# Vulnerabilities published in 2026


- [CVE-2026-23451](https://insights.sbomify.com/CVE-2026-23451/): bonding: prevent potential infinite loop in bond_header_parse() (high 7.5)
- [CVE-2026-23450](https://insights.sbomify.com/CVE-2026-23450/): net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (critical 9.8)
- [CVE-2026-2345](https://insights.sbomify.com/CVE-2026-2345/): Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers (low 3.6)
- [CVE-2026-23449](https://insights.sbomify.com/CVE-2026-23449/): net/sched: teql: Fix double-free in teql_master_xmit (high 7.8)
- [CVE-2026-23448](https://insights.sbomify.com/CVE-2026-23448/): net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (high 7.8)
- [CVE-2026-23447](https://insights.sbomify.com/CVE-2026-23447/): net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (high 7.8)
- [CVE-2026-23446](https://insights.sbomify.com/CVE-2026-23446/): net: usb: aqc111: Do not perform PM inside suspend callback (medium 5.5)
- [CVE-2026-23445](https://insights.sbomify.com/CVE-2026-23445/): igc: fix page fault in XDP TX timestamps handling (high 7.8)
- [CVE-2026-23444](https://insights.sbomify.com/CVE-2026-23444/): wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure (high 7.8)
- [CVE-2026-23443](https://insights.sbomify.com/CVE-2026-23443/): ACPI: processor: Fix previous acpi_processor_errata_piix4() fix (medium 5.5)
- [CVE-2026-23442](https://insights.sbomify.com/CVE-2026-23442/): ipv6: add NULL checks for idev in SRv6 paths (medium 5.5)
- [CVE-2026-23441](https://insights.sbomify.com/CVE-2026-23441/): net/mlx5e: Prevent concurrent access to IPSec ASO context (medium 4.7)
- [CVE-2026-23440](https://insights.sbomify.com/CVE-2026-23440/): net/mlx5e: Fix race condition during IPSec ESN update (high 7.5)
- [CVE-2026-2344](https://insights.sbomify.com/CVE-2026-2344/): Stored XSS on Plunet BusinessManager (high 8.6)
- [CVE-2026-23439](https://insights.sbomify.com/CVE-2026-23439/): udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n (medium 5.5)
- [CVE-2026-23438](https://insights.sbomify.com/CVE-2026-23438/): net: mvpp2: guard flow control update with global_tx_fc in buffer switching (medium 5.5)
- [CVE-2026-23437](https://insights.sbomify.com/CVE-2026-23437/): net: shaper: protect late read accesses to the hierarchy (high 7.8)
- [CVE-2026-23436](https://insights.sbomify.com/CVE-2026-23436/): net: shaper: protect from late creation of hierarchy (medium 5.5)
- [CVE-2026-23435](https://insights.sbomify.com/CVE-2026-23435/): perf/x86: Move event pointer setup earlier in x86_pmu_enable() (medium 5.5)
- [CVE-2026-23434](https://insights.sbomify.com/CVE-2026-23434/): mtd: rawnand: serialize lock/unlock against other NAND operations (high 7.1)
- [CVE-2026-23433](https://insights.sbomify.com/CVE-2026-23433/): arm_mpam: Fix null pointer dereference when restoring bandwidth counters (medium 5.5)
- [CVE-2026-23432](https://insights.sbomify.com/CVE-2026-23432/): mshv: Fix use-after-free in mshv_map_user_memory error path (high 7.8)
- [CVE-2026-23431](https://insights.sbomify.com/CVE-2026-23431/): spi: amlogic-spisg: Fix memory leak in aml_spisg_probe() (medium 5.5)
- [CVE-2026-23430](https://insights.sbomify.com/CVE-2026-23430/): drm/vmwgfx: Don't overwrite KMS surface dirty tracker (medium 5.5)
- [CVE-2026-2343](https://insights.sbomify.com/CVE-2026-2343/): PeproDev Ultimate Invoice <= 2.2.5 - Unauthenticated Invoice Archive Download (medium 5.3)
- [CVE-2026-23429](https://insights.sbomify.com/CVE-2026-23429/): iommu/sva: Fix crash in iommu_sva_unbind_device() (high 7.8)
- [CVE-2026-23428](https://insights.sbomify.com/CVE-2026-23428/): ksmbd: fix use-after-free of share_conf in compound request (critical 9.8)
- [CVE-2026-23427](https://insights.sbomify.com/CVE-2026-23427/): ksmbd: fix use-after-free in durable v2 replay of active file handles (critical 9.8)
- [CVE-2026-23426](https://insights.sbomify.com/CVE-2026-23426/): drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse() (medium 5.5)
- [CVE-2026-23425](https://insights.sbomify.com/CVE-2026-23425/): KVM: arm64: Fix ID register initialization for non-protected pKVM guests (high 8.8)
- [CVE-2026-23424](https://insights.sbomify.com/CVE-2026-23424/): accel/amdxdna: Validate command buffer payload count (high 7.1)
- [CVE-2026-23423](https://insights.sbomify.com/CVE-2026-23423/): btrfs: free pages on error in btrfs_uring_read_extent() (medium 5.5)
- [CVE-2026-23422](https://insights.sbomify.com/CVE-2026-23422/): dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler (high 7.8)
- [CVE-2026-23421](https://insights.sbomify.com/CVE-2026-23421/): drm/xe/configfs: Free ctx_restore_mid_bb in release (medium 5.5)
- [CVE-2026-23420](https://insights.sbomify.com/CVE-2026-23420/): wifi: wlcore: Fix a locking bug (medium 5.5)
- [CVE-2026-2342](https://insights.sbomify.com/CVE-2026-2342/): XSS in Oceanicsoft's ValeApp (critical 9.3)
- [CVE-2026-23419](https://insights.sbomify.com/CVE-2026-23419/): net/rds: Fix circular locking dependency in rds_tcp_tune (high 7.5)
- [CVE-2026-23418](https://insights.sbomify.com/CVE-2026-23418/): drm/xe/reg_sr: Fix leak on xa_store failure (medium 5.5)
- [CVE-2026-23417](https://insights.sbomify.com/CVE-2026-23417/): bpf: Fix constant blinding for PROBE_MEM32 stores (medium 5.5)
- [CVE-2026-23416](https://insights.sbomify.com/CVE-2026-23416/): mm/mseal: update VMA end correctly on merge (medium 5.5)
- [CVE-2026-23415](https://insights.sbomify.com/CVE-2026-23415/): futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (high 7.8)
- [CVE-2026-23414](https://insights.sbomify.com/CVE-2026-23414/): tls: Purge async_hold in tls_decrypt_async_wait() (high 7.5)
- [CVE-2026-23413](https://insights.sbomify.com/CVE-2026-23413/): clsact: Fix use-after-free in init/destroy rollback asymmetry (high 7.8)
- [CVE-2026-23412](https://insights.sbomify.com/CVE-2026-23412/): netfilter: bpf: defer hook memory release until rcu readers are done (high 7.8)
- [CVE-2026-23411](https://insights.sbomify.com/CVE-2026-23411/): apparmor: fix race between freeing data and fs accessing it (high 7.8)
- [CVE-2026-23410](https://insights.sbomify.com/CVE-2026-23410/): apparmor: fix race on rawdata dereference (high 7.8)
- [CVE-2026-23409](https://insights.sbomify.com/CVE-2026-23409/): apparmor: fix differential encoding verification (medium 5.5)
- [CVE-2026-23408](https://insights.sbomify.com/CVE-2026-23408/): apparmor: Fix double free of ns_name in aa_replace_profiles() (high 7.8)
- [CVE-2026-23407](https://insights.sbomify.com/CVE-2026-23407/): apparmor: fix missing bounds check on DEFAULT table in verify_dfa() (high 7.8)
- [CVE-2026-23406](https://insights.sbomify.com/CVE-2026-23406/): apparmor: fix side-effect bug in match_char() macro usage (high 7.8)
- [CVE-2026-23405](https://insights.sbomify.com/CVE-2026-23405/): apparmor: fix: limit the number of levels of policy namespaces (medium 5.5)
- [CVE-2026-23404](https://insights.sbomify.com/CVE-2026-23404/): apparmor: replace recursive profile removal with iterative approach (medium 5.5)
- [CVE-2026-23403](https://insights.sbomify.com/CVE-2026-23403/): apparmor: fix memory leak in verify_header (medium 5.5)
- [CVE-2026-23402](https://insights.sbomify.com/CVE-2026-23402/): KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (medium 5.5)
- [CVE-2026-23401](https://insights.sbomify.com/CVE-2026-23401/): KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (medium 5.5)
- [CVE-2026-23400](https://insights.sbomify.com/CVE-2026-23400/): rust_binder: call set_notification_done() without proc lock (medium 5.5)
- [CVE-2026-2340](https://insights.sbomify.com/CVE-2026-2340/): Samba: vfs_worm does not block directory modification (medium 6.5)
- [CVE-2026-23399](https://insights.sbomify.com/CVE-2026-23399/): nf_tables: nft_dynset: fix possible stateful expression memleak in error path (medium 5.5)
- [CVE-2026-23398](https://insights.sbomify.com/CVE-2026-23398/): icmp: fix NULL pointer dereference in icmp_tag_validation() (medium 5.5)
- [CVE-2026-23397](https://insights.sbomify.com/CVE-2026-23397/): nfnetlink_osf: validate individual option lengths in fingerprints (high 7.1)
- [CVE-2026-23396](https://insights.sbomify.com/CVE-2026-23396/): wifi: mac80211: fix NULL deref in mesh_matches_local() (medium 5.5)
- [CVE-2026-23395](https://insights.sbomify.com/CVE-2026-23395/): Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ (high 8.8)
- [CVE-2026-23394](https://insights.sbomify.com/CVE-2026-23394/): af_unix: Give up GC if MSG_PEEK intervened. (medium 4.7)
- [CVE-2026-23393](https://insights.sbomify.com/CVE-2026-23393/): bridge: cfm: Fix race condition in peer_mep deletion (high 7.8)
- [CVE-2026-23392](https://insights.sbomify.com/CVE-2026-23392/): netfilter: nf_tables: release flowtable after rcu grace period on error (high 7.8)
- [CVE-2026-23391](https://insights.sbomify.com/CVE-2026-23391/): netfilter: xt_CT: drop pending enqueued packets on template removal (high 7.8)
- [CVE-2026-23390](https://insights.sbomify.com/CVE-2026-23390/): tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow (high 7.8)
- [CVE-2026-2339](https://insights.sbomify.com/CVE-2026-2339/): RCE in TUBITAK BILGEM's Liderahenk (high 7.5)
- [CVE-2026-23389](https://insights.sbomify.com/CVE-2026-23389/): ice: Fix memory leak in ice_set_ringparam() (medium 5.5)
- [CVE-2026-23388](https://insights.sbomify.com/CVE-2026-23388/): Squashfs: check metadata block offset is within range (high 7.1)
- [CVE-2026-23387](https://insights.sbomify.com/CVE-2026-23387/): pinctrl: cirrus: cs42l43: Fix double-put in cs42l43_pin_probe() (high 7.8)
- [CVE-2026-23386](https://insights.sbomify.com/CVE-2026-23386/): gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (medium 5.5)
- [CVE-2026-23385](https://insights.sbomify.com/CVE-2026-23385/): netfilter: nf_tables: clone set on flush only (medium 5.5)
- [CVE-2026-23384](https://insights.sbomify.com/CVE-2026-23384/): RDMA/ionic: Fix kernel stack leak in ionic_create_cq() (medium 5.5)
- [CVE-2026-23383](https://insights.sbomify.com/CVE-2026-23383/): bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing (high 7.8)
- [CVE-2026-23382](https://insights.sbomify.com/CVE-2026-23382/): HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them (medium 5.5)
- [CVE-2026-23381](https://insights.sbomify.com/CVE-2026-23381/): net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (medium 5.5)
- [CVE-2026-23380](https://insights.sbomify.com/CVE-2026-23380/): tracing: Fix WARN_ON in tracing_buffers_mmap_close (medium 5.5)
- [CVE-2026-23379](https://insights.sbomify.com/CVE-2026-23379/): net/sched: ets: fix divide by zero in the offload path (medium 5.5)
- [CVE-2026-23378](https://insights.sbomify.com/CVE-2026-23378/): net/sched: act_ife: Fix metalist update behavior (high 7.8)
- [CVE-2026-23377](https://insights.sbomify.com/CVE-2026-23377/): ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz (medium 5.5)
- [CVE-2026-23376](https://insights.sbomify.com/CVE-2026-23376/): nvmet-fcloop: Check remoteport port_state before calling done callback (medium 5.5)
- [CVE-2026-23375](https://insights.sbomify.com/CVE-2026-23375/): mm: thp: deny THP for files on anonymous inodes (medium 5.5)
- [CVE-2026-23374](https://insights.sbomify.com/CVE-2026-23374/): blktrace: fix __this_cpu_read/write in preemptible context (medium 5.5)
- [CVE-2026-23373](https://insights.sbomify.com/CVE-2026-23373/): wifi: rsi: Don't default to -EOPNOTSUPP in rsi_mac80211_config (medium 5.5)
- [CVE-2026-23372](https://insights.sbomify.com/CVE-2026-23372/): nfc: rawsock: cancel tx_work before socket teardown (high 7.8)
- [CVE-2026-23371](https://insights.sbomify.com/CVE-2026-23371/): sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting (medium 5.5)
- [CVE-2026-23370](https://insights.sbomify.com/CVE-2026-23370/): platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data (medium 5.5)
- [CVE-2026-2337](https://insights.sbomify.com/CVE-2026-2337/): Refleccted XSS on Plunet BusinessManager (high 8.7)
- [CVE-2026-23369](https://insights.sbomify.com/CVE-2026-23369/): i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (medium 5.5)
- [CVE-2026-23368](https://insights.sbomify.com/CVE-2026-23368/): net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (medium 5.5)
- [CVE-2026-23367](https://insights.sbomify.com/CVE-2026-23367/): wifi: radiotap: reject radiotap with unknown bits (medium 5.5)
- [CVE-2026-23366](https://insights.sbomify.com/CVE-2026-23366/): drm/client: Do not destroy NULL modes (medium 5.5)
- [CVE-2026-23365](https://insights.sbomify.com/CVE-2026-23365/): net: usb: kalmia: validate USB endpoints (medium 5.5)
- [CVE-2026-23364](https://insights.sbomify.com/CVE-2026-23364/): ksmbd: Compare MACs in constant time (high 7.4)
- [CVE-2026-23363](https://insights.sbomify.com/CVE-2026-23363/): wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() (high 7.1)
- [CVE-2026-23362](https://insights.sbomify.com/CVE-2026-23362/): can: bcm: fix locking for bcm_op runtime updates (medium 5.5)
- [CVE-2026-23361](https://insights.sbomify.com/CVE-2026-23361/): PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry (high 7.8)
- [CVE-2026-23360](https://insights.sbomify.com/CVE-2026-23360/): nvme: fix admin queue leak on controller reset (medium 5.5)
- [CVE-2026-2336](https://insights.sbomify.com/CVE-2026-2336/): Weak webstax_auth Cookie Authentication Allows Privilege Escalation (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/789/