- wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds {CVE-2023-53582} - net/sched: accept TCA_STAB only for root qdisc {CVE-2024-50039} - bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720} - net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948} - nvme-tcp: sanitize request list handling {CVE-2025-38264} - smb: client: fix double free of TCP_Server_Info::hostname {CVE-2025-21673} - net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815} - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886} - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} - nfsd: never defer requests during idmap lookup {CVE-2026-45983} - openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} - dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023} - thermal: core: Fix thermal zone governor cleanup issues {CVE-2026-46021} - tcp: call sk_data_ready() after listener migration {CVE-2026-46015} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} - xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218} - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} - smb: client: fix krb5 mount with username option {CVE-2026-31392} - netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212} - USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196} - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176} - fuse: reject fuse_notify() pagecache ops on directories {CVE-2026-53168} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - uio_hv_generic: Let userspace take care of interrupt mask {CVE-2025-40048} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947} - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970} - netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278} - crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945} - pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() {CVE-2026-46172} - octeontx2-af: Fix PF driver crash with kexec kernel booting {CVE-2026-46249} - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies {CVE-2026-46161} - usb: usblp: fix heap leak in IEEE 1284 device ID via short response {CVE-2026-46151} - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl {CVE-2026-46167} - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission {CVE-2026-46220} - vsock: fix buffer size clamping order {CVE-2026-46234} - sound: ua101: fix division by zero at probe {CVE-2026-46184} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - ext4: fix memory leak in ext4_ext_shift_extents() {CVE-2026-45948} - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path {CVE-2026-45964} - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails {CVE-2026-46040} - ALSA: ctxfi: Add fallback to default RSR for S/PDIF {CVE-2026-46049} - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES {CVE-2026-46018} - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 {CVE-2026-45987} - dcache: Limit the minimal number of bucket to two {CVE-2026-43071} - ipmi: Check event message buffer response for bad data {CVE-2026-46128} - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 {CVE-2026-46082} - ipmi:si: Return state to normal if message allocation fails {CVE-2026-46108} - netfilter: reject zero shift in nft_bitwise {CVE-2026-46101} - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access {CVE-2026-31393} - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() {CVE-2026-46088} - net: remove WARN_ON_ONCE when accessing forward path array {CVE-2026-45847} - scsi: csiostor: Fix dereference of null pointer rn {CVE-2026-45857} - ipvs: skip ipv6 extension headers for csum checks {CVE-2026-45850} - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() {CVE-2026-45839} - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO {CVE-2026-45841} - tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313} - bpf: fix end-of-list detection in cgroup_storage_get_next_key() {CVE-2026-45838} - slip: reject VJ receive packets on instances with no rstate array {CVE-2026-45842} - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} - smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388} - net: openvswitch: fix possible kfree_skb of ERR_PTR {CVE-2026-53227} - netfilter: x_tables: avoid leaking percpu counter pointers {CVE-2026-53219} - xfrm: fix stale skb->prev after async crypto steals a GSO segment {CVE-2026-68426} - vsock/vmci: fix sk_ack_backlog leak on failed handshake {CVE-2026-53181} - bnxt_en: Fix NULL pointer dereference {CVE-2026-53177} - scsi: sg: Resolve soft lockup issue when opening /dev/sgX {CVE-2026-53304} - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() {CVE-2026-43062} - netfilter: nft_ct: drop pending enqueued packets on removal {CVE-2026-43060} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - xfs: delete attr leaf freemap entries when empty {CVE-2026-43187} - audit: fix incorrect inheritable capability in CAPSET records {CVE-2026-53287} - xprtrdma: Decrement re_receiving on the early exit paths {CVE-2026-43469} - 6lowpan: fix off-by-one in multicast context address compression {CVE-2026-53263} - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr {CVE-2026-53245} - netfilter: synproxy: add mutex to guard hook reference counting {CVE-2026-53269} - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs {CVE-2026-53135} - mailbox: add sanity check for channel array {CVE-2026-53295} - efi: fix NULL-deref in init error path {CVE-2022-48879} - netlabel: validate unlabeled address and mask attribute lengths {CVE-2026-53238} - tracing/histogram: Fix a potential memory leak for kstrdup() {CVE-2022-48768} - drm/amdgpu: Add bounds checking to ib_{get,set}_value {CVE-2026-46218} - drm/amdkfd: validate SVM ioctl nattr against buffer size {CVE-2026-46197} - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} - vDPA/ifcvf: alloc the mgmt_dev before the adapter {CVE-2022-48706} - pNFS: Handle RPC size limit for layoutcommits - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - ipmi: Add limits to event and receive message requests {CVE-2026-46177} - nexthop: fix IPv6 route referencing IPv4 nexthop {CVE-2026-53012} - vsock/vmci: fix UAF when peer resets connection during handshake - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl {CVE-2026-52948} - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() {CVE-2026-52969} - can: af_can: fix NULL pointer dereference in can_rcv_filter {CVE-2022-49863} - nfsd: restore callback functionality for NFSv4.0 - HID: usbhid: fix deadlock in hid_post_reset() {CVE-2026-53037} - netdevsim: zero initialize struct iphdr in dummy sk_buff {CVE-2026-52985} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} - platform/x86: dell-wmi-sysman: bound enumeration string aggregation {CVE-2026-53022} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - block: initialize integrity buffer to zero before writing it to media {CVE-2024-43854} - fs/mount_setattr: always cleanup mount_kattr {CVE-2021-46923} - dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064} - net/sched: cls_fw: fix NULL dereference of "old" filters before change() {CVE-2026-53080} - iommu/iova: Fix alloc iova overflows issue {CVE-2023-52910} - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} - nexthop: initialize extack in nh_res_bucket_migrate() {CVE-2026-64576} - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} - drm/i915: Fix potential context UAFs {CVE-2023-52913} - wifi: brcmfmac: Fix error pointer dereference {CVE-2026-53093} - Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189} - ALSA: usb-audio: Bound MIDI endpoint descriptor scans {CVE-2026-52963} - net: bonding: fix NULL pointer dereference in bond_do_ioctl() {CVE-2026-53337} - openvswitch: validate MPLS set/set_masked payload length {CVE-2026-31679} - thunderbolt: Clamp XDomain response data copy to allocation size - hwmon: adm1275: Prevent reading uninitialized stack {CVE-2026-72396} - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324} - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2025-54518} - libbpf: Refactor cleanup in ring_buffer__add {CVE-2022-49030} - libbpf: Handle size overflow for ringbuf mmap {CVE-2022-49030} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() {CVE-2026-31530} - cxl/port: Keep port->uport valid for the entire life of a port {CVE-2026-31530} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} - libceph: remove debugfs files before client teardown {CVE-2026-68153} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows {CVE-2026-43501} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} - Input: elan_i2c - validate firmware size before use {CVE-2026-64237} - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225}