- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - Squashfs: check block offset is not negative {CVE-2026-90203} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - dm array: validate array block headers on read {CVE-2026-89574} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} - slip: fix use-after-free in sl_sync() {CVE-2026-81001} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - s390/qeth: validate user buffer length in SNMP and ARP query ioctls {CVE-2026-80584} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - dmaengine: Fix possible use after free {CVE-2026-72476} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} - sctp: validate embedded address parameter length {CVE-2026-74287} - netfilter: nf_queue: do not allow packet truncation below transport header offset {CVE-2022-36946} - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266} - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() {CVE-2022-48702} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - Update to kernel 3.10.0-1160.167.1.el7 - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O {CVE-2025-40026}