- net: skbuff: propagate shared-frag marker in skb_zerocopy() - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047} - SUNRPC: Fix a server shutdown leak {CVE-2023-53131} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info {CVE-2023-53066} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count {CVE-2026-64277} - dmaengine: Fix possible use after free {CVE-2026-72476} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state {CVE-2026-93288} - mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042} - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} - usb: dwc2: Fix use after free in debug code {CVE-2026-63927} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. {CVE-2024-50017} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} - RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508} - RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394} - dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - veth: fix NAPI leak in XDP enable error path {CVE-2026-80613} - net: hns3: fix kernel crash when 1588 is received on HIP08 devices {CVE-2024-26881} - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} - net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018} - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} - smb3: missing lock when picking channel {CVE-2024-35999} - smb: client: fix NULL ptr deref in crypto_aead_setkey() {CVE-2024-53185} - exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447} - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} - gfs2: Add metapath_dibh helper {CVE-2026-45984} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - fanotify: fix false positive on permission events {CVE-2026-46150} - pstore/ram: Add check for kstrdup {CVE-2023-54189} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209} - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} - bpf: Fix accesses to uninit stack slots {CVE-2023-52452} - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete {CVE-2026-31511} - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg {CVE-2022-49727} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. {CVE-2026-52986} - netfilter: nf_tables: use list_del_rcu for netlink hooks {CVE-2026-46324} - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} - net: openvswitch: fix use-after-free of the flow table mask array {CVE-2026-97611} - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} - net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465} - net/sched: cls_api: remove block_cb from driver_list before freeing {CVE-2023-54193} - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362} - perf: Reject exited events as group leaders {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec {CVE-2026-64556}