com/CVE-2026-43402/): kthread: consolidate kthread exit paths to prevent use-after-free (critical 9.8)
- [CVE-2026-43401](https://insights.sbomify.com/CVE-2026-43401/): cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() (medium 5.5)
- [CVE-2026-43400](https://insights.sbomify.com/CVE-2026-43400/): drm/amdgpu: add upper bound check on user inputs in signal ioctl (medium 5.5)
- [CVE-2026-43399](https://insights.sbomify.com/CVE-2026-43399/): drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl (medium 5.5)
- [CVE-2026-43398](https://insights.sbomify.com/CVE-2026-43398/): drm/amdgpu: add upper bound check on user inputs in wait ioctl (medium 5.5)
- [CVE-2026-43397](https://insights.sbomify.com/CVE-2026-43397/): drm/bridge: samsung-dsim: Fix memory leak in error path (medium 5.5)
- [CVE-2026-43396](https://insights.sbomify.com/CVE-2026-43396/): drm/xe/sync: Fix user fence leak on alloc failure (medium 5.5)
- [CVE-2026-43395](https://insights.sbomify.com/CVE-2026-43395/): drm/xe/sync: Cleanup partially initialized sync on parse failure (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/640/