- net: skbuff: propagate shared-frag marker in skb_zerocopy() - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} - ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF {CVE-2026-98116} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265} - RDMA/siw: Bound fragmented header copies by the remaining length {CVE-2026-98323} - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} - RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133} - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} - gfs2: Add metapath_dibh helper {CVE-2026-45984} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} - gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} - xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935} - sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924} - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} - netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912} - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} - net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182} - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071} - dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062} - dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947} - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - thunderbolt: Bound root directory content to block size {CVE-2026-53149} - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} - thunderbolt: Clamp XDomain response data copy to allocation size {CVE-2026-53148} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} - netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math {CVE-2026-64102} - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801} - pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391} - net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() {CVE-2026-63994} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count {CVE-2026-64277} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp {CVE-2026-63975} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377} - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - scsi: qla2xxx: Drop vport reference under lock in report ID acquisition {CVE-2026-89861} - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262} - mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697} - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - drm/amdgpu: zero-initialize GART table on allocation {CVE-2026-53374} - scsi: target: iscsi: Validate CHAP_R length before base64 decode {CVE-2026-63886} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - Squashfs: check block offset is not negative {CVE-2026-90203} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} - RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds {CVE-2026-98360} - sctp: validate embedded address parameter length {CVE-2026-74287}