- md/raid1,raid10: strip REQ_NOWAIT from member bios {CVE-2025-22125} - md/raid1: fix data lost for writemostly rdev {CVE-2025-22125} - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT {CVE-2025-22125} - md/raid1,raid10: don't ignore IO flags {CVE-2025-22125} - net/sched: netem: fix queue limit check to include reordered packets {CVE-2026-52984} - netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() {CVE-2025-21703} - net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818} - drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199} - drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230} - vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE {CVE-2022-48862} - vhost: handle error while adding split ranges to iotlb {CVE-2022-48862} - vhost: allow batching hint without size {CVE-2022-48862} - vhost: fix hung thread due to erroneous iotlb entries {CVE-2022-48862} - md raid: fix hang when stopping arrays with metadata through dm-raid {CVE-2026-43309} - dm raid: use proper md_ro_state enumerators {CVE-2026-43309} - i40e: When removing VF MAC filters, only check PF-set MAC {CVE-2024-26830} - i40e: Fix VF MAC filter removal {CVE-2024-26830} - i40e: Do not allow untrusted VF to remove administratively set MAC {CVE-2024-26830} - netlink: make sure we allow at least one dump skb {CVE-2025-38465} - netlink: avoid infinite retry looping in netlink_unicast() {CVE-2025-38465} - netlink: Fix rmem check in netlink_broadcast_deliver(). {CVE-2025-38465} - netlink: Fix wraparounds of sk->sk_rmem_alloc. {CVE-2025-38465} - ipv6: fix possible infinite loop in rt6_fill_node() {CVE-2024-56703} - ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2024-56703} - ipv6: Fix soft lockups in fib6_select_path under high next hop churn {CVE-2024-56703} - qede: fix out-of-bounds check for cqe->len_list[] {CVE-2025-40252} - net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() {CVE-2025-40252} - scsi: lpfc: apply the HBA_SETUP dev_loss check to SLI4 only {CVE-2024-49891} - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths {CVE-2024-49891} - ext4: fix string copying in parse_apply_sb_mount_options() {CVE-2025-71123} - ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() {CVE-2025-40198} - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - blk-iolatency: Fix memory leak on add_disk() failures {CVE-2022-50550} - drm/vkms: Fix use after free and double free on init error {CVE-2025-22097} - iommu/amd: move wait_on_sem() out of spinlock {CVE-2026-43253} - fbdev: bitblit: bound-check glyph index in bit_cursor() {CVE-2026-74635} - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726} - wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517} - sctp: prevent peer transport count overflow {CVE-2026-74469} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - sctp: validate embedded address parameter length {CVE-2026-74287} - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374} - ALSA: usb-audio: Fix a DMA to stack memory bug {CVE-2024-53197} - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197} - USB: core: Limit the length of unkillable synchronous timeouts {CVE-2026-43428} - ext4: refresh inline data size before write operations {CVE-2025-68264} - net, bpf: check master for NULL in xdp_master_redirect() {CVE-2026-64545} - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505} - dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280} - net: hns3: add vlan list lock to protect vlan list {CVE-2022-49182} - spi: fix statistics allocation {CVE-2026-23475} https://git.kernel.org/linus/dee0774bbb2abb172e9069ce5ffef579b12b3ae9 https://nvd.nist.gov/vuln/detail/CVE-2026-23475 https://access.redhat.com/security/cve/CVE-2026-23475 https://ubuntu.com/security/CVE-2026-23475 almalinux9.2esu: Issue: ELSCVE-153557 (https://cloudlinux.atlassian.net/browse/ELSCVE-153557) CVSS: 5.5 - net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254} - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938} - drm/hyperv: Fix address space leak when Hyper-V DRM device is removed {CVE-2025-21978} - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O {CVE-2025-40026} - vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231} - ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446} - dm cache metadata: fix memory leak on metadata abort retry {CVE-2026-53060} - netfilter: ipset: fix refcount race between list:set GC and swap {CVE-2026-74748} - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288} - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} - drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436} - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362} - usb: roles: fix NULL pointer issue when put module's reference {CVE-2024-26747} - drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446} - smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103} - bpf: Free reuseport cBPF prog after RCU grace period {CVE-2026-52910} - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size {CVE-2026-52961} - bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded {CVE-2026-23310} - block: stop the timeout timer when releasing a never added disk {CVE-2026-80589} - net/mlx5: fw_tracer, return NULL on create error {CVE-2026-74717} - ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops {CVE-2026-74657} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer {CVE-2026-64034} - nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net {CVE-2026-89682} - nvmet-auth: validate reply message payload bounds against transfer length {CVE-2026-64319} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} - smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379} - dm-verity: fix buffer overflow in FEC calculation {CVE-2026-72098} - nvmet-auth: reject short AUTH_RECEIVE buffers {CVE-2026-72130} - drm/amdgpu: Fix context pstate override handling {CVE-2026-68273} - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() {CVE-2026-90228} - nvmet: fix error handling in nvmet_execute_identify_cns_cs_ns() {CVE-2026-90228} - svcrdma: Reject Write/Reply chunks with segcount 0 {CVE-2026-93228} - smb: client: fix heap overflow in DACL owner/group rewrite {CVE-2026-97555} - ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740} - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764} - dm: fix unlocked test for dm_suspended_md {CVE-2026-46327} - drm/amd/display: Validate GPIO pin LUT table size before iterating {CVE-2026-64097} - i40e: fix validation of VF state in get resources {CVE-2025-39969} - l2tp: prevent possible tunnel refcount underflow {CVE-2024-49940} - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} - bnx2x: fix potential memory leak in bnx2x_tpa_stop() {CVE-2022-3542} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} - usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm() {CVE-2026-74680} - bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor {CVE-2026-74726} - net, bpf: fix null-ptr-deref in xdp_master_redirect() for down master {CVE-2026-53069} - net/sched: cls_bpf: reject dev-bound programs bound to a different device {CVE-2026-74736} - xfrm: input: hold netns during deferred transport reinjection {CVE-2026-63919} - ASoC: rt700-sdw: always drain jack work on remove {CVE-2026-93185} - ima: fix out-of-bounds read in xattr_verify() {CVE-2026-74671} - net/openvswitch: check Ethernet header length in key_extract() {CVE-2026-74701} - bpf: reject BPF_PSEUDO_FUNC reference to the main program {CVE-2026-98075} - selinux: check connect-related permissions on TCP Fast Open {CVE-2026-72243} - ppp_synctty: ensure a writeable skb header {CVE-2026-97964} - nvme-rdma: fix -EIO cleanup order in queue_rq {CVE-2026-98154} - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} - drm/gud: NUL-terminate TV mode names read from the device {CVE-2026-89817} - NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check {CVE-2026-89711} - nvdimm: pmem: keep PREFLUSH before data writes {CVE-2026-98161} - net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261} - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} - Bluetooth: ISO: fix UAF in iso_recv_frame {CVE-2026-63946} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} - net/mlx5e: Fix use-after-free race in sample_restore_put() {CVE-2026-98016} - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075} - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} - xfs: fix ilock leak on error in xfs_dq_get_next_id {CVE-2026-80534} - nexthop: Initialize extack in remove_nh_grp_entry() {CVE-2026-98031} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - ASoC: ops: Consistently treat platform_max as control value {CVE-2025-37889} - Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet {CVE-2026-80574} - crypto: essiv - Check ssize for decryption and in-place encryption {CVE-2025-40019} - Squashfs: fix uninit-value in squashfs_get_parent {CVE-2025-40049} - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() {CVE-2025-40115} - nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980} - can: gw: fix OOB heap access in cgw_csum_crc8_rel() {CVE-2026-31570} - libceph: Use u32 for non-negative values in ceph_monmap_decode() {CVE-2026-43405} - perf/x86/amd: Fix crash due to race between amd_pmu_enable_all, perf NMI and throttling {CVE-2022-49781} - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241} - net: ipv6: flowlabel: defer exclusive option free until RCU teardown {CVE-2026-31680} - KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight {CVE-2025-38455} - bpf: reject direct access to nullable PTR_TO_BUF pointers {CVE-2026-43333} - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221} - KVM: x86: Play nice with protected guests in complete_hypercall_exit() {CVE-2024-55881} - pid: Add a judgment for ns null in pid_nr_ns {CVE-2025-40178} - arm64/fpsimd: Discard stale CPU state when handling SME traps {CVE-2025-38170} - vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991} - ALSA: timer: drain a slave's callback before its master detaches it {CVE-2026-68201} - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} - libceph: validate banner payload length {CVE-2026-90067} - tls: fix handling of zero-length records on the rx_list {CVE-2025-39682}