# Vulnerabilities published in 2026


- [CVE-2026-31714](https://insights.sbomify.com/CVE-2026-31714/): f2fs: fix to avoid memory leak in f2fs_rename() (medium 5.5)
- [CVE-2026-31713](https://insights.sbomify.com/CVE-2026-31713/): fuse: abort on fatal signal during sync init (medium 5.5)
- [CVE-2026-31712](https://insights.sbomify.com/CVE-2026-31712/): ksmbd: require minimum ACE size in smb_check_perm_dacl() (high 8.3)
- [CVE-2026-31711](https://insights.sbomify.com/CVE-2026-31711/): smb: server: fix active_num_conn leak on transport allocation failure (high 7.5)
- [CVE-2026-31710](https://insights.sbomify.com/CVE-2026-31710/): smb: client: fix dir separator in SMB1 UNIX mounts (medium 5.5)
- [CVE-2026-3171](https://insights.sbomify.com/CVE-2026-3171/): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System queue.php cross site scripting (medium 5.1)
- [CVE-2026-31709](https://insights.sbomify.com/CVE-2026-31709/): smb: client: validate the whole DACL before rewriting it in cifsacl (high 8.8)
- [CVE-2026-31708](https://insights.sbomify.com/CVE-2026-31708/): smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (high 8.1)
- [CVE-2026-31707](https://insights.sbomify.com/CVE-2026-31707/): ksmbd: validate response sizes in ipc_validate_msg() (high 7.1)
- [CVE-2026-31706](https://insights.sbomify.com/CVE-2026-31706/): ksmbd: validate num_aces and harden ACE walk in smb_inherit_dacl() (high 8.8)
- [CVE-2026-31705](https://insights.sbomify.com/CVE-2026-31705/): ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment (critical 9.8)
- [CVE-2026-31704](https://insights.sbomify.com/CVE-2026-31704/): ksmbd: use check_add_overflow() to prevent u16 DACL size overflow (medium 5.5)
- [CVE-2026-31703](https://insights.sbomify.com/CVE-2026-31703/): writeback: Fix use after free in inode_switch_wbs_work_fn() (high 7.8)
- [CVE-2026-31702](https://insights.sbomify.com/CVE-2026-31702/): f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() (high 7.8)
- [CVE-2026-31701](https://insights.sbomify.com/CVE-2026-31701/): ALSA: caiaq: take a reference on the USB device in create_card() (medium 5.5)
- [CVE-2026-31700](https://insights.sbomify.com/CVE-2026-31700/): net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() (high 7.8)
- [CVE-2026-3170](https://insights.sbomify.com/CVE-2026-3170/): SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System patient-search.php cross site scripting (medium 4.8)
- [CVE-2026-31699](https://insights.sbomify.com/CVE-2026-31699/): crypto: ccp: Don't attempt to copy CSR to userspace if PSP command failed (high 7.1)
- [CVE-2026-31698](https://insights.sbomify.com/CVE-2026-31698/): crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed (high 7.1)
- [CVE-2026-31697](https://insights.sbomify.com/CVE-2026-31697/): crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed (high 7.1)
- [CVE-2026-31696](https://insights.sbomify.com/CVE-2026-31696/): rxrpc: Fix missing validation of ticket length in non-XDR key preparsing (high 7.8)
- [CVE-2026-31695](https://insights.sbomify.com/CVE-2026-31695/): wifi: virt_wifi: remove SET_NETDEV_DEV to avoid use-after-free (high 7.8)
- [CVE-2026-31694](https://insights.sbomify.com/CVE-2026-31694/): fuse: reject oversized dirents in page cache (high 7.8)
- [CVE-2026-31693](https://insights.sbomify.com/CVE-2026-31693/): cifs: some missing initializations on replay (high 7.8)
- [CVE-2026-31692](https://insights.sbomify.com/CVE-2026-31692/): rtnetlink: add missing netlink_ns_capable() check for peer netns (medium 5.5)
- [CVE-2026-31691](https://insights.sbomify.com/CVE-2026-31691/): igb: remove napi_synchronize() in igb_down() (medium 5.5)
- [CVE-2026-31690](https://insights.sbomify.com/CVE-2026-31690/): firmware: thead: Fix buffer overflow and use standard endian macros (high 7.8)
- [CVE-2026-3169](https://insights.sbomify.com/CVE-2026-3169/): Tenda F453 httpd SafeEmailFilter fromSafeEmailFilter buffer overflow (high 8.7)
- [CVE-2026-31689](https://insights.sbomify.com/CVE-2026-31689/): EDAC/mc: Fix error path ordering in edac_mc_alloc() (medium 5.5)
- [CVE-2026-31687](https://insights.sbomify.com/CVE-2026-31687/): gpio: omap: do not register driver in probe() (medium 5.5)
- [CVE-2026-31686](https://insights.sbomify.com/CVE-2026-31686/): mm/kasan: fix double free for kasan pXds (high 7.8)
- [CVE-2026-31685](https://insights.sbomify.com/CVE-2026-31685/): netfilter: ip6t_eui64: reject invalid MAC header for all packets (critical 9.4)
- [CVE-2026-31684](https://insights.sbomify.com/CVE-2026-31684/): net: sched: act_csum: validate nested VLAN headers (medium 5.5)
- [CVE-2026-31683](https://insights.sbomify.com/CVE-2026-31683/): batman-adv: avoid OGM aggregation when skb tailroom is insufficient (high 7.8)
- [CVE-2026-31682](https://insights.sbomify.com/CVE-2026-31682/): bridge: br_nd_send: linearize skb before parsing ND options (critical 9.1)
- [CVE-2026-31681](https://insights.sbomify.com/CVE-2026-31681/): netfilter: xt_multiport: validate range encoding in checkentry (medium 5.5)
- [CVE-2026-31680](https://insights.sbomify.com/CVE-2026-31680/): net: ipv6: flowlabel: defer exclusive option free until RCU teardown (high 7.8)
- [CVE-2026-3168](https://insights.sbomify.com/CVE-2026-3168/): Tenda F453 httpd NatStaticSetting fromNatStaticSetting buffer overflow (high 8.7)
- [CVE-2026-31679](https://insights.sbomify.com/CVE-2026-31679/): openvswitch: validate MPLS set/set_masked payload length (high 7.1)
- [CVE-2026-31678](https://insights.sbomify.com/CVE-2026-31678/): openvswitch: defer tunnel netdev_put to RCU release (high 7.8)
- [CVE-2026-31677](https://insights.sbomify.com/CVE-2026-31677/): crypto: af_alg - limit RX SG extraction by receive buffer budget (medium 5.5)
- [CVE-2026-31676](https://insights.sbomify.com/CVE-2026-31676/): rxrpc: only handle RESPONSE during service challenge (high 7.5)
- [CVE-2026-31675](https://insights.sbomify.com/CVE-2026-31675/): net/sched: sch_netem: fix out-of-bounds access in packet corruption (high 7.8)
- [CVE-2026-31674](https://insights.sbomify.com/CVE-2026-31674/): netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (high 7.1)
- [CVE-2026-31673](https://insights.sbomify.com/CVE-2026-31673/): af_unix: read UNIX_DIAG_VFS data under unix_state_lock (high 7.8)
- [CVE-2026-31672](https://insights.sbomify.com/CVE-2026-31672/): wifi: rt2x00usb: fix devres lifetime (medium 5.5)
- [CVE-2026-31671](https://insights.sbomify.com/CVE-2026-31671/): xfrm_user: fix info leak in build_report() (medium 5.5)
- [CVE-2026-31670](https://insights.sbomify.com/CVE-2026-31670/): net: rfkill: prevent unlimited numbers of rfkill events from being created (medium 5.5)
- [CVE-2026-3167](https://insights.sbomify.com/CVE-2026-3167/): Tenda F453 httpd webtypelibrary formWebTypeLibrary buffer overflow (high 8.7)
- [CVE-2026-31669](https://insights.sbomify.com/CVE-2026-31669/): mptcp: fix slab-use-after-free in __inet_lookup_established (critical 9.8)
- [CVE-2026-31668](https://insights.sbomify.com/CVE-2026-31668/): seg6: separate dst_cache for input and output paths in seg6 lwtunnel (critical 9.8)
- [CVE-2026-31667](https://insights.sbomify.com/CVE-2026-31667/): Input: uinput - fix circular locking dependency with ff-core (high 7.8)
- [CVE-2026-31666](https://insights.sbomify.com/CVE-2026-31666/): btrfs: fix incorrect return value after changing leaf in lookup_extent_data_ref() (high 7.8)
- [CVE-2026-31665](https://insights.sbomify.com/CVE-2026-31665/): netfilter: nft_ct: fix use-after-free in timeout object destroy (high 7.8)
- [CVE-2026-31664](https://insights.sbomify.com/CVE-2026-31664/): xfrm: clear trailing padding in build_polexpire() (medium 5.5)
- [CVE-2026-31663](https://insights.sbomify.com/CVE-2026-31663/): xfrm: hold dev ref until after transport_finish NF_HOOK (high 7.8)
- [CVE-2026-31662](https://insights.sbomify.com/CVE-2026-31662/): tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (high 7.5)
- [CVE-2026-31661](https://insights.sbomify.com/CVE-2026-31661/): wifi: brcmsmac: Fix dma_free_coherent() size (medium 5.5)
- [CVE-2026-31660](https://insights.sbomify.com/CVE-2026-31660/): nfc: pn533: allocate rx skb before consuming bytes (medium 5.5)
- [CVE-2026-3166](https://insights.sbomify.com/CVE-2026-3166/): Tenda F453 httpd RouteStatic fromRouteStatic buffer overflow (high 8.7)
- [CVE-2026-31659](https://insights.sbomify.com/CVE-2026-31659/): batman-adv: reject oversized global TT response buffers (critical 9.8)
- [CVE-2026-31658](https://insights.sbomify.com/CVE-2026-31658/): net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit() (medium 5.5)
- [CVE-2026-31657](https://insights.sbomify.com/CVE-2026-31657/): batman-adv: hold claim backbone gateways by reference (critical 9.8)
- [CVE-2026-31656](https://insights.sbomify.com/CVE-2026-31656/): drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (high 7.8)
- [CVE-2026-31655](https://insights.sbomify.com/CVE-2026-31655/): pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled (medium 5.5)
- [CVE-2026-31654](https://insights.sbomify.com/CVE-2026-31654/): mm/vma: fix memory leak in __mmap_region() (medium 5.5)
- [CVE-2026-31653](https://insights.sbomify.com/CVE-2026-31653/): mm/damon/sysfs: dealloc repeat_call_control if damon_call() fails (medium 5.5)
- [CVE-2026-31652](https://insights.sbomify.com/CVE-2026-31652/): mm/damon/stat: deallocate damon_call() failure leaking damon_ctx (high 7.8)
- [CVE-2026-31651](https://insights.sbomify.com/CVE-2026-31651/): mmc: vub300: fix NULL-deref on disconnect (medium 5.5)
- [CVE-2026-31650](https://insights.sbomify.com/CVE-2026-31650/): mmc: vub300: fix use-after-free on disconnect (high 7.8)
- [CVE-2026-3165](https://insights.sbomify.com/CVE-2026-3165/): Tenda F453 httpd AdvSetWrlsafeset fromSetWifiGusetBasic buffer overflow (high 8.7)
- [CVE-2026-31649](https://insights.sbomify.com/CVE-2026-31649/): net: stmmac: fix integer underflow in chain mode (critical 9.8)
- [CVE-2026-31648](https://insights.sbomify.com/CVE-2026-31648/): mm: filemap: fix nr_pages calculation overflow in filemap_map_pages() (high 7.8)
- [CVE-2026-31647](https://insights.sbomify.com/CVE-2026-31647/): idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (medium 5.5)
- [CVE-2026-31646](https://insights.sbomify.com/CVE-2026-31646/): net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool() (medium 5.5)
- [CVE-2026-31645](https://insights.sbomify.com/CVE-2026-31645/): net: lan966x: fix page pool leak in error paths (medium 5.5)
- [CVE-2026-31644](https://insights.sbomify.com/CVE-2026-31644/): net: lan966x: fix use-after-free and leak in lan966x_fdma_reload() (high 7.8)
- [CVE-2026-31643](https://insights.sbomify.com/CVE-2026-31643/): rxrpc: Fix key parsing memleak (medium 5.5)
- [CVE-2026-31642](https://insights.sbomify.com/CVE-2026-31642/): rxrpc: Fix call removal to use RCU safe deletion (medium 5.5)
- [CVE-2026-31641](https://insights.sbomify.com/CVE-2026-31641/): rxrpc: Fix RxGK token loading to check bounds (high 7.8)
- [CVE-2026-31640](https://insights.sbomify.com/CVE-2026-31640/): rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial (high 7.5)
- [CVE-2026-3164](https://insights.sbomify.com/CVE-2026-3164/): itsourcecode News Portal Project contactus.php sql injection (medium 6.9)
- [CVE-2026-31639](https://insights.sbomify.com/CVE-2026-31639/): rxrpc: Fix key reference count leak from call->key (medium 5.5)
- [CVE-2026-31638](https://insights.sbomify.com/CVE-2026-31638/): rxrpc: Only put the call ref if one was acquired (high 7.5)
- [CVE-2026-31637](https://insights.sbomify.com/CVE-2026-31637/): rxrpc: reject undecryptable rxkad response tickets (critical 9.8)
- [CVE-2026-31636](https://insights.sbomify.com/CVE-2026-31636/): rxrpc: fix RESPONSE authenticator parser OOB read (critical 9.1)
- [CVE-2026-31635](https://insights.sbomify.com/CVE-2026-31635/): rxrpc: fix oversized RESPONSE authenticator length check (high 7.5)
- [CVE-2026-31634](https://insights.sbomify.com/CVE-2026-31634/): rxrpc: fix reference count leak in rxrpc_server_keyring() (medium 5.5)
- [CVE-2026-31633](https://insights.sbomify.com/CVE-2026-31633/): rxrpc: Fix integer overflow in rxgk_verify_response() (critical 9.8)
- [CVE-2026-31632](https://insights.sbomify.com/CVE-2026-31632/): rxrpc: Fix leak of rxgk context in rxgk_verify_response() (medium 5.5)
- [CVE-2026-31631](https://insights.sbomify.com/CVE-2026-31631/): rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (high 8.2)
- [CVE-2026-31630](https://insights.sbomify.com/CVE-2026-31630/): rxrpc: proc: size address buffers for %pISpc output (high 7.8)
- [CVE-2026-3163](https://insights.sbomify.com/CVE-2026-3163/): SourceCodester Website Link Extractor URL file_get_contents server-side request forgery (medium 5.3)
- [CVE-2026-31629](https://insights.sbomify.com/CVE-2026-31629/): nfc: llcp: add missing return after LLCP_CLOSED checks (high 8.8)
- [CVE-2026-31628](https://insights.sbomify.com/CVE-2026-31628/): x86/CPU: Fix FPDSS on Zen1 (medium 5.5)
- [CVE-2026-31627](https://insights.sbomify.com/CVE-2026-31627/): i2c: s3c24xx: check the size of the SMBUS message before using it (high 7.8)
- [CVE-2026-31626](https://insights.sbomify.com/CVE-2026-31626/): staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() (high 7.1)
- [CVE-2026-31625](https://insights.sbomify.com/CVE-2026-31625/): HID: alps: fix NULL pointer dereference in alps_raw_event() (medium 5.5)
- [CVE-2026-31624](https://insights.sbomify.com/CVE-2026-31624/): HID: core: clamp report_size in s32ton() to avoid undefined shift (medium 5.5)
- [CVE-2026-31623](https://insights.sbomify.com/CVE-2026-31623/): net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/727/