- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075} - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} - usb: free iso schedules on failed submit {CVE-2026-64348} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} - net: tun: bound receive headroom {CVE-2026-81000} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268} - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} - libceph: remove debugfs files before client teardown {CVE-2026-68153} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet {CVE-2026-17523} - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961} - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589} - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493} - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239} - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} - net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272} - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480} - blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552} - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure {CVE-2022-50401} - net_sched: qfq: Fix double list add in class with netem as child qdisc {CVE-2025-37913} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453} - x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045} - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146} - net_sched: drr: Fix double list add in class with netem as child qdisc {CVE-2025-37915} - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111} - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880} - net_sched: red: fix a race in __red_change() {CVE-2025-38108} - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318} - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} - PCI: use generic driver_override infrastructure {CVE-2026-53120} - driver core: generalize driver_override in struct device - iio: event: Fix event FIFO reset race {CVE-2026-64496} - net/mlx5e: Fix use-after-free of encap entry in neigh update handler {CVE-2021-47247} - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174} - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282} - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() {CVE-2026-53352} - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001} - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117} - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129} - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} - padata: Fix pd UAF once and for all {CVE-2025-38584}