# Vulnerabilities published in 2026


- [CVE-2026-31622](https://insights.sbomify.com/CVE-2026-31622/): NFC: digital: Bounds check NFC-A cascade depth in SDD response handler (high 8.8)
- [CVE-2026-31621](https://insights.sbomify.com/CVE-2026-31621/): bnge: return after auxiliary_device_uninit() in error path (medium 5.5)
- [CVE-2026-31620](https://insights.sbomify.com/CVE-2026-31620/): ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 (medium 4.6)
- [CVE-2026-31619](https://insights.sbomify.com/CVE-2026-31619/): ALSA: fireworks: bound device-supplied status before string array lookup (medium 5.5)
- [CVE-2026-31618](https://insights.sbomify.com/CVE-2026-31618/): fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (medium 5.5)
- [CVE-2026-31617](https://insights.sbomify.com/CVE-2026-31617/): usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() (medium 5.5)
- [CVE-2026-31616](https://insights.sbomify.com/CVE-2026-31616/): usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() (medium 5.5)
- [CVE-2026-31615](https://insights.sbomify.com/CVE-2026-31615/): usb: gadget: renesas_usb3: validate endpoint index in standard request handlers (medium 5.5)
- [CVE-2026-31614](https://insights.sbomify.com/CVE-2026-31614/): smb: client: fix off-by-8 bounds check in check_wsl_eas() (high 7.1)
- [CVE-2026-31613](https://insights.sbomify.com/CVE-2026-31613/): smb: client: fix OOB reads parsing symlink error response (high 8.1)
- [CVE-2026-31612](https://insights.sbomify.com/CVE-2026-31612/): ksmbd: validate EaNameLength in smb2_get_ea() (high 7.5)
- [CVE-2026-31611](https://insights.sbomify.com/CVE-2026-31611/): ksmbd: require 3 sub-authorities before reading sub_auth[2] (high 8.6)
- [CVE-2026-31610](https://insights.sbomify.com/CVE-2026-31610/): ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc (medium 5.5)
- [CVE-2026-3161](https://insights.sbomify.com/CVE-2026-3161/): IBM Cloud Pak System Risky Cryptographic Algorithm (medium 5.9)
- [CVE-2026-31609](https://insights.sbomify.com/CVE-2026-31609/): smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (critical 9.8)
- [CVE-2026-31608](https://insights.sbomify.com/CVE-2026-31608/): smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (critical 9.8)
- [CVE-2026-31607](https://insights.sbomify.com/CVE-2026-31607/): usbip: validate number_of_packets in usbip_pack_ret_submit() (critical 9.8)
- [CVE-2026-31606](https://insights.sbomify.com/CVE-2026-31606/): usb: gadget: f_hid: don't call cdev_init while cdev in use (medium 5.5)
- [CVE-2026-31605](https://insights.sbomify.com/CVE-2026-31605/): fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (medium 5.5)
- [CVE-2026-31604](https://insights.sbomify.com/CVE-2026-31604/): wifi: rtw88: fix device leak on probe failure (medium 5.5)
- [CVE-2026-31603](https://insights.sbomify.com/CVE-2026-31603/): staging: sm750fb: fix division by zero in ps_to_hz() (medium 5.5)
- [CVE-2026-31602](https://insights.sbomify.com/CVE-2026-31602/): ALSA: ctxfi: Limit PTP to a single page (high 7.8)
- [CVE-2026-31601](https://insights.sbomify.com/CVE-2026-31601/): vfio/xe: Reorganize the init to decouple migration from reset (medium 5.5)
- [CVE-2026-31600](https://insights.sbomify.com/CVE-2026-31600/): arm64: mm: Handle invalid large leaf mappings correctly (high 7.5)
- [CVE-2026-3160](https://insights.sbomify.com/CVE-2026-3160/): Unintended Proxy or Intermediary ('Confused Deputy') in GitLab (medium 5.8)
- [CVE-2026-31599](https://insights.sbomify.com/CVE-2026-31599/): media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections (medium 5.5)
- [CVE-2026-31598](https://insights.sbomify.com/CVE-2026-31598/): ocfs2: fix possible deadlock between unlink and dio_end_io_write (high 7.5)
- [CVE-2026-31597](https://insights.sbomify.com/CVE-2026-31597/): ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY (high 7.8)
- [CVE-2026-31596](https://insights.sbomify.com/CVE-2026-31596/): ocfs2: handle invalid dinode in ocfs2_group_extend (medium 5.5)
- [CVE-2026-31595](https://insights.sbomify.com/CVE-2026-31595/): PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup (medium 5.5)
- [CVE-2026-31594](https://insights.sbomify.com/CVE-2026-31594/): PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown (medium 5.5)
- [CVE-2026-31593](https://insights.sbomify.com/CVE-2026-31593/): KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU (medium 5.5)
- [CVE-2026-31592](https://insights.sbomify.com/CVE-2026-31592/): KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock (medium 5.5)
- [CVE-2026-31591](https://insights.sbomify.com/CVE-2026-31591/): KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish (medium 5.5)
- [CVE-2026-31590](https://insights.sbomify.com/CVE-2026-31590/): KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION (medium 5.5)
- [CVE-2026-31589](https://insights.sbomify.com/CVE-2026-31589/): mm: call ->free_folio() directly in folio_unmap_invalidate() (critical 9.8)
- [CVE-2026-31588](https://insights.sbomify.com/CVE-2026-31588/): KVM: x86: Use scratch field in MMIO fragment to hold small write values (high 8.8)
- [CVE-2026-31587](https://insights.sbomify.com/CVE-2026-31587/): ASoC: qcom: q6apm: move component registration to unmanaged version (high 7.8)
- [CVE-2026-31586](https://insights.sbomify.com/CVE-2026-31586/): mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() (high 7.8)
- [CVE-2026-31585](https://insights.sbomify.com/CVE-2026-31585/): media: vidtv: fix nfeeds state corruption on start_streaming failure (medium 5.5)
- [CVE-2026-31584](https://insights.sbomify.com/CVE-2026-31584/): media: mediatek: vcodec: fix use-after-free in encoder release path (high 7.8)
- [CVE-2026-31583](https://insights.sbomify.com/CVE-2026-31583/): media: em28xx: fix use-after-free in em28xx_v4l2_open() (high 7.8)
- [CVE-2026-31582](https://insights.sbomify.com/CVE-2026-31582/): hwmon: (powerz) Fix use-after-free on USB disconnect (high 7.8)
- [CVE-2026-31581](https://insights.sbomify.com/CVE-2026-31581/): ALSA: 6fire: fix use-after-free on disconnect (high 7.8)
- [CVE-2026-31580](https://insights.sbomify.com/CVE-2026-31580/): bcache: fix cached_dev.sb_bio use-after-free and crash (high 7.8)
- [CVE-2026-3158](https://insights.sbomify.com/CVE-2026-3158/): Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (medium 4.3)
- [CVE-2026-31579](https://insights.sbomify.com/CVE-2026-31579/): wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit (medium 5.5)
- [CVE-2026-31578](https://insights.sbomify.com/CVE-2026-31578/): media: as102: fix to not free memory after the device is registered in as102_usb_probe() (high 7.8)
- [CVE-2026-31577](https://insights.sbomify.com/CVE-2026-31577/): nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map (medium 5.5)
- [CVE-2026-31576](https://insights.sbomify.com/CVE-2026-31576/): media: hackrf: fix to not free memory after the device is registered in hackrf_probe() (high 7.8)
- [CVE-2026-31575](https://insights.sbomify.com/CVE-2026-31575/): mm/userfaultfd: fix hugetlb fault mutex hash calculation (medium 5.5)
- [CVE-2026-31574](https://insights.sbomify.com/CVE-2026-31574/): clockevents: Add missing resets of the next_event_forced flag (medium 5.5)
- [CVE-2026-31573](https://insights.sbomify.com/CVE-2026-31573/): media: verisilicon: Fix kernel panic due to __initconst misuse (medium 5.5)
- [CVE-2026-31572](https://insights.sbomify.com/CVE-2026-31572/): i2c: designware: amdisp: Fix resume-probe race condition issue (medium 4.7)
- [CVE-2026-31571](https://insights.sbomify.com/CVE-2026-31571/): drm/i915: Unlink NV12 planes earlier (medium 5.5)
- [CVE-2026-31570](https://insights.sbomify.com/CVE-2026-31570/): can: gw: fix OOB heap access in cgw_csum_crc8_rel() (high 8.8)
- [CVE-2026-3157](https://insights.sbomify.com/CVE-2026-3157/): Information disclosure in Sterling B2B Integrator (medium 4.3)
- [CVE-2026-31569](https://insights.sbomify.com/CVE-2026-31569/): LoongArch: KVM: Handle the case that EIOINTC's coremap is empty (high 7.3)
- [CVE-2026-31568](https://insights.sbomify.com/CVE-2026-31568/): s390/mm: Add missing secure storage access fixups for donated memory (high 7.1)
- [CVE-2026-31567](https://insights.sbomify.com/CVE-2026-31567/): PM: sleep: Drop spurious WARN_ON() from pm_restore_gfp_mask() (medium 5.5)
- [CVE-2026-31566](https://insights.sbomify.com/CVE-2026-31566/): drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (high 7.8)
- [CVE-2026-31565](https://insights.sbomify.com/CVE-2026-31565/): RDMA/irdma: Fix deadlock during netdev reset with active connections (medium 5.5)
- [CVE-2026-31564](https://insights.sbomify.com/CVE-2026-31564/): LoongArch: KVM: Fix base address calculation in kvm_eiointc_regs_access() (medium 5.5)
- [CVE-2026-31563](https://insights.sbomify.com/CVE-2026-31563/): net: macb: Use dev_consume_skb_any() to free TX SKBs (high 7.5)
- [CVE-2026-31562](https://insights.sbomify.com/CVE-2026-31562/): drm/mediatek: dsi: Store driver data before invoking mipi_dsi_host_register (medium 5.5)
- [CVE-2026-31561](https://insights.sbomify.com/CVE-2026-31561/): x86/cpu: Remove X86_CR4_FRED from the CR4 pinned bits mask (medium 5.5)
- [CVE-2026-31560](https://insights.sbomify.com/CVE-2026-31560/): spi: spi-dw-dma: fix print error log when wait finish transaction (medium 5.5)
- [CVE-2026-31559](https://insights.sbomify.com/CVE-2026-31559/): LoongArch: Fix missing NULL checks for kstrdup() (medium 5.5)
- [CVE-2026-31558](https://insights.sbomify.com/CVE-2026-31558/): LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust (high 8.8)
- [CVE-2026-31557](https://insights.sbomify.com/CVE-2026-31557/): nvmet: move async event work off nvmet-wq (high 7.5)
- [CVE-2026-31556](https://insights.sbomify.com/CVE-2026-31556/): xfs: scrub: unlock dquot before early return in quota scrub (medium 5.5)
- [CVE-2026-31555](https://insights.sbomify.com/CVE-2026-31555/): futex: Clear stale exiting pointer in futex_lock_pi() retry path (medium 5.5)
- [CVE-2026-31554](https://insights.sbomify.com/CVE-2026-31554/): futex: Require sys_futex_requeue() to have identical flags (high 7.8)
- [CVE-2026-31553](https://insights.sbomify.com/CVE-2026-31553/): KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc() (high 8.8)
- [CVE-2026-31552](https://insights.sbomify.com/CVE-2026-31552/): wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom (high 7.5)
- [CVE-2026-31551](https://insights.sbomify.com/CVE-2026-31551/): wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. (medium 5.5)
- [CVE-2026-31550](https://insights.sbomify.com/CVE-2026-31550/): pmdomain: bcm: bcm2835-power: Increase ASB control timeout (medium 5.5)
- [CVE-2026-3155](https://insights.sbomify.com/CVE-2026-3155/): Missing authorization in OneSignal – Web Push Notifications (low 3.1)
- [CVE-2026-31549](https://insights.sbomify.com/CVE-2026-31549/): i2c: cp2615: fix serial string NULL-deref at probe (medium 5.5)
- [CVE-2026-31548](https://insights.sbomify.com/CVE-2026-31548/): wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (high 7.8)
- [CVE-2026-31547](https://insights.sbomify.com/CVE-2026-31547/): drm/xe: Fix missing runtime PM reference in ccs_mode_store (medium 5.5)
- [CVE-2026-31546](https://insights.sbomify.com/CVE-2026-31546/): net: bonding: fix NULL deref in bond_debug_rlb_hash_show (medium 5.5)
- [CVE-2026-31545](https://insights.sbomify.com/CVE-2026-31545/): NFC: nxp-nci: allow GPIOs to sleep (medium 5.5)
- [CVE-2026-31544](https://insights.sbomify.com/CVE-2026-31544/): firmware: arm_scmi: Fix NULL dereference on notify error path (medium 5.5)
- [CVE-2026-31543](https://insights.sbomify.com/CVE-2026-31543/): crash_dump: don't log dm-crypt key bytes in read_key_from_user_keying (medium 5.5)
- [CVE-2026-31542](https://insights.sbomify.com/CVE-2026-31542/): x86/platform/uv: Handle deconfigured sockets (medium 5.5)
- [CVE-2026-31541](https://insights.sbomify.com/CVE-2026-31541/): tracing: Fix trace_marker copy link list updates (high 7.8)
- [CVE-2026-31540](https://insights.sbomify.com/CVE-2026-31540/): drm/i915/gt: Check set_default_submission() before deferencing (medium 5.5)
- [CVE-2026-31539](https://insights.sbomify.com/CVE-2026-31539/): smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (high 7.5)
- [CVE-2026-31538](https://insights.sbomify.com/CVE-2026-31538/): smb: server: make use of smbdirect_socket.recv_io.credits.available (high 7.5)
- [CVE-2026-31537](https://insights.sbomify.com/CVE-2026-31537/): smb: server: make use of smbdirect_socket.send_io.bcredits (medium 5.5)
- [CVE-2026-31536](https://insights.sbomify.com/CVE-2026-31536/): smb: server: let send_done handle a completion without IB_SEND_SIGNALED (critical 9.8)
- [CVE-2026-31535](https://insights.sbomify.com/CVE-2026-31535/): smb: client: make use of smbdirect_socket.recv_io.credits.available (medium 4.7)
- [CVE-2026-31533](https://insights.sbomify.com/CVE-2026-31533/): net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (critical 9.8)
- [CVE-2026-31532](https://insights.sbomify.com/CVE-2026-31532/): can: raw: fix ro->uniq use-after-free in raw_rcv() (high 7.8)
- [CVE-2026-31531](https://insights.sbomify.com/CVE-2026-31531/): ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() (medium 5.5)
- [CVE-2026-31530](https://insights.sbomify.com/CVE-2026-31530/): cxl/port: Fix use after free of parent_port in cxl_detach_ep() (high 7.8)
- [CVE-2026-3153](https://insights.sbomify.com/CVE-2026-3153/): itsourcecode Document Management System register.php sql injection (medium 6.9)
- [CVE-2026-31529](https://insights.sbomify.com/CVE-2026-31529/): cxl/region: Fix leakage in __construct_region() (medium 5.5)
- [CVE-2026-31528](https://insights.sbomify.com/CVE-2026-31528/): perf: Make sure to use pmu_ctx->pmu for groups (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/728/