- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518} - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} - bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} - net: Introduce skb tc depth field to track packet loops {CVE-2026-63983} - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - ata: libata-core: Reject an invalid concurrent positioning ranges count {CVE-2026-72030} - wifi: mac80211: validate extension-frame layout before RX {CVE-2026-68470} - wifi: mac80211: pass 'sta' to ieee80211_rx_data_set_sta() {CVE-2026-68470} - drm/amd/pm: fix pptable use-after-free {CVE-2026-74450} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636} - smb: client: harden DFS cache against invalid target hints {CVE-2026-93210} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - HID: sony: clean up device list on probe failure {CVE-2026-90041} - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} - fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100} - bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} - netfilter: cttimeout: prevent UAF during module unload {CVE-2026-97609} - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - Squashfs: check block offset is not negative {CVE-2026-90203} - RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345} - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} - hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - scsi: target: Fix hexadecimal CHAP_I handling {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown {CVE-2026-89708} - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - netfilter: nf_tables: add hook transactions for device deletions {CVE-2026-63858} - netfilter: nf_tables: use kzalloc for hook allocation {CVE-2026-63858} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560} - sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520} - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} - arm64: mm: Fix the lockless page-table walk in show_pte() {CVE-2026-93239} - bpf: mark a NULL call argument precise {CVE-2026-98019} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} - RDMA/core: Fix potential use after free in counter_release() {CVE-2026-92509} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402} - sched: address a potential NULL pointer dereference in the GRED scheduler {CVE-2025-21980} - net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked {CVE-2026-43496} - vsock/virtio: discard packets if the transport changes {CVE-2025-21669} - SUNRPC: Fix a suspicious RCU usage warning {CVE-2023-52623} - netfilter: nf_tables: honor table dormant flag from netdev release event path {CVE-2024-36005} - netfilter: nf_tables: flush pending destroy work before exit_net release {CVE-2024-35899} - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr {CVE-2024-35969} - ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() {CVE-2024-27417} - erspan: make sure erspan_base_hdr is present in skb->head {CVE-2024-35888} - net/mlx5e: Fix mlx5e_priv_init() cleanup flow {CVE-2024-35959} - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() {CVE-2021-47548} - ovl: fix warning in ovl_create_real() {CVE-2021-47579} - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up {CVE-2024-36952} - dm: call the resume method on internal suspend {CVE-2024-26880} - drm/client: Fully protect modes[] with dev->mode_config.mutex {CVE-2024-35950} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} - sctp: Fix MAC comparison to be constant-time {CVE-2025-40204} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - ip: orphan prefetched skbs before multicast forwarding {CVE-2026-89564} - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - drm/amdgpu: zero-initialize GART table on allocation {CVE-2026-53374} - netfilter: ctnetlink: ignore explicit helper on new expectations {CVE-2026-43025} - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355} - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky {CVE-2026-43296} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() {CVE-2026-45872} - scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex {CVE-2026-31473} - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - RDMA/core: Fix potential use after free in ib_free_cq() {CVE-2026-92508} - HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind {CVE-2026-89625} - drm/i915/gem: Fix phys BO pread/pwrite with offset {CVE-2026-53356} - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers {CVE-2026-68277} - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 {CVE-2026-23005} - arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248} - rxrpc: proc: size address buffers for %pISpc output {CVE-2026-31630} - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} - ata: ata_generic: Don't store pci_device_id {CVE-2026-90421} - packet: use ubuf_info completion for TX_RING packets {CVE-2026-80841} - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} - exec: Cleanup POSIX timers right after de_thread() {CVE-2026-98260} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - ACPI: platform: Use acpi_bus_get_primary_device() {CVE-2026-93251} - ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323}