# Vulnerabilities published in 2026


- [CVE-2026-23265](https://insights.sbomify.com/CVE-2026-23265/): f2fs: fix to do sanity check on node footer in {read,write}_end_io (medium 5.5)
- [CVE-2026-23264](https://insights.sbomify.com/CVE-2026-23264/): Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" (medium 5.5)
- [CVE-2026-23263](https://insights.sbomify.com/CVE-2026-23263/): io_uring/zcrx: fix page array leak (medium 5.5)
- [CVE-2026-23262](https://insights.sbomify.com/CVE-2026-23262/): gve: Fix stats report corruption on queue count change (high 7.8)
- [CVE-2026-23261](https://insights.sbomify.com/CVE-2026-23261/): nvme-fc: release admin tagset if init fails (medium 5.5)
- [CVE-2026-23260](https://insights.sbomify.com/CVE-2026-23260/): regmap: maple: free entry on mas_store_gfp() failure (medium 5.5)
- [CVE-2026-23259](https://insights.sbomify.com/CVE-2026-23259/): io_uring/rw: free potentially allocated iovec on cache put failure (medium 5.5)
- [CVE-2026-23258](https://insights.sbomify.com/CVE-2026-23258/): net: liquidio: Initialize netdev pointer before queue setup (medium 5.5)
- [CVE-2026-23257](https://insights.sbomify.com/CVE-2026-23257/): net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (medium 5.5)
- [CVE-2026-23256](https://insights.sbomify.com/CVE-2026-23256/): net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (medium 5.5)
- [CVE-2026-23255](https://insights.sbomify.com/CVE-2026-23255/): net: add proper RCU protection to /proc/net/ptype (medium 5.5)
- [CVE-2026-23254](https://insights.sbomify.com/CVE-2026-23254/): net: gro: fix outer network offset (medium 5.5)
- [CVE-2026-23253](https://insights.sbomify.com/CVE-2026-23253/): media: dvb-core: fix wrong reinitialization of ringbuffer on reopen (high 7.8)
- [CVE-2026-23252](https://insights.sbomify.com/CVE-2026-23252/): xfs: get rid of the xchk_xfile_*_descr calls (medium 5.5)
- [CVE-2026-23251](https://insights.sbomify.com/CVE-2026-23251/): xfs: only call xf{array,blob}_destroy if we have a valid pointer (medium 5.5)
- [CVE-2026-23250](https://insights.sbomify.com/CVE-2026-23250/): xfs: check return value of xchk_scrub_create_subord (medium 5.5)
- [CVE-2026-2325](https://insights.sbomify.com/CVE-2026-2325/): Improper Input Validation in MS Teams Meetings API Handler (medium 4.3)
- [CVE-2026-23249](https://insights.sbomify.com/CVE-2026-23249/): xfs: check for deleted cursors when revalidating two btrees (medium 5.5)
- [CVE-2026-23248](https://insights.sbomify.com/CVE-2026-23248/): perf/core: Fix refcount bug and potential UAF in perf_mmap (high 7.8)
- [CVE-2026-23247](https://insights.sbomify.com/CVE-2026-23247/): tcp: secure_seq: add back ports to TS offset (medium 5.5)
- [CVE-2026-23246](https://insights.sbomify.com/CVE-2026-23246/): wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration (high 8.8)
- [CVE-2026-23245](https://insights.sbomify.com/CVE-2026-23245/): net/sched: act_gate: snapshot parameters with RCU on replace (high 7.8)
- [CVE-2026-23244](https://insights.sbomify.com/CVE-2026-23244/): nvme: fix memory allocation in nvme_pr_read_keys() (high 7.1)
- [CVE-2026-23243](https://insights.sbomify.com/CVE-2026-23243/): RDMA/umad: Reject negative data_len in ib_umad_write (high 7.8)
- [CVE-2026-23242](https://insights.sbomify.com/CVE-2026-23242/): RDMA/siw: Fix potential NULL pointer dereference in header processing (high 7.5)
- [CVE-2026-23241](https://insights.sbomify.com/CVE-2026-23241/): audit: add missing syscalls to read class (medium 5.5)
- [CVE-2026-23240](https://insights.sbomify.com/CVE-2026-23240/): tls: Fix race condition in tls_sw_cancel_work_tx() (critical 9.8)
- [CVE-2026-2324](https://insights.sbomify.com/CVE-2026-2324/): Cross-site request forgery in LatePoint – Calendar Booking Plugin for Appointments and Events (medium 6.1)
- [CVE-2026-23239](https://insights.sbomify.com/CVE-2026-23239/): espintcp: Fix race condition in espintcp_close() (high 7.8)
- [CVE-2026-23238](https://insights.sbomify.com/CVE-2026-23238/): romfs: check sb_set_blocksize() return value (medium 5.5)
- [CVE-2026-23237](https://insights.sbomify.com/CVE-2026-23237/): platform/x86: classmate-laptop: Add missing NULL pointer checks (medium 5.5)
- [CVE-2026-23236](https://insights.sbomify.com/CVE-2026-23236/): fbdev: smscufx: properly copy ioctl memory to kernelspace (high 7.3)
- [CVE-2026-23235](https://insights.sbomify.com/CVE-2026-23235/): f2fs: fix out-of-bounds access in sysfs attribute read/write (high 7.1)
- [CVE-2026-23234](https://insights.sbomify.com/CVE-2026-23234/): f2fs: fix to avoid UAF in f2fs_write_end_io() (high 7.8)
- [CVE-2026-23233](https://insights.sbomify.com/CVE-2026-23233/): f2fs: fix to avoid mapping wrong physical block for swapfile (high 7.8)
- [CVE-2026-23232](https://insights.sbomify.com/CVE-2026-23232/): Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()" (medium 5.5)
- [CVE-2026-23231](https://insights.sbomify.com/CVE-2026-23231/): netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (high 7.8)
- [CVE-2026-23230](https://insights.sbomify.com/CVE-2026-23230/): smb: client: split cached_fid bitfields to avoid shared-byte RMW races (high 8.8)
- [CVE-2026-2323](https://insights.sbomify.com/CVE-2026-2323/): Other in Chrome (medium 4.3)
- [CVE-2026-23229](https://insights.sbomify.com/CVE-2026-23229/): crypto: virtio - Add spinlock protection with virtqueue notification (medium 5.5)
- [CVE-2026-23228](https://insights.sbomify.com/CVE-2026-23228/): smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (medium 5.5)
- [CVE-2026-23227](https://insights.sbomify.com/CVE-2026-23227/): drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free (high 7.8)
- [CVE-2026-23226](https://insights.sbomify.com/CVE-2026-23226/): ksmbd: add chann_lock to protect ksmbd_chann_list xarray (high 8.8)
- [CVE-2026-23225](https://insights.sbomify.com/CVE-2026-23225/): sched/mmcid: Don't assume CID is CPU owned on mode switch (high 7.8)
- [CVE-2026-23224](https://insights.sbomify.com/CVE-2026-23224/): erofs: fix UAF issue for file-backed mounts w/ directio option (high 7.8)
- [CVE-2026-23223](https://insights.sbomify.com/CVE-2026-23223/): xfs: fix UAF in xchk_btree_check_block_owner (high 7.8)
- [CVE-2026-23222](https://insights.sbomify.com/CVE-2026-23222/): crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (high 7.8)
- [CVE-2026-23221](https://insights.sbomify.com/CVE-2026-23221/): bus: fsl-mc: fix use-after-free in driver_override_show() (high 7.8)
- [CVE-2026-23220](https://insights.sbomify.com/CVE-2026-23220/): ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths (medium 5.5)
- [CVE-2026-2322](https://insights.sbomify.com/CVE-2026-2322/): Other in Chrome (medium 5.4)
- [CVE-2026-23219](https://insights.sbomify.com/CVE-2026-23219/): mm/slab: Add alloc_tagging_slab_free_hook for memcg_alloc_abort_single (medium 5.5)
- [CVE-2026-23218](https://insights.sbomify.com/CVE-2026-23218/): gpio: loongson-64bit: Fix incorrect NULL check after devm_kcalloc() (medium 5.5)
- [CVE-2026-23217](https://insights.sbomify.com/CVE-2026-23217/): riscv: trace: fix snapshot deadlock with sbi ecall (medium 5.5)
- [CVE-2026-23216](https://insights.sbomify.com/CVE-2026-23216/): scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (high 7.8)
- [CVE-2026-23215](https://insights.sbomify.com/CVE-2026-23215/): x86/vmware: Fix hypercall clobbers (medium 5.5)
- [CVE-2026-23214](https://insights.sbomify.com/CVE-2026-23214/): btrfs: reject new transactions if the fs is fully read-only (medium 5.5)
- [CVE-2026-23213](https://insights.sbomify.com/CVE-2026-23213/): drm/amd/pm: Disable MMIO access during SMU Mode 1 reset (medium 5.5)
- [CVE-2026-23212](https://insights.sbomify.com/CVE-2026-23212/): bonding: annotate data-races around slave->last_rx (medium 4.7)
- [CVE-2026-23211](https://insights.sbomify.com/CVE-2026-23211/): mm, swap: restore swap_space attr aviod kernel panic (medium 5.5)
- [CVE-2026-23210](https://insights.sbomify.com/CVE-2026-23210/): ice: Fix PTP NULL pointer dereference during VSI rebuild (medium 4.7)
- [CVE-2026-2321](https://insights.sbomify.com/CVE-2026-2321/): Use after free in Chrome (high 8.8)
- [CVE-2026-23209](https://insights.sbomify.com/CVE-2026-23209/): macvlan: fix error recovery in macvlan_common_newlink() (high 7.8)
- [CVE-2026-23208](https://insights.sbomify.com/CVE-2026-23208/): ALSA: usb-audio: Prevent excessive number of frames (high 7.8)
- [CVE-2026-23207](https://insights.sbomify.com/CVE-2026-23207/): spi: tegra210-quad: Protect curr_xfer check in IRQ handler (medium 4.7)
- [CVE-2026-23206](https://insights.sbomify.com/CVE-2026-23206/): dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (medium 5.5)
- [CVE-2026-23205](https://insights.sbomify.com/CVE-2026-23205/): smb/client: fix memory leak in smb2_open_file() (medium 5.5)
- [CVE-2026-23204](https://insights.sbomify.com/CVE-2026-23204/): net/sched: cls_u32: use skb_header_pointer_careful() (high 7.1)
- [CVE-2026-23203](https://insights.sbomify.com/CVE-2026-23203/): net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue (medium 5.5)
- [CVE-2026-23202](https://insights.sbomify.com/CVE-2026-23202/): spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (medium 5.5)
- [CVE-2026-23201](https://insights.sbomify.com/CVE-2026-23201/): ceph: fix oops due to invalid pointer for kfree() in parse_longname() (medium 5.5)
- [CVE-2026-23200](https://insights.sbomify.com/CVE-2026-23200/): ipv6: Fix ECMP sibling count mismatch when clearing RTF_ADDRCONF (medium 5.5)
- [CVE-2026-2320](https://insights.sbomify.com/CVE-2026-2320/): Other in Chrome (medium 6.5)
- [CVE-2026-23199](https://insights.sbomify.com/CVE-2026-23199/): procfs: avoid fetching build ID while holding VMA lock (medium 5.5)
- [CVE-2026-23198](https://insights.sbomify.com/CVE-2026-23198/): KVM: Don't clobber irqfd routing type when deassigning irqfd (high 7.8)
- [CVE-2026-23197](https://insights.sbomify.com/CVE-2026-23197/): i2c: imx: preserve error state in block data length handler (medium 5.5)
- [CVE-2026-23196](https://insights.sbomify.com/CVE-2026-23196/): HID: Intel-thc-hid: Intel-thc: Add safety check for reading DMA buffer (medium 5.5)
- [CVE-2026-23195](https://insights.sbomify.com/CVE-2026-23195/): cgroup/dmem: avoid pool UAF (high 7.0)
- [CVE-2026-23194](https://insights.sbomify.com/CVE-2026-23194/): rust_binder: correctly handle FDA objects of length zero (high 7.8)
- [CVE-2026-23193](https://insights.sbomify.com/CVE-2026-23193/): scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (high 8.8)
- [CVE-2026-23192](https://insights.sbomify.com/CVE-2026-23192/): linkwatch: use __dev_put() in callers to prevent UAF (high 7.8)
- [CVE-2026-23191](https://insights.sbomify.com/CVE-2026-23191/): ALSA: aloop: Fix racy access at PCM trigger (high 7.8)
- [CVE-2026-23190](https://insights.sbomify.com/CVE-2026-23190/): ASoC: amd: fix memory leak in acp3x pdm dma ops (medium 5.5)
- [CVE-2026-2319](https://insights.sbomify.com/CVE-2026-2319/): Race condition in Chrome (high 7.5)
- [CVE-2026-23189](https://insights.sbomify.com/CVE-2026-23189/): ceph: fix NULL pointer dereference in ceph_mds_auth_match() (medium 5.5)
- [CVE-2026-23188](https://insights.sbomify.com/CVE-2026-23188/): net: usb: r8152: fix resume reset deadlock (medium 5.5)
- [CVE-2026-23187](https://insights.sbomify.com/CVE-2026-23187/): pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains (high 7.1)
- [CVE-2026-23186](https://insights.sbomify.com/CVE-2026-23186/): hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify() (medium 5.5)
- [CVE-2026-23185](https://insights.sbomify.com/CVE-2026-23185/): wifi: iwlwifi: mld: cancel mlo_scan_start_wk (high 7.8)
- [CVE-2026-23184](https://insights.sbomify.com/CVE-2026-23184/): binder: fix UAF in binder_netlink_report() (high 7.8)
- [CVE-2026-23183](https://insights.sbomify.com/CVE-2026-23183/): cgroup/dmem: fix NULL pointer dereference when setting max (not scored)
- [CVE-2026-23182](https://insights.sbomify.com/CVE-2026-23182/): spi: tegra: Fix a memory leak in tegra_slink_probe() (not scored)
- [CVE-2026-23181](https://insights.sbomify.com/CVE-2026-23181/): btrfs: sync read disk super and set block size (not scored)
- [CVE-2026-23180](https://insights.sbomify.com/CVE-2026-23180/): dpaa2-switch: add bounds check for if_id in IRQ handler (high 7.0)
- [CVE-2026-2318](https://insights.sbomify.com/CVE-2026-2318/): Other in Chrome (medium 6.5)
- [CVE-2026-23179](https://insights.sbomify.com/CVE-2026-23179/): nvmet-tcp: fixup hang in nvmet_tcp_listen_data_ready() (not scored)
- [CVE-2026-23178](https://insights.sbomify.com/CVE-2026-23178/): HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() (high 7.8)
- [CVE-2026-23177](https://insights.sbomify.com/CVE-2026-23177/): mm, shmem: prevent infinite loop on truncate race (not scored)
- [CVE-2026-23176](https://insights.sbomify.com/CVE-2026-23176/): platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (not scored)
- [CVE-2026-23175](https://insights.sbomify.com/CVE-2026-23175/): net: cpsw: Execute ndo_set_rx_mode callback in a work queue (high 7.0)
- [CVE-2026-23174](https://insights.sbomify.com/CVE-2026-23174/): nvme-pci: handle changing device dma map requirements (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/791/