# Vulnerabilities published in 2026


- [CVE-2026-23173](https://insights.sbomify.com/CVE-2026-23173/): net/mlx5e: TC, delete flows only for existing peers (medium 5.5)
- [CVE-2026-23172](https://insights.sbomify.com/CVE-2026-23172/): net: wwan: t7xx: fix potential skb->frags overflow in RX path (high 8.4)
- [CVE-2026-23171](https://insights.sbomify.com/CVE-2026-23171/): bonding: fix use-after-free due to enslave fail after slave array update (high 7.8)
- [CVE-2026-23170](https://insights.sbomify.com/CVE-2026-23170/): drm/imx/tve: fix probe device leak (medium 5.5)
- [CVE-2026-2317](https://insights.sbomify.com/CVE-2026-2317/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-23169](https://insights.sbomify.com/CVE-2026-23169/): mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (high 7.8)
- [CVE-2026-23168](https://insights.sbomify.com/CVE-2026-23168/): flex_proportions: make fprop_new_period() hardirq safe (medium 5.5)
- [CVE-2026-23167](https://insights.sbomify.com/CVE-2026-23167/): nfc: nci: Fix race between rfkill and nci_unregister_device(). (medium 4.7)
- [CVE-2026-23166](https://insights.sbomify.com/CVE-2026-23166/): ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (medium 5.5)
- [CVE-2026-23165](https://insights.sbomify.com/CVE-2026-23165/): sfc: fix deadlock in RSS config read (medium 5.5)
- [CVE-2026-23164](https://insights.sbomify.com/CVE-2026-23164/): rocker: fix memory leak in rocker_world_port_post_fini() (medium 5.5)
- [CVE-2026-23163](https://insights.sbomify.com/CVE-2026-23163/): drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove (medium 5.5)
- [CVE-2026-23162](https://insights.sbomify.com/CVE-2026-23162/): drm/xe/nvm: Fix double-free on aux add failure (high 7.8)
- [CVE-2026-23161](https://insights.sbomify.com/CVE-2026-23161/): mm/shmem, swap: fix race of truncate and swap entry split (high 7.3)
- [CVE-2026-23160](https://insights.sbomify.com/CVE-2026-23160/): octeon_ep: Fix memory leak in octep_device_setup() (medium 5.5)
- [CVE-2026-2316](https://insights.sbomify.com/CVE-2026-2316/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-23159](https://insights.sbomify.com/CVE-2026-23159/): perf: sched: Fix perf crash with new is_user_task() helper (medium 5.5)
- [CVE-2026-23158](https://insights.sbomify.com/CVE-2026-23158/): gpio: virtuser: fix UAF in configfs release path (high 7.8)
- [CVE-2026-23157](https://insights.sbomify.com/CVE-2026-23157/): btrfs: do not strictly require dirty metadata threshold for metadata writepages (medium 5.5)
- [CVE-2026-23156](https://insights.sbomify.com/CVE-2026-23156/): efivarfs: fix error propagation in efivar_entry_get() (high 7.8)
- [CVE-2026-23155](https://insights.sbomify.com/CVE-2026-23155/): can: gs_usb: gs_usb_receive_bulk_callback(): fix error message (medium 5.5)
- [CVE-2026-23154](https://insights.sbomify.com/CVE-2026-23154/): net: fix segmentation of forwarding fraglist GRO (medium 5.5)
- [CVE-2026-23153](https://insights.sbomify.com/CVE-2026-23153/): firewire: core: fix race condition against transaction list (medium 4.7)
- [CVE-2026-23152](https://insights.sbomify.com/CVE-2026-23152/): wifi: mac80211: correctly decode TTLM with default link map (medium 5.5)
- [CVE-2026-23151](https://insights.sbomify.com/CVE-2026-23151/): Bluetooth: MGMT: Fix memory leak in set_ssp_complete (medium 5.5)
- [CVE-2026-23150](https://insights.sbomify.com/CVE-2026-23150/): nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). (medium 5.5)
- [CVE-2026-2315](https://insights.sbomify.com/CVE-2026-2315/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-23149](https://insights.sbomify.com/CVE-2026-23149/): drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (medium 5.5)
- [CVE-2026-23148](https://insights.sbomify.com/CVE-2026-23148/): nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference (high 7.5)
- [CVE-2026-23147](https://insights.sbomify.com/CVE-2026-23147/): btrfs: zlib: fix the folio leak on S390 hardware acceleration (medium 5.5)
- [CVE-2026-23146](https://insights.sbomify.com/CVE-2026-23146/): Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (medium 5.5)
- [CVE-2026-23145](https://insights.sbomify.com/CVE-2026-23145/): ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref (medium 5.5)
- [CVE-2026-23144](https://insights.sbomify.com/CVE-2026-23144/): mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (medium 5.5)
- [CVE-2026-23143](https://insights.sbomify.com/CVE-2026-23143/): virtio_net: Fix misalignment bug in struct virtnet_info (medium 5.5)
- [CVE-2026-23142](https://insights.sbomify.com/CVE-2026-23142/): mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (medium 5.5)
- [CVE-2026-23141](https://insights.sbomify.com/CVE-2026-23141/): btrfs: send: check for inline extents in range_is_hole_in_parent() (medium 5.5)
- [CVE-2026-23140](https://insights.sbomify.com/CVE-2026-23140/): bpf, test_run: Subtract size of xdp_frame from allowed metadata size (medium 5.5)
- [CVE-2026-2314](https://insights.sbomify.com/CVE-2026-2314/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-23139](https://insights.sbomify.com/CVE-2026-23139/): netfilter: nf_conncount: update last_gc only when GC has been performed (high 7.5)
- [CVE-2026-23138](https://insights.sbomify.com/CVE-2026-23138/): tracing: Add recursion protection in kernel stack trace recording (medium 5.5)
- [CVE-2026-23137](https://insights.sbomify.com/CVE-2026-23137/): of: unittest: Fix memory leak in unittest_data_add() (medium 5.5)
- [CVE-2026-23136](https://insights.sbomify.com/CVE-2026-23136/): libceph: reset sparse-read state in osd_fault() (high 7.5)
- [CVE-2026-23135](https://insights.sbomify.com/CVE-2026-23135/): wifi: ath12k: fix dma_free_coherent() pointer (medium 5.5)
- [CVE-2026-23134](https://insights.sbomify.com/CVE-2026-23134/): slab: fix kmalloc_nolock() context check for PREEMPT_RT (medium 5.5)
- [CVE-2026-23133](https://insights.sbomify.com/CVE-2026-23133/): wifi: ath10k: fix dma_free_coherent() pointer (medium 5.5)
- [CVE-2026-23132](https://insights.sbomify.com/CVE-2026-23132/): drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind (medium 5.5)
- [CVE-2026-23131](https://insights.sbomify.com/CVE-2026-23131/): platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names (medium 5.5)
- [CVE-2026-23130](https://insights.sbomify.com/CVE-2026-23130/): wifi: ath12k: fix dead lock while flushing management frames (medium 5.5)
- [CVE-2026-2313](https://insights.sbomify.com/CVE-2026-2313/): Use after free in Chrome (high 8.8)
- [CVE-2026-23129](https://insights.sbomify.com/CVE-2026-23129/): dpll: Prevent duplicate registrations (medium 5.5)
- [CVE-2026-23128](https://insights.sbomify.com/CVE-2026-23128/): arm64: Set __nocfi on swsusp_arch_resume() (medium 5.5)
- [CVE-2026-23127](https://insights.sbomify.com/CVE-2026-23127/): perf: Fix refcount warning on event->mmap_count increment (medium 5.5)
- [CVE-2026-23126](https://insights.sbomify.com/CVE-2026-23126/): netdevsim: fix a race issue related to the operation on bpf_bound_progs list (medium 4.7)
- [CVE-2026-23125](https://insights.sbomify.com/CVE-2026-23125/): sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (medium 5.5)
- [CVE-2026-23124](https://insights.sbomify.com/CVE-2026-23124/): ipv6: annotate data-race in ndisc_router_discovery() (medium 5.5)
- [CVE-2026-23123](https://insights.sbomify.com/CVE-2026-23123/): interconnect: debugfs: initialize src_node and dst_node to empty strings (medium 5.5)
- [CVE-2026-23122](https://insights.sbomify.com/CVE-2026-23122/): igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue (medium 5.5)
- [CVE-2026-23121](https://insights.sbomify.com/CVE-2026-23121/): mISDN: annotate data-race around dev->work (medium 5.5)
- [CVE-2026-23120](https://insights.sbomify.com/CVE-2026-23120/): l2tp: avoid one data-race in l2tp_tunnel_del_work() (medium 5.5)
- [CVE-2026-2312](https://insights.sbomify.com/CVE-2026-2312/): Missing authorization in Media Library Folders (medium 4.3)
- [CVE-2026-23119](https://insights.sbomify.com/CVE-2026-23119/): bonding: provide a net pointer to __skb_flow_dissect() (medium 5.5)
- [CVE-2026-23118](https://insights.sbomify.com/CVE-2026-23118/): rxrpc: Fix data-race warning and potential load/store tearing (medium 4.7)
- [CVE-2026-23117](https://insights.sbomify.com/CVE-2026-23117/): ice: add missing ice_deinit_hw() in devlink reinit path (medium 5.5)
- [CVE-2026-23116](https://insights.sbomify.com/CVE-2026-23116/): pmdomain: imx8m-blk-ctrl: Remove separate rst and clk mask for 8mq vpu (medium 5.5)
- [CVE-2026-23115](https://insights.sbomify.com/CVE-2026-23115/): serial: Fix not set tty->port race condition (medium 4.7)
- [CVE-2026-23114](https://insights.sbomify.com/CVE-2026-23114/): arm64/fpsimd: ptrace: Fix SVE writes on !SME systems (medium 5.5)
- [CVE-2026-23113](https://insights.sbomify.com/CVE-2026-23113/): io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop (medium 5.5)
- [CVE-2026-23112](https://insights.sbomify.com/CVE-2026-23112/): nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (critical 9.8)
- [CVE-2026-23111](https://insights.sbomify.com/CVE-2026-23111/): netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (high 7.8)
- [CVE-2026-23110](https://insights.sbomify.com/CVE-2026-23110/): scsi: core: Wake up the error handler when final completions race against each other (medium 4.7)
- [CVE-2026-2311](https://insights.sbomify.com/CVE-2026-2311/): IBM i is affected by a privilege escalation vulnerability in Web Administration GUI [] (medium 6.4)
- [CVE-2026-23109](https://insights.sbomify.com/CVE-2026-23109/): fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes() (medium 5.5)
- [CVE-2026-23108](https://insights.sbomify.com/CVE-2026-23108/): can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak (medium 5.5)
- [CVE-2026-23107](https://insights.sbomify.com/CVE-2026-23107/): arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA (medium 5.5)
- [CVE-2026-23106](https://insights.sbomify.com/CVE-2026-23106/): timekeeping: Adjust the leap state for the correct auxiliary timekeeper (medium 5.5)
- [CVE-2026-23105](https://insights.sbomify.com/CVE-2026-23105/): net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (high 7.8)
- [CVE-2026-23104](https://insights.sbomify.com/CVE-2026-23104/): ice: fix devlink reload call trace (medium 5.5)
- [CVE-2026-23103](https://insights.sbomify.com/CVE-2026-23103/): ipvlan: Make the addrs_lock be per port (high 7.8)
- [CVE-2026-23102](https://insights.sbomify.com/CVE-2026-23102/): arm64/fpsimd: signal: Fix restoration of SVE context (high 7.1)
- [CVE-2026-23101](https://insights.sbomify.com/CVE-2026-23101/): leds: led-class: Only Add LED to leds_list when it is fully ready (medium 4.7)
- [CVE-2026-23100](https://insights.sbomify.com/CVE-2026-23100/): mm/hugetlb: fix hugetlb_pmd_shared() (medium 5.5)
- [CVE-2026-2310](https://insights.sbomify.com/CVE-2026-2310/): XML external entity in webMethods Integration Server (high 7.8)
- [CVE-2026-23099](https://insights.sbomify.com/CVE-2026-23099/): bonding: limit BOND_MODE_8023AD to Ethernet devices (high 7.1)
- [CVE-2026-23098](https://insights.sbomify.com/CVE-2026-23098/): netrom: fix double-free in nr_route_frame() (high 8.8)
- [CVE-2026-23097](https://insights.sbomify.com/CVE-2026-23097/): migrate: correct lock ordering for hugetlb file folios (medium 5.5)
- [CVE-2026-23096](https://insights.sbomify.com/CVE-2026-23096/): uacce: fix cdev handling in the cleanup path (medium 5.5)
- [CVE-2026-23095](https://insights.sbomify.com/CVE-2026-23095/): gue: Fix skb memleak with inner IP protocol 0. (high 7.5)
- [CVE-2026-23094](https://insights.sbomify.com/CVE-2026-23094/): uacce: fix isolate sysfs check condition (medium 5.5)
- [CVE-2026-23093](https://insights.sbomify.com/CVE-2026-23093/): ksmbd: smbd: fix dma_unmap_sg() nents (medium 5.5)
- [CVE-2026-23092](https://insights.sbomify.com/CVE-2026-23092/): iio: dac: ad3552r-hs: fix out-of-bound write in ad3552r_hs_write_data_source (high 7.8)
- [CVE-2026-23091](https://insights.sbomify.com/CVE-2026-23091/): intel_th: fix device leak on output open() (medium 5.5)
- [CVE-2026-23090](https://insights.sbomify.com/CVE-2026-23090/): slimbus: core: fix device reference leak on report present (medium 5.5)
- [CVE-2026-23089](https://insights.sbomify.com/CVE-2026-23089/): ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() (high 7.8)
- [CVE-2026-23088](https://insights.sbomify.com/CVE-2026-23088/): tracing: Fix crash on synthetic stacktrace field usage (medium 5.5)
- [CVE-2026-23087](https://insights.sbomify.com/CVE-2026-23087/): scsi: xen: scsiback: Fix potential memory leak in scsiback_remove() (medium 5.5)
- [CVE-2026-23086](https://insights.sbomify.com/CVE-2026-23086/): vsock/virtio: cap TX credit to local buffer size (medium 5.5)
- [CVE-2026-23085](https://insights.sbomify.com/CVE-2026-23085/): irqchip/gic-v3-its: Avoid truncating memory addresses (medium 5.5)
- [CVE-2026-23084](https://insights.sbomify.com/CVE-2026-23084/): be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list (medium 5.5)
- [CVE-2026-23083](https://insights.sbomify.com/CVE-2026-23083/): fou: Don't allow 0 for FOU_ATTR_IPPROTO. (high 7.8)
- [CVE-2026-23082](https://insights.sbomify.com/CVE-2026-23082/): can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/792/