# Vulnerabilities published in 2026


- [CVE-2026-43303](https://insights.sbomify.com/CVE-2026-43303/): mm/page_alloc: clear page->private in free_pages_prepare() (high 7.8)
- [CVE-2026-43302](https://insights.sbomify.com/CVE-2026-43302/): drm/v3d: Set DMA segment size to avoid debug warnings (medium 5.5)
- [CVE-2026-43301](https://insights.sbomify.com/CVE-2026-43301/): media: chips-media: wave5: Fix PM runtime usage count underflow (medium 5.5)
- [CVE-2026-43300](https://insights.sbomify.com/CVE-2026-43300/): drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() (medium 5.5)
- [CVE-2026-4330](https://insights.sbomify.com/CVE-2026-4330/): Missing authorization in Blog2Social: Social Media Auto Post & Scheduler (medium 4.3)
- [CVE-2026-43299](https://insights.sbomify.com/CVE-2026-43299/): btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() (medium 5.5)
- [CVE-2026-43298](https://insights.sbomify.com/CVE-2026-43298/): drm/amdgpu: Skip vcn poison irq release on VF (medium 5.5)
- [CVE-2026-43297](https://insights.sbomify.com/CVE-2026-43297/): media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() (medium 5.5)
- [CVE-2026-43296](https://insights.sbomify.com/CVE-2026-43296/): octeontx2-af: Workaround SQM/PSE stalls by disabling sticky (high 7.5)
- [CVE-2026-43295](https://insights.sbomify.com/CVE-2026-43295/): rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() (medium 5.5)
- [CVE-2026-43294](https://insights.sbomify.com/CVE-2026-43294/): drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels (medium 5.5)
- [CVE-2026-43293](https://insights.sbomify.com/CVE-2026-43293/): media: chips-media: wave5: Fix kthread worker destruction in polling mode (medium 5.5)
- [CVE-2026-43292](https://insights.sbomify.com/CVE-2026-43292/): mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node (medium 5.5)
- [CVE-2026-43291](https://insights.sbomify.com/CVE-2026-43291/): net: nfc: nci: Fix parameter validation for packet data (high 8.3)
- [CVE-2026-43290](https://insights.sbomify.com/CVE-2026-43290/): media: uvcvideo: Return queued buffers on start_streaming() failure (high 7.8)
- [CVE-2026-4329](https://insights.sbomify.com/CVE-2026-4329/): Blackhole for Bad Bots <= 3.8 - Unauthenticated Stored Cross-Site Scripting via User-Agent HTTP Header (high 7.2)
- [CVE-2026-43289](https://insights.sbomify.com/CVE-2026-43289/): kexec: derive purgatory entry from symbol (medium 5.5)
- [CVE-2026-43288](https://insights.sbomify.com/CVE-2026-43288/): ext4: move ext4_percpu_param_init() before ext4_mb_init() (medium 5.5)
- [CVE-2026-43287](https://insights.sbomify.com/CVE-2026-43287/): drm: Account property blob allocations to memcg (medium 5.5)
- [CVE-2026-43286](https://insights.sbomify.com/CVE-2026-43286/): mm/hugetlb: restore failed global reservations to subpool (medium 5.5)
- [CVE-2026-43285](https://insights.sbomify.com/CVE-2026-43285/): mm/slab: do not access current->mems_allowed_seq if !allow_spin (medium 5.5)
- [CVE-2026-43284](https://insights.sbomify.com/CVE-2026-43284/): xfrm: esp: avoid in-place decrypt on shared skb frags (high 8.8)
- [CVE-2026-43283](https://insights.sbomify.com/CVE-2026-43283/): net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle (high 8.8)
- [CVE-2026-43282](https://insights.sbomify.com/CVE-2026-43282/): RDMA/ionic: Fix potential NULL pointer dereference in ionic_query_port (medium 5.5)
- [CVE-2026-43281](https://insights.sbomify.com/CVE-2026-43281/): mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() (high 7.1)
- [CVE-2026-43280](https://insights.sbomify.com/CVE-2026-43280/): drm/xe: Add bounds check on pat_index to prevent OOB kernel read in madvise (high 7.1)
- [CVE-2026-4328](https://insights.sbomify.com/CVE-2026-4328/): Server-side request forgery in Advanced Import (medium 6.4)
- [CVE-2026-43279](https://insights.sbomify.com/CVE-2026-43279/): ALSA: usb-audio: Add sanity check for OOB writes at silencing (high 7.8)
- [CVE-2026-43278](https://insights.sbomify.com/CVE-2026-43278/): dm: clear cloned request bio pointer when last clone bio completes (high 7.8)
- [CVE-2026-43277](https://insights.sbomify.com/CVE-2026-43277/): APEI/GHES: ensure that won't go past CPER allocated record (medium 5.5)
- [CVE-2026-43276](https://insights.sbomify.com/CVE-2026-43276/): net: mana: Fix double destroy_workqueue on service rescan PCI path (high 7.8)
- [CVE-2026-43275](https://insights.sbomify.com/CVE-2026-43275/): scsi: ufs: core: Flush exception handling work when RPM level is zero (medium 4.7)
- [CVE-2026-43274](https://insights.sbomify.com/CVE-2026-43274/): mailbox: mchp-ipc-sbi: fix out-of-bounds access in mchp_ipc_get_cluster_aggr_irq() (high 8.4)
- [CVE-2026-43273](https://insights.sbomify.com/CVE-2026-43273/): ceph: supply snapshot context in ceph_zero_partial_object() (medium 5.5)
- [CVE-2026-43272](https://insights.sbomify.com/CVE-2026-43272/): ring-buffer: Fix possible dereference of uninitialized pointer (medium 5.5)
- [CVE-2026-43271](https://insights.sbomify.com/CVE-2026-43271/): md-cluster: fix NULL pointer dereference in process_metadata_update (medium 5.5)
- [CVE-2026-43270](https://insights.sbomify.com/CVE-2026-43270/): media: mtk-mdp: Fix a reference leak bug in mtk_mdp_remove() (medium 5.5)
- [CVE-2026-4327](https://insights.sbomify.com/CVE-2026-4327/): Code injection in The Welcomizer (high 8.8)
- [CVE-2026-43269](https://insights.sbomify.com/CVE-2026-43269/): drm/atmel-hlcdc: fix memory leak from the atomic_destroy_state callback (medium 5.5)
- [CVE-2026-43268](https://insights.sbomify.com/CVE-2026-43268/): hfsplus: pretend special inodes as regular files (medium 5.5)
- [CVE-2026-43267](https://insights.sbomify.com/CVE-2026-43267/): wifi: rtw89: fix potential zero beacon interval in beacon tracking (medium 5.5)
- [CVE-2026-43266](https://insights.sbomify.com/CVE-2026-43266/): EFI/CPER: don't go past the ARM processor CPER record buffer (medium 5.5)
- [CVE-2026-43265](https://insights.sbomify.com/CVE-2026-43265/): KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() (medium 5.5)
- [CVE-2026-43264](https://insights.sbomify.com/CVE-2026-43264/): fbdev: of: display_timing: fix refcount leak in of_get_display_timings() (medium 5.5)
- [CVE-2026-43263](https://insights.sbomify.com/CVE-2026-43263/): media: chips-media: wave5: Fix Null reference while testing fluster (high 7.8)
- [CVE-2026-43262](https://insights.sbomify.com/CVE-2026-43262/): gfs2: fiemap page fault fix (medium 5.5)
- [CVE-2026-43261](https://insights.sbomify.com/CVE-2026-43261/): arm64: Add support for TSV110 Spectre-BHB mitigation (medium 5.5)
- [CVE-2026-43260](https://insights.sbomify.com/CVE-2026-43260/): bnxt_en: Fix RSS context delete logic (high 7.8)
- [CVE-2026-4326](https://insights.sbomify.com/CVE-2026-4326/): Missing authorization in Vertex Addons for Elementor (high 8.8)
- [CVE-2026-43259](https://insights.sbomify.com/CVE-2026-43259/): phy: fsl-imx8mq-usb: set platform driver data (medium 5.5)
- [CVE-2026-43258](https://insights.sbomify.com/CVE-2026-43258/): alpha: fix user-space corruption during memory compaction (high 7.8)
- [CVE-2026-43257](https://insights.sbomify.com/CVE-2026-43257/): media: cx88: Add missing unmap in snd_cx88_hw_params() (medium 5.5)
- [CVE-2026-43256](https://insights.sbomify.com/CVE-2026-43256/): media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() (high 7.8)
- [CVE-2026-43255](https://insights.sbomify.com/CVE-2026-43255/): wifi: libertas: fix WARNING in usb_tx_block (medium 5.5)
- [CVE-2026-43254](https://insights.sbomify.com/CVE-2026-43254/): ovpn: tcp - fix packet extraction from stream (high 7.5)
- [CVE-2026-43253](https://insights.sbomify.com/CVE-2026-43253/): iommu/amd: move wait_on_sem() out of spinlock (high 7.5)
- [CVE-2026-43252](https://insights.sbomify.com/CVE-2026-43252/): mptcp: pm: in-kernel: always set ID as avail when rm endp (medium 5.5)
- [CVE-2026-43251](https://insights.sbomify.com/CVE-2026-43251/): HID: prodikeys: Check presence of pm->input_ep82 (medium 5.5)
- [CVE-2026-43250](https://insights.sbomify.com/CVE-2026-43250/): usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() (high 7.8)
- [CVE-2026-4325](https://insights.sbomify.com/CVE-2026-4325/): Keycloak: keycloak: replay of action tokens via improper handling of single-use entries (medium 5.3)
- [CVE-2026-43249](https://insights.sbomify.com/CVE-2026-43249/): 9p/xen: protect xen_9pfs_front_free against concurrent calls (high 8.8)
- [CVE-2026-43248](https://insights.sbomify.com/CVE-2026-43248/): vhost: move vdpa group bound check to vhost_vdpa (high 7.8)
- [CVE-2026-43247](https://insights.sbomify.com/CVE-2026-43247/): media: chips-media: wave5: Fix SError of kernel panic when closed (medium 5.5)
- [CVE-2026-43246](https://insights.sbomify.com/CVE-2026-43246/): media: i2c/tw9906: Fix potential memory leak in tw9906_probe() (medium 5.5)
- [CVE-2026-43245](https://insights.sbomify.com/CVE-2026-43245/): ntfs: ->d_compare() must not block (high 7.5)
- [CVE-2026-43244](https://insights.sbomify.com/CVE-2026-43244/): kcm: fix zero-frag skb in frag_list on partial sendmsg error (medium 5.5)
- [CVE-2026-43243](https://insights.sbomify.com/CVE-2026-43243/): drm/amd/display: Add signal type check for dcn401 get_phyd32clk_src (medium 5.5)
- [CVE-2026-43242](https://insights.sbomify.com/CVE-2026-43242/): soc: ti: k3-socinfo: Fix regmap leak on probe failure (medium 5.5)
- [CVE-2026-43241](https://insights.sbomify.com/CVE-2026-43241/): ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access (high 7.1)
- [CVE-2026-43240](https://insights.sbomify.com/CVE-2026-43240/): x86/kexec: add a sanity check on previous kernel's ima kexec buffer (medium 5.5)
- [CVE-2026-4324](https://insights.sbomify.com/CVE-2026-4324/): Rubygem-katello: katello: denial of service and potential information disclosure via sql injection (medium 5.4)
- [CVE-2026-43239](https://insights.sbomify.com/CVE-2026-43239/): smb: client: prevent races in ->query_interfaces() (high 8.8)
- [CVE-2026-43238](https://insights.sbomify.com/CVE-2026-43238/): net/sched: act_skbedit: fix divide-by-zero in tcf_skbedit_hash() (medium 5.5)
- [CVE-2026-43237](https://insights.sbomify.com/CVE-2026-43237/): drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (high 7.8)
- [CVE-2026-43236](https://insights.sbomify.com/CVE-2026-43236/): drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release (high 7.8)
- [CVE-2026-43235](https://insights.sbomify.com/CVE-2026-43235/): media: iris: Add missing platform data entries for SM8750 (medium 5.5)
- [CVE-2026-43234](https://insights.sbomify.com/CVE-2026-43234/): team: avoid NETDEV_CHANGEMTU event when unregistering slave (medium 5.5)
- [CVE-2026-43233](https://insights.sbomify.com/CVE-2026-43233/): netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (high 8.2)
- [CVE-2026-43232](https://insights.sbomify.com/CVE-2026-43232/): net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets (high 8.8)
- [CVE-2026-43231](https://insights.sbomify.com/CVE-2026-43231/): media: radio-keene: fix memory leak in error path (medium 5.5)
- [CVE-2026-43230](https://insights.sbomify.com/CVE-2026-43230/): net/rds: Clear reconnect pending bit (high 7.5)
- [CVE-2026-43229](https://insights.sbomify.com/CVE-2026-43229/): media: chips-media: wave5: Fix device cleanup order to prevent kernel panic (medium 5.5)
- [CVE-2026-43228](https://insights.sbomify.com/CVE-2026-43228/): hfs: Replace BUG_ON with error handling for CNID count checks (medium 5.5)
- [CVE-2026-43227](https://insights.sbomify.com/CVE-2026-43227/): clocksource/drivers/sh_tmu: Always leave device running after probe (medium 5.5)
- [CVE-2026-43226](https://insights.sbomify.com/CVE-2026-43226/): net/rds: No shortcut out of RDS_CONN_ERROR (high 7.5)
- [CVE-2026-43225](https://insights.sbomify.com/CVE-2026-43225/): staging: rtl8723bs: fix memory leak on failure path (medium 5.5)
- [CVE-2026-43224](https://insights.sbomify.com/CVE-2026-43224/): io_uring/zcrx: fix sgtable leak on mapping failures (medium 5.5)
- [CVE-2026-43223](https://insights.sbomify.com/CVE-2026-43223/): media: pvrusb2: fix URB leak in pvr2_send_request_ex (medium 5.5)
- [CVE-2026-43222](https://insights.sbomify.com/CVE-2026-43222/): media: verisilicon: AV1: Fix tile info buffer size (high 7.8)
- [CVE-2026-43221](https://insights.sbomify.com/CVE-2026-43221/): ipmi: ipmb: initialise event handler read bytes (medium 5.5)
- [CVE-2026-43220](https://insights.sbomify.com/CVE-2026-43220/): iommu/amd: serialize sequence allocation under concurrent TLB invalidations (medium 5.5)
- [CVE-2026-4322](https://insights.sbomify.com/CVE-2026-4322/): XSS in Raera's Destekz (medium 6.1)
- [CVE-2026-43219](https://insights.sbomify.com/CVE-2026-43219/): net: cpsw_new: Fix potential unregister of netdev that has not been registered yet (medium 5.5)
- [CVE-2026-43218](https://insights.sbomify.com/CVE-2026-43218/): media: i2c/tw9903: Fix potential memory leak in tw9903_probe() (medium 5.5)
- [CVE-2026-43217](https://insights.sbomify.com/CVE-2026-43217/): media: iris: gen2: Add sanity check for session stop (medium 5.5)
- [CVE-2026-43216](https://insights.sbomify.com/CVE-2026-43216/): net: Drop the lock in skb_may_tx_timestamp() (medium 5.5)
- [CVE-2026-43215](https://insights.sbomify.com/CVE-2026-43215/): cifs: Fix locking usage for tcon fields (high 8.8)
- [CVE-2026-43214](https://insights.sbomify.com/CVE-2026-43214/): KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() (high 7.8)
- [CVE-2026-43213](https://insights.sbomify.com/CVE-2026-43213/): wifi: rtw89: pci: validate sequence number of TX release report (high 7.5)
- [CVE-2026-43212](https://insights.sbomify.com/CVE-2026-43212/): LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/642/