- perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344} - x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363} - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} - dm: remove fake timeout to avoid leak request {CVE-2026-43314} - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163} - drm: Account property blob allocations to memcg {CVE-2026-43287} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206} - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} - net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-39677} - l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120} - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() {CVE-2025-39876} - espintcp: fix skb leaks {CVE-2025-38057} - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829} - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() {CVE-2025-37824} - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141} - virtiofs: add filesystem context source name check {CVE-2025-37773} - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063} - ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922} - wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910} - wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097} - net/sctp: Prevent autoclose integer overflow in sctp_association_init() {CVE-2024-57938} - ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172} - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() {CVE-2024-56369} - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware {CVE-2024-53157} - vsock: Fix sk_error_queue memory leak {CVE-2024-53118} - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof {CVE-2024-53113} - exec: don't WARN for racy path_noexec check {CVE-2024-50010} - drm/amd/display: Initialize get_bytes_per_element's default to 1 {CVE-2024-49892} - ppp: do not assume bh is held in ppp_channel_bridge_input() {CVE-2024-49946} - drm/amd/display: Skip Recompute DSC Params if no Stream on Link {CVE-2024-47683} - x86/sgx: Fix deadlock in SGX NUMA node search {CVE-2024-49856} - pktgen: use cpus_read_lock() in pg_net_init() {CVE-2024-46681} - nfsd: call cache_put if xdr_reserve_space returns NULL {CVE-2024-47737} - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739} - drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812} - net/mlx5: Fix bridge mode operations when there are no VFs {CVE-2024-46857} - Input: MT - limit max slots {CVE-2024-45008} - net/mlx5e: SHAMPO, Fix incorrect page release {CVE-2024-46717} - netfilter: ctnetlink: use helper function to calculate expect ID {CVE-2024-44944} - lib: objagg: Fix general protection fault {CVE-2024-43846} - drm/qxl: Add check for drm_cvt_mode {CVE-2024-43829} - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems {CVE-2024-42073} - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes {CVE-2024-42101} - RDMA/mlx5: Add check for srq max_sge attribute {CVE-2024-40990} - tracing: Build event generation tests only as modules {CVE-2024-41004} - KEYS: trusted: Fix memory leak in tpm2_key_encode() {CVE-2024-36967} - epoll: be better about file lifetimes {CVE-2024-38580} - drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988} - RDMA/srpt: Add a check for valid 'mad_agent' pointer {CVE-2023-54274} - x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction {CVE-2023-54172} - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772} - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected {CVE-2024-26891} - dm: don't attempt to queue IO under RCU protection {CVE-2023-53860} - md: fix soft lockup in status_resync {CVE-2023-53620} - spi: qup: Don't skip cleanup in remove's error path {CVE-2023-53567} - md/raid10: prevent soft lockup while flush writes {CVE-2023-53151} - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() {CVE-2023-53133} - spi: imx: Don't skip cleanup in remove's error path {CVE-2023-53225} - xsk: Add missing overflow check in xdp_umem_reg {CVE-2023-53080} - wifi: mt76: do not run mt76u_status_worker if the device is not running {CVE-2022-50735} - bpf: Skip task with pid=1 in send_signal_common() {CVE-2023-52992} - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808} - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() {CVE-2023-52702} - RDMA/irdma: Fix potential NULL-ptr-dereference {CVE-2023-52744} - i2c: designware: Fix handling of real but unexpected device interrupts {CVE-2022-50370} - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() {CVE-2022-50544} - tpm: acpi: Call acpi_put_table() to fix memory leak {CVE-2022-50562} - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed {CVE-2022-50500} - ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476} - blk-mq: fix possible memleak when register 'hctx' failed {CVE-2022-50434} - ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918} - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() {CVE-2022-49885} - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989} - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE {CVE-2022-49875} - can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845} - ovl: Use "buf" flexible array for memcpy() destination {CVE-2022-49743} - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() {CVE-2022-49839} - net: bcmgenet: Use stronger register read/writes to assure ordering {CVE-2022-49194} - ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643} - net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656} - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" {CVE-2025-71137} - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078} - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281} - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696} - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455} - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840} - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596} - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778} - ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826} - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799} - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779}