- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113} - btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} - xfs: delete attr leaf freemap entries when empty {CVE-2026-43158} - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664} - media: dvbdev: adopts refcnt to avoid UAF {CVE-2022-50274} - igbvf: fix double free in `igbvf_probe` {CVE-2021-47589} - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576} - ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281} - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} - IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields {CVE-2021-47485} - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740} - proc/vmcore: fix clearing user buffer by properly using clear_user() - staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect() - ASoC: ops: Correct bounds check for second channel on SX controls {CVE-2022-48951} - ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951} - nfsd: fix use-after-free due to delegation race {CVE-2021-47506}