# Vulnerabilities published in 2026


- [CVE-2026-31527](https://insights.sbomify.com/CVE-2026-31527/): driver core: platform: use generic driver_override infrastructure (high 7.8)
- [CVE-2026-31526](https://insights.sbomify.com/CVE-2026-31526/): bpf: Fix exception exit lock checking for subprogs (medium 5.5)
- [CVE-2026-31525](https://insights.sbomify.com/CVE-2026-31525/): bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN (high 7.8)
- [CVE-2026-31524](https://insights.sbomify.com/CVE-2026-31524/): HID: asus: avoid memory leak in asus_report_fixup() (medium 5.5)
- [CVE-2026-31523](https://insights.sbomify.com/CVE-2026-31523/): nvme-pci: ensure we're polling a polled queue (medium 4.7)
- [CVE-2026-31522](https://insights.sbomify.com/CVE-2026-31522/): HID: magicmouse: avoid memory leak in magicmouse_report_fixup() (medium 5.5)
- [CVE-2026-31521](https://insights.sbomify.com/CVE-2026-31521/): module: Fix kernel panic when a symbol st_shndx is out of bounds (medium 5.5)
- [CVE-2026-31520](https://insights.sbomify.com/CVE-2026-31520/): HID: apple: avoid memory leak in apple_report_fixup() (medium 5.5)
- [CVE-2026-3152](https://insights.sbomify.com/CVE-2026-3152/): itsourcecode College Management System teacher-salary.php sql injection (medium 6.9)
- [CVE-2026-31519](https://insights.sbomify.com/CVE-2026-31519/): btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create (medium 5.5)
- [CVE-2026-31518](https://insights.sbomify.com/CVE-2026-31518/): esp: fix skb leak with espintcp and async crypto (medium 5.5)
- [CVE-2026-31517](https://insights.sbomify.com/CVE-2026-31517/): xfrm: iptfs: fix skb_put() panic on non-linear skb during reassembly (medium 5.5)
- [CVE-2026-31516](https://insights.sbomify.com/CVE-2026-31516/): xfrm: prevent policy_hthresh.work from racing with netns teardown (high 7.8)
- [CVE-2026-31515](https://insights.sbomify.com/CVE-2026-31515/): af_key: validate families in pfkey_send_migrate() (medium 5.5)
- [CVE-2026-31514](https://insights.sbomify.com/CVE-2026-31514/): erofs: set fileio bio failed in short read case (medium 5.5)
- [CVE-2026-31513](https://insights.sbomify.com/CVE-2026-31513/): Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req (high 8.1)
- [CVE-2026-31512](https://insights.sbomify.com/CVE-2026-31512/): Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() (medium 5.5)
- [CVE-2026-31511](https://insights.sbomify.com/CVE-2026-31511/): Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (high 7.8)
- [CVE-2026-31510](https://insights.sbomify.com/CVE-2026-31510/): Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb (medium 5.5)
- [CVE-2026-3151](https://insights.sbomify.com/CVE-2026-3151/): itsourcecode College Management System login.php sql injection (medium 6.9)
- [CVE-2026-31509](https://insights.sbomify.com/CVE-2026-31509/): nfc: nci: fix circular locking dependency in nci_close_device (medium 5.5)
- [CVE-2026-31508](https://insights.sbomify.com/CVE-2026-31508/): net: openvswitch: Avoid releasing netdev before teardown completes (high 7.8)
- [CVE-2026-31507](https://insights.sbomify.com/CVE-2026-31507/): net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer (high 7.8)
- [CVE-2026-31506](https://insights.sbomify.com/CVE-2026-31506/): net: bcmasp: fix double free of WoL irq (high 7.8)
- [CVE-2026-31505](https://insights.sbomify.com/CVE-2026-31505/): iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() (high 7.8)
- [CVE-2026-31504](https://insights.sbomify.com/CVE-2026-31504/): net: fix fanout UAF in packet_release() via NETDEV_UP race (high 7.8)
- [CVE-2026-31503](https://insights.sbomify.com/CVE-2026-31503/): udp: Fix wildcard bind conflict check when using hash2 (medium 5.5)
- [CVE-2026-31502](https://insights.sbomify.com/CVE-2026-31502/): team: fix header_ops type confusion with non-Ethernet ports (high 7.8)
- [CVE-2026-31501](https://insights.sbomify.com/CVE-2026-31501/): net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path (critical 9.8)
- [CVE-2026-31500](https://insights.sbomify.com/CVE-2026-31500/): Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock (high 7.8)
- [CVE-2026-3150](https://insights.sbomify.com/CVE-2026-3150/): itsourcecode College Management System display-teacher.php sql injection (medium 5.3)
- [CVE-2026-31499](https://insights.sbomify.com/CVE-2026-31499/): Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() (medium 5.5)
- [CVE-2026-31498](https://insights.sbomify.com/CVE-2026-31498/): Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop (medium 5.5)
- [CVE-2026-31497](https://insights.sbomify.com/CVE-2026-31497/): Bluetooth: btusb: clamp SCO altsetting table indices (medium 5.5)
- [CVE-2026-31496](https://insights.sbomify.com/CVE-2026-31496/): netfilter: nf_conntrack_expect: skip expectations in other netns via proc (medium 5.5)
- [CVE-2026-31495](https://insights.sbomify.com/CVE-2026-31495/): netfilter: ctnetlink: use netlink policy range checks (medium 5.5)
- [CVE-2026-31494](https://insights.sbomify.com/CVE-2026-31494/): net: macb: use the current queue number for stats (high 7.8)
- [CVE-2026-31493](https://insights.sbomify.com/CVE-2026-31493/): RDMA/efa: Fix use of completion ctx after free (high 7.8)
- [CVE-2026-31492](https://insights.sbomify.com/CVE-2026-31492/): RDMA/irdma: Initialize free_qp completion before using it (medium 5.5)
- [CVE-2026-31491](https://insights.sbomify.com/CVE-2026-31491/): RDMA/irdma: Harden depth calculation functions (medium 5.5)
- [CVE-2026-31490](https://insights.sbomify.com/CVE-2026-31490/): drm/xe/pf: Fix use-after-free in migration restore (high 7.8)
- [CVE-2026-3149](https://insights.sbomify.com/CVE-2026-3149/): itsourcecode College Management System asign-single-student-subjects.php sql injection (medium 5.3)
- [CVE-2026-31489](https://insights.sbomify.com/CVE-2026-31489/): spi: meson-spicc: Fix double-put in remove path (high 7.8)
- [CVE-2026-31488](https://insights.sbomify.com/CVE-2026-31488/): drm/amd/display: Do not skip unrelated mode changes in DSC validation (high 7.8)
- [CVE-2026-31487](https://insights.sbomify.com/CVE-2026-31487/): spi: use generic driver_override infrastructure (medium 5.5)
- [CVE-2026-31486](https://insights.sbomify.com/CVE-2026-31486/): hwmon: (pmbus/core) Protect regulator operations with mutex (high 7.1)
- [CVE-2026-31485](https://insights.sbomify.com/CVE-2026-31485/): spi: spi-fsl-lpspi: fix teardown order issue (UAF) (high 7.8)
- [CVE-2026-31484](https://insights.sbomify.com/CVE-2026-31484/): io_uring/fdinfo: fix OOB read in SQE_MIXED wrap check (high 7.1)
- [CVE-2026-31483](https://insights.sbomify.com/CVE-2026-31483/): s390/syscalls: Add spectre boundary for syscall dispatch table (medium 5.5)
- [CVE-2026-31482](https://insights.sbomify.com/CVE-2026-31482/): s390/entry: Scrub r12 register on kernel entry (medium 5.5)
- [CVE-2026-31481](https://insights.sbomify.com/CVE-2026-31481/): tracing: Drain deferred trigger frees if kthread creation fails (medium 5.5)
- [CVE-2026-31480](https://insights.sbomify.com/CVE-2026-31480/): tracing: Fix potential deadlock in cpu hotplug with osnoise (medium 5.5)
- [CVE-2026-3148](https://insights.sbomify.com/CVE-2026-3148/): SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection (medium 6.9)
- [CVE-2026-31479](https://insights.sbomify.com/CVE-2026-31479/): drm/xe: always keep track of remap prev/next (high 7.8)
- [CVE-2026-31478](https://insights.sbomify.com/CVE-2026-31478/): ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() (critical 9.8)
- [CVE-2026-31477](https://insights.sbomify.com/CVE-2026-31477/): ksmbd: fix memory leaks and NULL deref in smb2_lock() (high 7.5)
- [CVE-2026-31476](https://insights.sbomify.com/CVE-2026-31476/): ksmbd: do not expire session on binding failure (high 8.2)
- [CVE-2026-31475](https://insights.sbomify.com/CVE-2026-31475/): ASoC: sma1307: fix double free of devm_kzalloc() memory (high 7.8)
- [CVE-2026-31474](https://insights.sbomify.com/CVE-2026-31474/): can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (high 7.8)
- [CVE-2026-31473](https://insights.sbomify.com/CVE-2026-31473/): media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex (high 7.8)
- [CVE-2026-31472](https://insights.sbomify.com/CVE-2026-31472/): xfrm: iptfs: validate inner IPv4 header length in IPTFS payload (medium 5.5)
- [CVE-2026-31471](https://insights.sbomify.com/CVE-2026-31471/): xfrm: iptfs: only publish mode_data after clone setup (high 7.8)
- [CVE-2026-31470](https://insights.sbomify.com/CVE-2026-31470/): virt: tdx-guest: Fix handling of host controlled 'quote' buffer length (high 7.1)
- [CVE-2026-3147](https://insights.sbomify.com/CVE-2026-3147/): libvips csvload.c vips_foreign_load_csv_build heap-based overflow (medium 4.8)
- [CVE-2026-31469](https://insights.sbomify.com/CVE-2026-31469/): virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false (high 7.8)
- [CVE-2026-31468](https://insights.sbomify.com/CVE-2026-31468/): vfio/pci: Fix double free in dma-buf feature (high 7.8)
- [CVE-2026-31467](https://insights.sbomify.com/CVE-2026-31467/): erofs: add GFP_NOIO in the bio completion if needed (high 7.5)
- [CVE-2026-31466](https://insights.sbomify.com/CVE-2026-31466/): mm/huge_memory: fix folio isn't locked in softleaf_to_folio() (medium 4.7)
- [CVE-2026-31465](https://insights.sbomify.com/CVE-2026-31465/): writeback: don't block sync for filesystems with no data integrity guarantees (medium 5.5)
- [CVE-2026-31464](https://insights.sbomify.com/CVE-2026-31464/): scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done() (high 8.1)
- [CVE-2026-31463](https://insights.sbomify.com/CVE-2026-31463/): iomap: fix invalid folio access when i_blkbits differs from I/O granularity (critical 9.8)
- [CVE-2026-31462](https://insights.sbomify.com/CVE-2026-31462/): drm/amdgpu: prevent immediate PASID reuse case (medium 5.5)
- [CVE-2026-31461](https://insights.sbomify.com/CVE-2026-31461/): drm/amd/display: Fix drm_edid leak in amdgpu_dm (medium 5.5)
- [CVE-2026-31460](https://insights.sbomify.com/CVE-2026-31460/): drm/amd/display: check if ext_caps is valid in BL setup (medium 5.5)
- [CVE-2026-3146](https://insights.sbomify.com/CVE-2026-3146/): libvips matrixload.c vips_foreign_load_matrix_header null pointer dereference (medium 4.8)
- [CVE-2026-31459](https://insights.sbomify.com/CVE-2026-31459/): mm/damon/sysfs: fix param_ctx leak on damon_sysfs_new_test_ctx() failure (medium 5.5)
- [CVE-2026-31458](https://insights.sbomify.com/CVE-2026-31458/): mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] (medium 5.5)
- [CVE-2026-31457](https://insights.sbomify.com/CVE-2026-31457/): mm/damon/sysfs: check contexts->nr in repeat_call_fn (medium 5.5)
- [CVE-2026-31456](https://insights.sbomify.com/CVE-2026-31456/): mm/pagewalk: fix race between concurrent split and refault (medium 4.7)
- [CVE-2026-31455](https://insights.sbomify.com/CVE-2026-31455/): xfs: stop reclaim before pushing AIL during unmount (high 7.8)
- [CVE-2026-31454](https://insights.sbomify.com/CVE-2026-31454/): xfs: save ailp before dropping the AIL lock in push callbacks (high 7.8)
- [CVE-2026-31453](https://insights.sbomify.com/CVE-2026-31453/): xfs: avoid dereferencing log items after push callbacks (high 7.8)
- [CVE-2026-31452](https://insights.sbomify.com/CVE-2026-31452/): ext4: convert inline data to extents when truncate exceeds inline size (high 7.8)
- [CVE-2026-31451](https://insights.sbomify.com/CVE-2026-31451/): ext4: replace BUG_ON with proper error handling in ext4_read_inline_folio (medium 5.5)
- [CVE-2026-31450](https://insights.sbomify.com/CVE-2026-31450/): ext4: publish jinode after initialization (high 8.8)
- [CVE-2026-3145](https://insights.sbomify.com/CVE-2026-3145/): libvips matrixload.c vips_foreign_load_matrix_header memory corruption (medium 4.8)
- [CVE-2026-31449](https://insights.sbomify.com/CVE-2026-31449/): ext4: validate p_idx bounds in ext4_ext_correct_indexes (high 7.8)
- [CVE-2026-31448](https://insights.sbomify.com/CVE-2026-31448/): ext4: avoid infinite loops caused by residual data (critical 9.4)
- [CVE-2026-31447](https://insights.sbomify.com/CVE-2026-31447/): ext4: reject mount if bigalloc with s_first_data_block != 0 (high 7.8)
- [CVE-2026-31446](https://insights.sbomify.com/CVE-2026-31446/): ext4: fix use-after-free in update_super_work when racing with umount (high 7.8)
- [CVE-2026-31445](https://insights.sbomify.com/CVE-2026-31445/): mm/damon/core: avoid use of half-online-committed context (medium 5.5)
- [CVE-2026-31444](https://insights.sbomify.com/CVE-2026-31444/): ksmbd: fix use-after-free and NULL deref in smb_grant_oplock() (critical 9.8)
- [CVE-2026-31443](https://insights.sbomify.com/CVE-2026-31443/): dmaengine: idxd: Fix crash when the event log is disabled (medium 5.5)
- [CVE-2026-31442](https://insights.sbomify.com/CVE-2026-31442/): dmaengine: idxd: Fix possible invalid memory access after FLR (high 7.8)
- [CVE-2026-31441](https://insights.sbomify.com/CVE-2026-31441/): dmaengine: idxd: Fix memory leak when a wq is reset (medium 5.5)
- [CVE-2026-31440](https://insights.sbomify.com/CVE-2026-31440/): dmaengine: idxd: Fix leaking event log memory (medium 5.5)
- [CVE-2026-3144](https://insights.sbomify.com/CVE-2026-3144/): IBM API Connect Default Credentials (high 8.1)
- [CVE-2026-31439](https://insights.sbomify.com/CVE-2026-31439/): dmaengine: xilinx: xdma: Fix regmap init error handling (medium 5.5)
- [CVE-2026-31438](https://insights.sbomify.com/CVE-2026-31438/): netfs: Fix kernel BUG in netfs_limit_iter() for ITER_KVEC iterators (medium 5.5)
- [CVE-2026-31437](https://insights.sbomify.com/CVE-2026-31437/): netfs: Fix NULL pointer dereference in netfs_unbuffered_write() on retry (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/729/