- drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251} - amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949} - Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909} - Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912} - xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454} - net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041} - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349} - cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844} - fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237} - cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258} - pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253} - Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164} - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873} - ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065} - ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018} - Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151} - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281} - fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982} - libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406} - netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024} - ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261} - bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035} - sctp: stream: fully roll back denied add-stream state {CVE-2026-52929} - netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457} - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407} - af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673} - jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337} - Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304} - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533} - fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788} - isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303} - net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102} - sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225} - xfs: don't swallow dquot recovery verification errors {CVE-2026-80529} - xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529} - bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575} - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714} - bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714} - bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714} - bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714} - bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575} - bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714} - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730} - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689} - net: add copy_safe_from_sockptr() helper {CVE-2026-74689} - xfs: close crash window in attr dabtree inactivation {CVE-2026-43053} - gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048} - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card {CVE-2025-40085} - tee: fix NULL pointer dereference in tee_shm_put {CVE-2025-39865} - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229} - cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() {CVE-2024-53230} - netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665} - md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438} - md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050} - mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844} - arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() {CVE-2026-53357} - wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue() {CVE-2025-37795} - hwrng: core - Fix page fault dead lock on mmap-ed hwrng {CVE-2023-52615} - ceph: fix possible deadlock when holding Fwb to get inline_data {CVE-2022-49296} - bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error {CVE-2024-47728} - scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782} - xfrm: Wait for RCU readers during policy netns exit {CVE-2026-43091} - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870} - sched/rt: Skip currently executing CPU in rto_next_cpu() {CVE-2026-45919} - md/raid5: fix soft lockup in retry_aligned_read() {CVE-2026-46051} - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() {CVE-2026-46196} - exit: prevent preemption of oopsing TASK_DEAD task {CVE-2026-46173} - netfilter: ipset: stop hash:* range iteration at end {CVE-2026-52921} - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() {CVE-2026-53352} - quota: Fix potential NULL pointer dereference {CVE-2024-26878} - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229} - udp: clear skb->dev before running a sockmap verdict {CVE-2026-53184} - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146} - kasan: remove kasan_find_vm_area() to prevent possible deadlock {CVE-2025-38510} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds {CVE-2026-68391} - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} - bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336} - slip: bound decode() reads against the compressed packet length {CVE-2026-45843} - netfilter: nf_set_pipapo_avx2: fix initial map fill {CVE-2025-38120} - APEI/GHES: ARM processor Error: don't go past allocated memory {CVE-2026-43201} - netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272} - usb: typec: ucsi: Fix NULL pointer access {CVE-2025-21918} - futex: Prevent use-after-free during requeue-PI {CVE-2025-39977} - drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884} - KVM: nSVM: mark VMCB_LBR dirty at svm_{enable,disable}_lbrv copy sites {CVE-2026-46071} - ipv6: fix possible infinite loop in fib6_select_path() {CVE-2026-63968} - ipv6: fix possible infinite loop in fib6_info_uses_dev() {CVE-2025-38587} - wifi: cfg80211: fix link del callback to call correct handler {CVE-2024-57898} - drm/vmwgfx: drop the hash entry when adding a buffer object fails {CVE-2025-40111} - sched/rt: Have RT_PUSH_IPI be default off for non PREEMPT_RT {CVE-2026-64374} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path {CVE-2026-64370} - netfilter: ebtables: module names must be null-terminated {CVE-2026-64412} - Bluetooth: bnep: pin L2CAP connection during netdev registration {CVE-2026-64408} - netfilter: ebtables: terminate table name before find_table_lock() {CVE-2026-64411} - Bluetooth: L2CAP: validate option length before reading conf opt value {CVE-2026-64403} - net: af_key: initialize alg_key_len for IPComp states {CVE-2026-64436} - tipc: fix out-of-bounds read in broadcast Gap ACK blocks {CVE-2026-64450} - audit: Fix data races of skb_queue_len() readers on audit_queue {CVE-2026-64435} - USB: serial: keyspan_pda: fix information leak {CVE-2026-64336} - USB: serial: digi_acceleport: fix broken rx after throttle {CVE-2026-64335} - USB: serial: digi_acceleport: fix hard lockup on disconnect {CVE-2026-64334} - isofs: bound Rock Ridge symlink components to the SL record {CVE-2026-64317} - crypto: ecc - Fix carry overflow in vli multiplication {CVE-2026-64313} - crypto: drbg - Fix returning success on failure in CTR_DRBG {CVE-2026-64306} - tracing: Prevent out-of-bounds read in glob matching {CVE-2026-64299} - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} - smb: client: harden POSIX SID length parsing {CVE-2026-64380} - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - netfilter: nf_tables: release batch on table validation from abort path - Bluetooth: SCO: fix sleeping under spinlock in sco_conn_ready - padata: Reset next CPU when reorder sequence wraps around - padata: remove __padata_list_init() - usb: free iso schedules on failed submit {CVE-2026-64348} - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove {CVE-2026-64329} - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} - bpf: Allow LPM map access from sleepable BPF programs {CVE-2026-64352} - bpf: Consistently use bpf_rcu_lock_held() everywhere {CVE-2026-64352} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path {CVE-2026-64303} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() {CVE-2025-39944} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125} - can: isotp: use unconditional synchronize_rcu() in isotp_release() {CVE-2026-72126} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621} - net: gro: properly validate BIG TCP aggregation criteria {CVE-2026-80725} - mm/ptdump: always stabilise against page table freeing using init_mm {CVE-2026-74599} - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF {CVE-2026-74672} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} - tracing: Fix reading strings from synthetic events {CVE-2022-50255} - tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails {CVE-2022-50255} - tracing/probes: Fix to update dynamic data counter if fetcharg uses it {CVE-2022-50255} - tracing: Add FAULT_STRING macro to trace.h {CVE-2022-50255} - tracing: Move duplicate code of trace_kprobe/eprobe.c into header {CVE-2022-50255} - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib {CVE-2026-31566} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330} - bpf: Reject fragmented frames in devmap {CVE-2026-64355} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} - treewide: fix cosmetic build warnings introduced by recent backports {CVE-2026-23110} - drm/ttm: fix warning that we shouldn't mix && and || - mm/mmap: call hugetlb_split() under the i_mmap rwsem {CVE-2025-38084} - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" {CVE-2026-74604} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} - NFSv4: nfs4_do_open() is incorrectly triggering state recovery {CVE-2026-72472} - nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472} - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}