# Vulnerabilities published in 2026


- [CVE-2026-23081](https://insights.sbomify.com/CVE-2026-23081/): net: phy: intel-xway: fix OF node refcount leakage (medium 5.5)
- [CVE-2026-23080](https://insights.sbomify.com/CVE-2026-23080/): can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak (medium 5.5)
- [CVE-2026-23079](https://insights.sbomify.com/CVE-2026-23079/): gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() (medium 5.5)
- [CVE-2026-23078](https://insights.sbomify.com/CVE-2026-23078/): ALSA: scarlett2: Fix buffer overflow in config retrieval (high 7.8)
- [CVE-2026-23077](https://insights.sbomify.com/CVE-2026-23077/): mm/vma: fix anon_vma UAF on mremap() faulted, unfaulted merge (high 7.8)
- [CVE-2026-23076](https://insights.sbomify.com/CVE-2026-23076/): ALSA: ctxfi: Fix potential OOB access in audio mixer handling (high 7.1)
- [CVE-2026-23075](https://insights.sbomify.com/CVE-2026-23075/): can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (medium 5.5)
- [CVE-2026-23074](https://insights.sbomify.com/CVE-2026-23074/): net/sched: Enforce that teql can only be used as root qdisc (high 7.8)
- [CVE-2026-23073](https://insights.sbomify.com/CVE-2026-23073/): wifi: rsi: Fix memory corruption due to not set vif driver data size (high 7.8)
- [CVE-2026-23072](https://insights.sbomify.com/CVE-2026-23072/): l2tp: Fix memleak in l2tp_udp_encap_recv(). (medium 5.5)
- [CVE-2026-23071](https://insights.sbomify.com/CVE-2026-23071/): regmap: Fix race condition in hwspinlock irqsave routine (medium 4.7)
- [CVE-2026-23070](https://insights.sbomify.com/CVE-2026-23070/): Octeontx2-af: Add proper checks for fwdata (medium 5.5)
- [CVE-2026-23069](https://insights.sbomify.com/CVE-2026-23069/): vsock/virtio: fix potential underflow in virtio_transport_get_credit() (medium 5.5)
- [CVE-2026-23068](https://insights.sbomify.com/CVE-2026-23068/): spi: spi-sprd-adi: Fix double free in probe error path (high 7.8)
- [CVE-2026-23067](https://insights.sbomify.com/CVE-2026-23067/): iommu/io-pgtable-arm: fix size_t signedness bug in unmap path (medium 5.5)
- [CVE-2026-23066](https://insights.sbomify.com/CVE-2026-23066/): rxrpc: Fix recvmsg() unconditional requeue (high 7.8)
- [CVE-2026-23065](https://insights.sbomify.com/CVE-2026-23065/): platform/x86/amd: Fix memory leak in wbrf_record() (medium 5.5)
- [CVE-2026-23064](https://insights.sbomify.com/CVE-2026-23064/): net/sched: act_ife: avoid possible NULL deref (medium 5.5)
- [CVE-2026-23063](https://insights.sbomify.com/CVE-2026-23063/): uacce: ensure safe queue release with state management (medium 5.5)
- [CVE-2026-23062](https://insights.sbomify.com/CVE-2026-23062/): platform/x86: hp-bioscfg: Fix kernel panic in GET_INSTANCE_ID macro (medium 5.5)
- [CVE-2026-23061](https://insights.sbomify.com/CVE-2026-23061/): can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak (medium 5.5)
- [CVE-2026-23060](https://insights.sbomify.com/CVE-2026-23060/): crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (medium 5.5)
- [CVE-2026-2306](https://insights.sbomify.com/CVE-2026-2306/): Ninja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation (medium 4.3)
- [CVE-2026-23059](https://insights.sbomify.com/CVE-2026-23059/): scsi: qla2xxx: Sanitize payload size to prevent member overflow (not scored)
- [CVE-2026-23058](https://insights.sbomify.com/CVE-2026-23058/): can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak (not scored)
- [CVE-2026-23057](https://insights.sbomify.com/CVE-2026-23057/): vsock/virtio: Coalesce only linear skb (not scored)
- [CVE-2026-23056](https://insights.sbomify.com/CVE-2026-23056/): uacce: implement mremap in uacce_vm_ops to return -EPERM (not scored)
- [CVE-2026-23055](https://insights.sbomify.com/CVE-2026-23055/): i2c: riic: Move suspend handling to NOIRQ phase (not scored)
- [CVE-2026-23054](https://insights.sbomify.com/CVE-2026-23054/): net: hv_netvsc: reject RSS hash key programming without RX indirection table (not scored)
- [CVE-2026-23053](https://insights.sbomify.com/CVE-2026-23053/): NFS: Fix a deadlock involving nfs_release_folio() (not scored)
- [CVE-2026-23052](https://insights.sbomify.com/CVE-2026-23052/): ftrace: Do not over-allocate ftrace memory (not scored)
- [CVE-2026-23051](https://insights.sbomify.com/CVE-2026-23051/): drm/amdgpu: fix drm panic null pointer when driver not support atomic (not scored)
- [CVE-2026-23050](https://insights.sbomify.com/CVE-2026-23050/): pNFS: Fix a deadlock when returning a delegation during open() (not scored)
- [CVE-2026-2305](https://insights.sbomify.com/CVE-2026-2305/): AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields (medium 6.4)
- [CVE-2026-23049](https://insights.sbomify.com/CVE-2026-23049/): drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (not scored)
- [CVE-2026-23048](https://insights.sbomify.com/CVE-2026-23048/): udp: call skb_orphan() before skb_attempt_defer_free() (not scored)
- [CVE-2026-23047](https://insights.sbomify.com/CVE-2026-23047/): libceph: make calc_target() set t->paused, not just clear it (not scored)
- [CVE-2026-23046](https://insights.sbomify.com/CVE-2026-23046/): virtio_net: fix device mismatch in devm_kzalloc/devm_kfree (not scored)
- [CVE-2026-23045](https://insights.sbomify.com/CVE-2026-23045/): net/ena: fix missing lock when update devlink params (not scored)
- [CVE-2026-23044](https://insights.sbomify.com/CVE-2026-23044/): PM: hibernate: Fix crash when freeing invalid crypto compressor (not scored)
- [CVE-2026-23043](https://insights.sbomify.com/CVE-2026-23043/): btrfs: fix NULL pointer dereference in do_abort_log_replay() (not scored)
- [CVE-2026-23042](https://insights.sbomify.com/CVE-2026-23042/): idpf: fix aux device unplugging when rdma is not supported by vport (not scored)
- [CVE-2026-23041](https://insights.sbomify.com/CVE-2026-23041/): bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup (not scored)
- [CVE-2026-23040](https://insights.sbomify.com/CVE-2026-23040/): wifi: mac80211_hwsim: fix typo in frequency notification (not scored)
- [CVE-2026-23039](https://insights.sbomify.com/CVE-2026-23039/): drm/gud: fix NULL fb and crtc dereferences on USB disconnect (not scored)
- [CVE-2026-23038](https://insights.sbomify.com/CVE-2026-23038/): pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() (not scored)
- [CVE-2026-23037](https://insights.sbomify.com/CVE-2026-23037/): can: etas_es58x: allow partial RX URB allocation to succeed (not scored)
- [CVE-2026-23036](https://insights.sbomify.com/CVE-2026-23036/): btrfs: release path before iget_failed() in btrfs_read_locked_inode() (not scored)
- [CVE-2026-23035](https://insights.sbomify.com/CVE-2026-23035/): net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (not scored)
- [CVE-2026-23034](https://insights.sbomify.com/CVE-2026-23034/): drm/amdgpu/userq: Fix fence reference leak on queue teardown v2 (not scored)
- [CVE-2026-23033](https://insights.sbomify.com/CVE-2026-23033/): dmaengine: omap-dma: fix dma_pool resource leak in error paths (not scored)
- [CVE-2026-23032](https://insights.sbomify.com/CVE-2026-23032/): null_blk: fix kmemleak by releasing references to fault configfs items (not scored)
- [CVE-2026-23031](https://insights.sbomify.com/CVE-2026-23031/): can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak (not scored)
- [CVE-2026-23030](https://insights.sbomify.com/CVE-2026-23030/): phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (not scored)
- [CVE-2026-2303](https://insights.sbomify.com/CVE-2026-2303/): Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak (medium 6.9)
- [CVE-2026-23029](https://insights.sbomify.com/CVE-2026-23029/): LoongArch: KVM: Fix kvm_device leak in kvm_eiointc_destroy() (not scored)
- [CVE-2026-23028](https://insights.sbomify.com/CVE-2026-23028/): LoongArch: KVM: Fix kvm_device leak in kvm_ipi_destroy() (not scored)
- [CVE-2026-23027](https://insights.sbomify.com/CVE-2026-23027/): LoongArch: KVM: Fix kvm_device leak in kvm_pch_pic_destroy() (not scored)
- [CVE-2026-23026](https://insights.sbomify.com/CVE-2026-23026/): dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (medium 5.5)
- [CVE-2026-23025](https://insights.sbomify.com/CVE-2026-23025/): mm/page_alloc: prevent pcp corruption with SMP=n (high 7.8)
- [CVE-2026-23024](https://insights.sbomify.com/CVE-2026-23024/): idpf: fix memory leak of flow steer list on rmmod (medium 5.5)
- [CVE-2026-23023](https://insights.sbomify.com/CVE-2026-23023/): idpf: fix memory leak in idpf_vport_rel() (medium 5.5)
- [CVE-2026-23022](https://insights.sbomify.com/CVE-2026-23022/): idpf: fix memory leak in idpf_vc_core_deinit() (medium 5.5)
- [CVE-2026-23021](https://insights.sbomify.com/CVE-2026-23021/): net: usb: pegasus: fix memory leak in update_eth_regs_async() (medium 5.5)
- [CVE-2026-23020](https://insights.sbomify.com/CVE-2026-23020/): net: 3com: 3c59x: fix possible null dereference in vortex_probe1() (medium 5.5)
- [CVE-2026-2302](https://insights.sbomify.com/CVE-2026-2302/): Unsafe Reflection in Mongoid::Criteria.from_hash (medium 6.9)
- [CVE-2026-23019](https://insights.sbomify.com/CVE-2026-23019/): net: marvell: prestera: fix NULL dereference on devlink_alloc() failure (medium 5.5)
- [CVE-2026-23018](https://insights.sbomify.com/CVE-2026-23018/): btrfs: release path before initializing extent tree in btrfs_read_locked_inode() (medium 5.5)
- [CVE-2026-23017](https://insights.sbomify.com/CVE-2026-23017/): idpf: fix error handling in the init_task on load (medium 5.5)
- [CVE-2026-23016](https://insights.sbomify.com/CVE-2026-23016/): inet: frags: drop fraglist conntrack references (medium 5.5)
- [CVE-2026-23015](https://insights.sbomify.com/CVE-2026-23015/): gpio: mpsse: fix reference leak in gpio_mpsse_probe() error paths (medium 5.5)
- [CVE-2026-23014](https://insights.sbomify.com/CVE-2026-23014/): perf: Ensure swevent hrtimer is properly destroyed (high 7.8)
- [CVE-2026-23013](https://insights.sbomify.com/CVE-2026-23013/): net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (high 7.0)
- [CVE-2026-23012](https://insights.sbomify.com/CVE-2026-23012/): mm/damon/core: remove call_control in inactive contexts (high 7.8)
- [CVE-2026-23011](https://insights.sbomify.com/CVE-2026-23011/): ipv4: ip_gre: make ipgre_header() robust (medium 5.5)
- [CVE-2026-23010](https://insights.sbomify.com/CVE-2026-23010/): ipv6: Fix use-after-free in inet6_addr_del(). (high 7.8)
- [CVE-2026-2301](https://insights.sbomify.com/CVE-2026-2301/): Missing authorization in Post Duplicator (medium 4.3)
- [CVE-2026-23009](https://insights.sbomify.com/CVE-2026-23009/): xhci: sideband: don't dereference freed ring when removing sideband endpoint (medium 5.5)
- [CVE-2026-23008](https://insights.sbomify.com/CVE-2026-23008/): drm/vmwgfx: Fix KMS with 3D on HW version 10 (medium 5.5)
- [CVE-2026-23007](https://insights.sbomify.com/CVE-2026-23007/): block: zero non-PI portion of auto integrity buffer (medium 5.5)
- [CVE-2026-23006](https://insights.sbomify.com/CVE-2026-23006/): ASoC: tlv320adcx140: fix null pointer (medium 5.5)
- [CVE-2026-23005](https://insights.sbomify.com/CVE-2026-23005/): x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (medium 5.5)
- [CVE-2026-23004](https://insights.sbomify.com/CVE-2026-23004/): dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() (high 7.8)
- [CVE-2026-23003](https://insights.sbomify.com/CVE-2026-23003/): ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (high 7.5)
- [CVE-2026-23002](https://insights.sbomify.com/CVE-2026-23002/): lib/buildid: use __kernel_read() for sleepable context (medium 5.5)
- [CVE-2026-23001](https://insights.sbomify.com/CVE-2026-23001/): macvlan: fix possible UAF in macvlan_forward_source() (high 7.8)
- [CVE-2026-23000](https://insights.sbomify.com/CVE-2026-23000/): net/mlx5e: Fix crash on profile change rollback failure (medium 5.5)
- [CVE-2026-2300](https://insights.sbomify.com/CVE-2026-2300/): BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block (medium 6.4)
- [CVE-2026-22999](https://insights.sbomify.com/CVE-2026-22999/): net/sched: sch_qfq: do not free existing class in qfq_change_class() (high 7.8)
- [CVE-2026-22998](https://insights.sbomify.com/CVE-2026-22998/): nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (high 7.5)
- [CVE-2026-22997](https://insights.sbomify.com/CVE-2026-22997/): net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts (high 7.5)
- [CVE-2026-22996](https://insights.sbomify.com/CVE-2026-22996/): net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (medium 5.5)
- [CVE-2026-22995](https://insights.sbomify.com/CVE-2026-22995/): ublk: fix use-after-free in ublk_partition_scan_work (high 7.8)
- [CVE-2026-22994](https://insights.sbomify.com/CVE-2026-22994/): bpf: Fix reference count leak in bpf_prog_test_run_xdp() (medium 5.5)
- [CVE-2026-22993](https://insights.sbomify.com/CVE-2026-22993/): idpf: Fix RSS LUT NULL ptr issue after soft reset (medium 5.5)
- [CVE-2026-22992](https://insights.sbomify.com/CVE-2026-22992/): libceph: return the handler error from mon_handle_auth_done() (high 7.5)
- [CVE-2026-22991](https://insights.sbomify.com/CVE-2026-22991/): libceph: make free_choose_arg_map() resilient to partial allocation (high 7.5)
- [CVE-2026-22990](https://insights.sbomify.com/CVE-2026-22990/): libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (high 7.5)
- [CVE-2026-2299](https://insights.sbomify.com/CVE-2026-2299/): Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint (medium 4.2)
- [CVE-2026-22989](https://insights.sbomify.com/CVE-2026-22989/): nfsd: check that server is running in unlock_filesystem (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/793/