- smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201} - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729} - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180} - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913} - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296} - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800} - net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074} - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114} - isofs: Prevent the use of too small fid {CVE-2025-37780} - media: dvb-frontends: avoid stack overflow warnings with clang {CVE-2024-27075} - ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886} - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304} - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824} - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269} - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574} - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572} - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891} - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853} - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680} - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691} - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322} - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258} - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885}