- fix: fbdev: fix potential buffer overflow in do_register_framebuffer() - qed: Don't collect too many protection override GRC elements {CVE-2025-39949} - drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693} - pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691} - netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732} - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085} - fs: dlm: fix use after free in midcomms commit {CVE-2023-53629} - svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811} - bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303} - scsi: target: iscsit: Free cmds before session free {CVE-2023-54184} - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322} - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022} - memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892} - ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244} - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114} - net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306} - usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299} - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234} - rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195} - block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242} - wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540} - wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589} - wifi: mac80211: check for station first in client probe {CVE-2023-53588} - bonding: do not assume skb mac_header is set {CVE-2023-53601} - drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571} - wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574} - net: bcmgenet: Add a check for oversized packets {CVE-2023-53535} - media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882} - md/raid10: fix memleak of md thread {CVE-2023-54294} - usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186} - scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289} - HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020} - driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321} - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125} - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246} - bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283} - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202} - mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846} - bpf: Disable preemption in bpf_event_output {CVE-2023-54173} - net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148} - net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347} - net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105} - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494} - HID: core: ensure __hid_request reserves the report ID as the first byte - HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495} - HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392} - xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835} - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535} - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524} - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201} - xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500} - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471} - drm/edid: fix info leak when failing to get panel id {CVE-2023-53085} - xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470} - vdpa: Add features attr to vdpa_nl_policy for nlattr length check {CVE-2023-53652} - virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515} - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687} - drivers: net: prevent tun_build_skb() to exceed the packet size limit - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304} - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy {CVE-2025-40251} - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683} - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} - HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454} - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824} - udf: Do not bother merging very long extents {CVE-2023-53506} - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913} - ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587} - tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600} - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604} - tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560} - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619} - gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622} - iavf: Fix use-after-free in free_netdev {CVE-2023-53556}