# Vulnerabilities published in 2026


- [CVE-2026-23359](https://insights.sbomify.com/CVE-2026-23359/): bpf: Fix stack-out-of-bounds write in devmap (high 7.8)
- [CVE-2026-23358](https://insights.sbomify.com/CVE-2026-23358/): drm/amdgpu: Fix error handling in slot reset (medium 5.5)
- [CVE-2026-23357](https://insights.sbomify.com/CVE-2026-23357/): can: mcp251x: fix deadlock in error path of mcp251x_open (medium 5.5)
- [CVE-2026-23356](https://insights.sbomify.com/CVE-2026-23356/): drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() (medium 5.5)
- [CVE-2026-23355](https://insights.sbomify.com/CVE-2026-23355/): ata: libata: cancel pending work after clearing deferred_qc (medium 5.5)
- [CVE-2026-23354](https://insights.sbomify.com/CVE-2026-23354/): x86/fred: Correct speculative safety in fred_extint() (high 7.8)
- [CVE-2026-23353](https://insights.sbomify.com/CVE-2026-23353/): ice: fix crash in ethtool offline loopback test (medium 5.5)
- [CVE-2026-23352](https://insights.sbomify.com/CVE-2026-23352/): x86/efi: defer freeing of boot services memory (medium 5.5)
- [CVE-2026-23351](https://insights.sbomify.com/CVE-2026-23351/): netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (high 7.8)
- [CVE-2026-23350](https://insights.sbomify.com/CVE-2026-23350/): drm/xe/queue: Call fini on exec queue creation fail (high 7.8)
- [CVE-2026-23349](https://insights.sbomify.com/CVE-2026-23349/): HID: pidff: Fix condition effect bit clearing (medium 5.5)
- [CVE-2026-23348](https://insights.sbomify.com/CVE-2026-23348/): cxl: Fix race of nvdimm_bus object when creating nvdimm objects (medium 4.7)
- [CVE-2026-23347](https://insights.sbomify.com/CVE-2026-23347/): can: usb: f81604: correctly anchor the urb in the read bulk callback (medium 5.5)
- [CVE-2026-23346](https://insights.sbomify.com/CVE-2026-23346/): arm64: io: Extract user memory type in ioremap_prot() (medium 5.5)
- [CVE-2026-23345](https://insights.sbomify.com/CVE-2026-23345/): arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled (medium 5.5)
- [CVE-2026-23344](https://insights.sbomify.com/CVE-2026-23344/): crypto: ccp - Fix use-after-free on error path (high 7.8)
- [CVE-2026-23343](https://insights.sbomify.com/CVE-2026-23343/): xdp: produce a warning when calculated tailroom is negative (high 7.8)
- [CVE-2026-23342](https://insights.sbomify.com/CVE-2026-23342/): bpf: Fix race in cpumap on PREEMPT_RT (medium 4.7)
- [CVE-2026-23341](https://insights.sbomify.com/CVE-2026-23341/): accel/amdxdna: Fix crash when destroying a suspended hardware context (medium 5.5)
- [CVE-2026-23340](https://insights.sbomify.com/CVE-2026-23340/): net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (high 7.8)
- [CVE-2026-2334](https://insights.sbomify.com/CVE-2026-2334/): ) Missing Server-Side File Extension Validation in vsDesk (critical 9.4)
- [CVE-2026-23339](https://insights.sbomify.com/CVE-2026-23339/): nfc: nci: free skb on nci_transceive early error paths (medium 5.5)
- [CVE-2026-23338](https://insights.sbomify.com/CVE-2026-23338/): drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings (medium 5.5)
- [CVE-2026-23337](https://insights.sbomify.com/CVE-2026-23337/): pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() (medium 5.5)
- [CVE-2026-23336](https://insights.sbomify.com/CVE-2026-23336/): wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() (high 7.8)
- [CVE-2026-23335](https://insights.sbomify.com/CVE-2026-23335/): RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() (medium 5.5)
- [CVE-2026-23334](https://insights.sbomify.com/CVE-2026-23334/): can: usb: f81604: handle short interrupt urb messages properly (medium 5.5)
- [CVE-2026-23332](https://insights.sbomify.com/CVE-2026-23332/): cpufreq: intel_pstate: Fix crash during turbo disable (medium 5.5)
- [CVE-2026-23331](https://insights.sbomify.com/CVE-2026-23331/): udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected. (medium 5.5)
- [CVE-2026-23330](https://insights.sbomify.com/CVE-2026-23330/): nfc: nci: complete pending data exchange on device close (medium 5.5)
- [CVE-2026-2333](https://insights.sbomify.com/CVE-2026-2333/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds (critical 9.2)
- [CVE-2026-23329](https://insights.sbomify.com/CVE-2026-23329/): libie: don't unroll if fwlog isn't supported (medium 5.5)
- [CVE-2026-23328](https://insights.sbomify.com/CVE-2026-23328/): accel/amdxdna: Fix NULL pointer dereference of mgmt_chann (medium 5.5)
- [CVE-2026-23327](https://insights.sbomify.com/CVE-2026-23327/): cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() (high 7.1)
- [CVE-2026-23326](https://insights.sbomify.com/CVE-2026-23326/): xsk: Fix fragment node deletion to prevent buffer leak (high 7.8)
- [CVE-2026-23325](https://insights.sbomify.com/CVE-2026-23325/): wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211() (high 7.1)
- [CVE-2026-23324](https://insights.sbomify.com/CVE-2026-23324/): can: usb: etas_es58x: correctly anchor the urb in the read bulk callback (medium 5.5)
- [CVE-2026-23323](https://insights.sbomify.com/CVE-2026-23323/): hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver (high 7.8)
- [CVE-2026-23322](https://insights.sbomify.com/CVE-2026-23322/): ipmi: Fix use-after-free and list corruption on sender error (high 7.8)
- [CVE-2026-23321](https://insights.sbomify.com/CVE-2026-23321/): mptcp: pm: in-kernel: always mark signal+subflow endp as used (medium 5.5)
- [CVE-2026-2332](https://insights.sbomify.com/CVE-2026-2332/): HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (high 7.4)
- [CVE-2026-23319](https://insights.sbomify.com/CVE-2026-23319/): bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim (high 7.8)
- [CVE-2026-23318](https://insights.sbomify.com/CVE-2026-23318/): ALSA: usb-audio: Use correct version for UAC3 header validation (high 7.1)
- [CVE-2026-23317](https://insights.sbomify.com/CVE-2026-23317/): drm/vmwgfx: Return the correct value in vmw_translate_ptr functions (high 7.8)
- [CVE-2026-23316](https://insights.sbomify.com/CVE-2026-23316/): net: ipv4: fix ARM64 alignment fault in multipath hash seed (medium 5.5)
- [CVE-2026-23315](https://insights.sbomify.com/CVE-2026-23315/): wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() (high 7.1)
- [CVE-2026-23314](https://insights.sbomify.com/CVE-2026-23314/): regulator: bq257xx: Fix device node reference leak in bq257xx_reg_dt_parse_gpio() (medium 5.5)
- [CVE-2026-23313](https://insights.sbomify.com/CVE-2026-23313/): i40e: Fix preempt count leak in napi poll tracepoint (medium 5.5)
- [CVE-2026-23312](https://insights.sbomify.com/CVE-2026-23312/): net: usb: kaweth: validate USB endpoints (medium 5.5)
- [CVE-2026-23311](https://insights.sbomify.com/CVE-2026-23311/): perf/core: Fix invalid wait context in ctx_sched_in() (medium 5.5)
- [CVE-2026-23310](https://insights.sbomify.com/CVE-2026-23310/): bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded (medium 5.5)
- [CVE-2026-2331](https://insights.sbomify.com/CVE-2026-2331/): CVE-2026-2331 (critical 9.8)
- [CVE-2026-23309](https://insights.sbomify.com/CVE-2026-23309/): tracing: Add NULL pointer check to trigger_data_free() (medium 5.5)
- [CVE-2026-23308](https://insights.sbomify.com/CVE-2026-23308/): pinctrl: equilibrium: fix warning trace on load (medium 5.5)
- [CVE-2026-23307](https://insights.sbomify.com/CVE-2026-23307/): can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message (medium 5.5)
- [CVE-2026-23306](https://insights.sbomify.com/CVE-2026-23306/): scsi: pm8001: Fix use-after-free in pm8001_queue_command() (high 7.8)
- [CVE-2026-23305](https://insights.sbomify.com/CVE-2026-23305/): accel/rocket: fix unwinding in error path in rocket_probe (high 7.1)
- [CVE-2026-23304](https://insights.sbomify.com/CVE-2026-23304/): ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() (medium 5.5)
- [CVE-2026-23303](https://insights.sbomify.com/CVE-2026-23303/): smb: client: Don't log plaintext credentials in cifs_set_cifscreds (medium 5.5)
- [CVE-2026-23302](https://insights.sbomify.com/CVE-2026-23302/): net: annotate data-races around sk->sk_{data_ready,write_space} (medium 4.7)
- [CVE-2026-23301](https://insights.sbomify.com/CVE-2026-23301/): ASoC: SDCA: Add allocation failure check for Entity name (medium 5.5)
- [CVE-2026-23300](https://insights.sbomify.com/CVE-2026-23300/): net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (medium 5.5)
- [CVE-2026-2330](https://insights.sbomify.com/CVE-2026-2330/): CVE-2026-2330 (critical 9.4)
- [CVE-2026-23299](https://insights.sbomify.com/CVE-2026-23299/): Bluetooth: purge error queues in socket destructors (medium 5.5)
- [CVE-2026-23298](https://insights.sbomify.com/CVE-2026-23298/): can: ucan: Fix infinite loop from zero-length messages (medium 5.5)
- [CVE-2026-23297](https://insights.sbomify.com/CVE-2026-23297/): nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit(). (medium 5.5)
- [CVE-2026-23296](https://insights.sbomify.com/CVE-2026-23296/): scsi: core: Fix refcount leak for tagset_refcnt (medium 5.5)
- [CVE-2026-23295](https://insights.sbomify.com/CVE-2026-23295/): accel/amdxdna: Fix dead lock for suspend and resume (medium 5.5)
- [CVE-2026-23294](https://insights.sbomify.com/CVE-2026-23294/): bpf: Fix race in devmap on PREEMPT_RT (high 7.0)
- [CVE-2026-23293](https://insights.sbomify.com/CVE-2026-23293/): net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled (medium 5.5)
- [CVE-2026-23292](https://insights.sbomify.com/CVE-2026-23292/): scsi: target: Fix recursive locking in __configfs_open_file() (medium 5.5)
- [CVE-2026-23291](https://insights.sbomify.com/CVE-2026-23291/): nfc: pn533: properly drop the usb interface reference on disconnect (medium 5.5)
- [CVE-2026-23290](https://insights.sbomify.com/CVE-2026-23290/): net: usb: pegasus: validate USB endpoints (medium 5.5)
- [CVE-2026-2329](https://insights.sbomify.com/CVE-2026-2329/): Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow (critical 9.3)
- [CVE-2026-23289](https://insights.sbomify.com/CVE-2026-23289/): IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq() (medium 5.5)
- [CVE-2026-23288](https://insights.sbomify.com/CVE-2026-23288/): accel/amdxdna: Fix out-of-bounds memset in command slot handling (high 7.8)
- [CVE-2026-23287](https://insights.sbomify.com/CVE-2026-23287/): irqchip/sifive-plic: Fix frozen interrupt due to affinity setting (medium 5.5)
- [CVE-2026-23286](https://insights.sbomify.com/CVE-2026-23286/): atm: lec: fix null-ptr-deref in lec_arp_clear_vccs (medium 5.5)
- [CVE-2026-23285](https://insights.sbomify.com/CVE-2026-23285/): drbd: fix null-pointer dereference on local read error (medium 5.5)
- [CVE-2026-23284](https://insights.sbomify.com/CVE-2026-23284/): net: ethernet: mtk_eth_soc: Reset prog ptr to old_prog in case of error in mtk_xdp_setup() (medium 5.5)
- [CVE-2026-23283](https://insights.sbomify.com/CVE-2026-23283/): regulator: fp9931: Fix PM runtime reference leak in fp9931_hwmon_read() (medium 5.5)
- [CVE-2026-23282](https://insights.sbomify.com/CVE-2026-23282/): smb: client: fix oops due to uninitialised var in smb2_unlink() (medium 5.5)
- [CVE-2026-23281](https://insights.sbomify.com/CVE-2026-23281/): wifi: libertas: fix use-after-free in lbs_free_adapter() (high 7.8)
- [CVE-2026-23280](https://insights.sbomify.com/CVE-2026-23280/): accel/amdxdna: Prevent ubuf size overflow (high 7.8)
- [CVE-2026-2328](https://insights.sbomify.com/CVE-2026-2328/): Backend Access Due to Insufficient Input Validation (high 7.5)
- [CVE-2026-23279](https://insights.sbomify.com/CVE-2026-23279/): wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame() (medium 5.5)
- [CVE-2026-23278](https://insights.sbomify.com/CVE-2026-23278/): netfilter: nf_tables: always walk all pending catchall elements (high 7.8)
- [CVE-2026-23277](https://insights.sbomify.com/CVE-2026-23277/): net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit (medium 5.5)
- [CVE-2026-23276](https://insights.sbomify.com/CVE-2026-23276/): net: add xmit recursion limit to tunnel xmit functions (medium 5.5)
- [CVE-2026-23275](https://insights.sbomify.com/CVE-2026-23275/): io_uring: ensure ctx->rings is stable for task work flags manipulation (high 7.8)
- [CVE-2026-23274](https://insights.sbomify.com/CVE-2026-23274/): netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels (high 7.8)
- [CVE-2026-23273](https://insights.sbomify.com/CVE-2026-23273/): macvlan: observe an RCU grace period in macvlan_common_newlink() error path (high 7.8)
- [CVE-2026-23272](https://insights.sbomify.com/CVE-2026-23272/): netfilter: nf_tables: unconditionally bump set->nelems before insertion (high 7.8)
- [CVE-2026-23271](https://insights.sbomify.com/CVE-2026-23271/): perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (high 7.8)
- [CVE-2026-23270](https://insights.sbomify.com/CVE-2026-23270/): net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (high 7.8)
- [CVE-2026-2327](https://insights.sbomify.com/CVE-2026-2327/): markdown-it is has a Regular Expression Denial of Service (ReDoS) (medium 6.9)
- [CVE-2026-23269](https://insights.sbomify.com/CVE-2026-23269/): apparmor: validate DFA start states are in bounds in unpack_pdb (high 7.1)
- [CVE-2026-23268](https://insights.sbomify.com/CVE-2026-23268/): apparmor: fix unprivileged local user can do privileged policy management (high 7.8)
- [CVE-2026-23267](https://insights.sbomify.com/CVE-2026-23267/): f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes (medium 5.5)
- [CVE-2026-23266](https://insights.sbomify.com/CVE-2026-23266/): fbdev: rivafb: fix divide error in nv3_arb() (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/790/