- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166} - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499} - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669} - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068} - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078} - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328} - drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664} - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} - driver core: enforce device_lock for driver_match_device() {CVE-2026-31688} - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} - netfilter: conntrack: switch to siphash {CVE-2021-3773} - gpiolib: cdev: fix NULL-pointer dereferences {CVE-2022-50453} - tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006} - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977} - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799} - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397} - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329} - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} - xen: fix buffer overflow in buildid_show() {CVE-2026-31786} - NTB: fix possible name leak in ntb_register_device() {CVE-2023-52652} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} - erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053} - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} - ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}