# Vulnerabilities published in 2026


- [CVE-2026-43394](https://insights.sbomify.com/CVE-2026-43394/): nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit(). (medium 5.5)
- [CVE-2026-43393](https://insights.sbomify.com/CVE-2026-43393/): btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() (medium 5.5)
- [CVE-2026-43392](https://insights.sbomify.com/CVE-2026-43392/): sched_ext: Fix starvation of scx_enable() under fair-class saturation (medium 5.5)
- [CVE-2026-43391](https://insights.sbomify.com/CVE-2026-43391/): nsfs: tighten permission checks for handle opening (high 8.8)
- [CVE-2026-43390](https://insights.sbomify.com/CVE-2026-43390/): nstree: tighten permission checks for listing (medium 5.5)
- [CVE-2026-4339](https://insights.sbomify.com/CVE-2026-4339/): SSRF via unvalidated attachment URLs in Mattermost Agents plugin MCP server (medium 6.5)
- [CVE-2026-43389](https://insights.sbomify.com/CVE-2026-43389/): mm: memfd_luo: always dirty all folios (medium 5.5)
- [CVE-2026-43388](https://insights.sbomify.com/CVE-2026-43388/): mm/damon/core: clear walk_control on inactive context in damos_walk() (high 7.8)
- [CVE-2026-43387](https://insights.sbomify.com/CVE-2026-43387/): staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() (medium 5.5)
- [CVE-2026-43386](https://insights.sbomify.com/CVE-2026-43386/): staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie (high 7.1)
- [CVE-2026-43385](https://insights.sbomify.com/CVE-2026-43385/): net: Fix rcu_tasks stall in threaded busypoll (high 7.5)
- [CVE-2026-43384](https://insights.sbomify.com/CVE-2026-43384/): net/tcp-ao: Fix MAC comparison to be constant-time (critical 9.8)
- [CVE-2026-43383](https://insights.sbomify.com/CVE-2026-43383/): net/tcp-md5: Fix MAC comparison to be constant-time (critical 9.4)
- [CVE-2026-43382](https://insights.sbomify.com/CVE-2026-43382/): batman-adv: Avoid double-rtnl_lock ELP metric worker (medium 5.5)
- [CVE-2026-43381](https://insights.sbomify.com/CVE-2026-43381/): nouveau/dpcd: return EBUSY for aux xfer if the device is asleep (medium 5.5)
- [CVE-2026-43380](https://insights.sbomify.com/CVE-2026-43380/): hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read (high 7.8)
- [CVE-2026-4338](https://insights.sbomify.com/CVE-2026-4338/): ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure (high 7.5)
- [CVE-2026-43379](https://insights.sbomify.com/CVE-2026-43379/): ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() (critical 9.8)
- [CVE-2026-43378](https://insights.sbomify.com/CVE-2026-43378/): smb: server: fix use-after-free in smb2_open() (critical 9.8)
- [CVE-2026-43377](https://insights.sbomify.com/CVE-2026-43377/): ksmbd: Don't log keys in SMB3 signing and encryption key generation (high 8.1)
- [CVE-2026-43376](https://insights.sbomify.com/CVE-2026-43376/): ksmbd: fix use-after-free by using call_rcu() for oplock_info (critical 9.8)
- [CVE-2026-43375](https://insights.sbomify.com/CVE-2026-43375/): net: mctp: fix device leak on probe failure (medium 5.5)
- [CVE-2026-43374](https://insights.sbomify.com/CVE-2026-43374/): net: nexthop: fix percpu use-after-free in remove_nh_grp_entry (high 7.8)
- [CVE-2026-43373](https://insights.sbomify.com/CVE-2026-43373/): net: ncsi: fix skb leak in error paths (high 7.5)
- [CVE-2026-43372](https://insights.sbomify.com/CVE-2026-43372/): net: dsa: microchip: Fix error path in PTP IRQ setup (medium 5.5)
- [CVE-2026-43371](https://insights.sbomify.com/CVE-2026-43371/): net: macb: Shuffle the tx ring before enabling tx (medium 5.5)
- [CVE-2026-43370](https://insights.sbomify.com/CVE-2026-43370/): drm/amdgpu: Fix use-after-free race in VM acquire (high 7.8)
- [CVE-2026-4337](https://insights.sbomify.com/CVE-2026-4337/): Unrestricted Upload of File in PuMuKIT application (high 8.8)
- [CVE-2026-43369](https://insights.sbomify.com/CVE-2026-43369/): drm/amd: Fix NULL pointer dereference in device cleanup (medium 5.5)
- [CVE-2026-43368](https://insights.sbomify.com/CVE-2026-43368/): drm/i915: Fix potential overflow of shmem scatterlist length (high 7.8)
- [CVE-2026-43367](https://insights.sbomify.com/CVE-2026-43367/): drm/amd: Fix a few more NULL pointer dereference in device cleanup (medium 5.5)
- [CVE-2026-43366](https://insights.sbomify.com/CVE-2026-43366/): io_uring/kbuf: check if target buffer list is still legacy on recycle (high 7.8)
- [CVE-2026-43365](https://insights.sbomify.com/CVE-2026-43365/): xfs: fix undersized l_iclog_roundoff values (high 8.2)
- [CVE-2026-43364](https://insights.sbomify.com/CVE-2026-43364/): ublk: fix NULL pointer dereference in ublk_ctrl_set_size() (medium 5.5)
- [CVE-2026-43363](https://insights.sbomify.com/CVE-2026-43363/): x86/apic: Disable x2apic on resume if the kernel expects so (medium 5.5)
- [CVE-2026-43362](https://insights.sbomify.com/CVE-2026-43362/): smb: client: fix in-place encryption corruption in SMB2_write() (high 8.1)
- [CVE-2026-43361](https://insights.sbomify.com/CVE-2026-43361/): btrfs: fix transaction abort when snapshotting received subvolumes (medium 5.5)
- [CVE-2026-43360](https://insights.sbomify.com/CVE-2026-43360/): btrfs: fix transaction abort on file creation due to name hash collision (medium 5.5)
- [CVE-2026-4336](https://insights.sbomify.com/CVE-2026-4336/): Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Content (medium 6.4)
- [CVE-2026-43359](https://insights.sbomify.com/CVE-2026-43359/): btrfs: fix transaction abort on set received ioctl due to item overflow (medium 5.5)
- [CVE-2026-43358](https://insights.sbomify.com/CVE-2026-43358/): btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() (medium 5.5)
- [CVE-2026-43357](https://insights.sbomify.com/CVE-2026-43357/): iio: gyro: mpu3050-core: fix pm_runtime error handling (medium 5.5)
- [CVE-2026-43356](https://insights.sbomify.com/CVE-2026-43356/): iio: imu: adis: Fix NULL pointer dereference in adis_init (medium 5.5)
- [CVE-2026-43355](https://insights.sbomify.com/CVE-2026-43355/): iio: light: bh1780: fix PM runtime leak on error path (medium 5.5)
- [CVE-2026-43354](https://insights.sbomify.com/CVE-2026-43354/): iio: proximity: hx9023s: Protect against division by zero in set_samp_freq (medium 5.5)
- [CVE-2026-43353](https://insights.sbomify.com/CVE-2026-43353/): i3c: mipi-i3c-hci: Fix race in DMA ring dequeue (high 7.8)
- [CVE-2026-43352](https://insights.sbomify.com/CVE-2026-43352/): i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue (high 7.8)
- [CVE-2026-43351](https://insights.sbomify.com/CVE-2026-43351/): KVM: arm64: Eagerly init vgic dist/redist on vgic creation (medium 5.5)
- [CVE-2026-43350](https://insights.sbomify.com/CVE-2026-43350/): smb: client: require a full NFS mode SID before reading mode bits (high 7.6)
- [CVE-2026-4335](https://insights.sbomify.com/CVE-2026-4335/): ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title (medium 5.4)
- [CVE-2026-43349](https://insights.sbomify.com/CVE-2026-43349/): f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer (medium 5.5)
- [CVE-2026-43348](https://insights.sbomify.com/CVE-2026-43348/): mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER (medium 5.5)
- [CVE-2026-43347](https://insights.sbomify.com/CVE-2026-43347/): arm64: dts: qcom: monaco: Reserve full Gunyah metadata region (high 7.5)
- [CVE-2026-43346](https://insights.sbomify.com/CVE-2026-43346/): ice: ptp: don't WARN when controlling PF is unavailable (medium 5.5)
- [CVE-2026-43345](https://insights.sbomify.com/CVE-2026-43345/): net: ipa: fix event ring index not programmed for IPA v5.0+ (high 7.5)
- [CVE-2026-43344](https://insights.sbomify.com/CVE-2026-43344/): perf/x86/intel/uncore: Fix die ID init and look up bugs (medium 5.5)
- [CVE-2026-43343](https://insights.sbomify.com/CVE-2026-43343/): usb: gadget: f_subset: Fix unbalanced refcnt in geth_free (medium 5.5)
- [CVE-2026-43342](https://insights.sbomify.com/CVE-2026-43342/): usb: gadget: f_rndis: Protect RNDIS options with mutex (medium 4.7)
- [CVE-2026-43341](https://insights.sbomify.com/CVE-2026-43341/): net/ipv6: ioam6: prevent schema length wraparound in trace fill (critical 9.8)
- [CVE-2026-43340](https://insights.sbomify.com/CVE-2026-43340/): comedi: Reinit dev->spinlock between attachments to low-level drivers (medium 5.5)
- [CVE-2026-4334](https://insights.sbomify.com/CVE-2026-4334/): Shariff Wrapper <= 4.6.20 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2026-43339](https://insights.sbomify.com/CVE-2026-43339/): ipv6: prevent possible UaF in addrconf_permanent_addr() (high 7.8)
- [CVE-2026-43338](https://insights.sbomify.com/CVE-2026-43338/): btrfs: reserve enough transaction items for qgroup ioctls (medium 5.5)
- [CVE-2026-43337](https://insights.sbomify.com/CVE-2026-43337/): drm/amd/display: Fix NULL pointer dereference in dcn401_init_hw() (medium 5.5)
- [CVE-2026-43336](https://insights.sbomify.com/CVE-2026-43336/): lib/crypto: chacha: Zeroize permuted_state before it leaves scope (high 7.5)
- [CVE-2026-43335](https://insights.sbomify.com/CVE-2026-43335/): interconnect: qcom: sm8450: Fix NULL pointer dereference in icc_link_nodes() (medium 5.5)
- [CVE-2026-43334](https://insights.sbomify.com/CVE-2026-43334/): Bluetooth: SMP: force responder MITM requirements before building the pairing response (high 8.8)
- [CVE-2026-43333](https://insights.sbomify.com/CVE-2026-43333/): bpf: reject direct access to nullable PTR_TO_BUF pointers (medium 5.5)
- [CVE-2026-43332](https://insights.sbomify.com/CVE-2026-43332/): thermal: core: Fix thermal zone device registration error path (high 7.8)
- [CVE-2026-43331](https://insights.sbomify.com/CVE-2026-43331/): x86/kexec: Disable KCOV instrumentation after load_segments() (medium 5.5)
- [CVE-2026-43330](https://insights.sbomify.com/CVE-2026-43330/): crypto: caam - fix overflow on long hmac keys (high 7.8)
- [CVE-2026-4333](https://insights.sbomify.com/CVE-2026-4333/): LearnPress <= 4.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'skin' Shortcode Attribute (medium 6.4)
- [CVE-2026-43329](https://insights.sbomify.com/CVE-2026-43329/): netfilter: flowtable: strictly check for maximum number of actions (high 7.8)
- [CVE-2026-43328](https://insights.sbomify.com/CVE-2026-43328/): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path (high 7.8)
- [CVE-2026-43327](https://insights.sbomify.com/CVE-2026-43327/): USB: dummy-hcd: Fix locking/synchronization error (medium 5.5)
- [CVE-2026-43326](https://insights.sbomify.com/CVE-2026-43326/): sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback (medium 5.5)
- [CVE-2026-43325](https://insights.sbomify.com/CVE-2026-43325/): wifi: iwlwifi: mvm: don't send a 6E related command when not supported (medium 5.5)
- [CVE-2026-43324](https://insights.sbomify.com/CVE-2026-43324/): USB: dummy-hcd: Fix interrupt synchronization error (high 7.8)
- [CVE-2026-43323](https://insights.sbomify.com/CVE-2026-43323/): sched/fair: Fix zero_vruntime tracking fix (medium 5.5)
- [CVE-2026-43322](https://insights.sbomify.com/CVE-2026-43322/): Bluetooth: hci_sync: Fix UAF in le_read_features_complete (high 8.8)
- [CVE-2026-43321](https://insights.sbomify.com/CVE-2026-43321/): bpf: Properly mark live registers for indirect jumps (high 7.8)
- [CVE-2026-43320](https://insights.sbomify.com/CVE-2026-43320/): drm/amd/display: Fix dsc eDP issue (medium 5.5)
- [CVE-2026-4332](https://insights.sbomify.com/CVE-2026-4332/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2026-43319](https://insights.sbomify.com/CVE-2026-43319/): spi: spidev: fix lock inversion between spi_lock and buf_lock (medium 5.5)
- [CVE-2026-43318](https://insights.sbomify.com/CVE-2026-43318/): drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify (medium 5.5)
- [CVE-2026-43317](https://insights.sbomify.com/CVE-2026-43317/): most: core: fix leak on early registration failure (medium 5.5)
- [CVE-2026-43316](https://insights.sbomify.com/CVE-2026-43316/): media: solo6x10: Check for out of bounds chip_id (medium 5.5)
- [CVE-2026-43315](https://insights.sbomify.com/CVE-2026-43315/): KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding (medium 5.5)
- [CVE-2026-43314](https://insights.sbomify.com/CVE-2026-43314/): dm: remove fake timeout to avoid leak request (medium 5.5)
- [CVE-2026-43313](https://insights.sbomify.com/CVE-2026-43313/): ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() (medium 5.5)
- [CVE-2026-43312](https://insights.sbomify.com/CVE-2026-43312/): media: i2c: ov5647: Initialize subdev before controls (medium 5.5)
- [CVE-2026-43311](https://insights.sbomify.com/CVE-2026-43311/): soc/tegra: pmc: Fix unsafe generic_handle_irq() call (medium 5.5)
- [CVE-2026-43310](https://insights.sbomify.com/CVE-2026-43310/): media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC (medium 5.5)
- [CVE-2026-4331](https://insights.sbomify.com/CVE-2026-4331/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 4.3)
- [CVE-2026-43309](https://insights.sbomify.com/CVE-2026-43309/): md raid: fix hang when stopping arrays with metadata through dm-raid (medium 5.5)
- [CVE-2026-43308](https://insights.sbomify.com/CVE-2026-43308/): btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() (medium 5.5)
- [CVE-2026-43307](https://insights.sbomify.com/CVE-2026-43307/): iio: accel: adxl380: Avoid reading more entries than present in FIFO (high 7.8)
- [CVE-2026-43306](https://insights.sbomify.com/CVE-2026-43306/): bpf: crypto: Use the correct destructor kfunc type (medium 5.5)
- [CVE-2026-43305](https://insights.sbomify.com/CVE-2026-43305/): drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path (medium 5.5)
- [CVE-2026-43304](https://insights.sbomify.com/CVE-2026-43304/): libceph: define and enforce CEPH_MAX_KEY_LEN (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/641/