- net: skbuff: propagate shared-frag marker in skb_zerocopy() - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331} - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962} - ice: fix double-free of tx_buf skb {CVE-2026-53009} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362} - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} - hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826} - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} - scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531} - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - sctp: prevent peer transport count overflow {CVE-2026-74469} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} - pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800} - NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - media: em28xx: defer audio-only extension registration {CVE-2026-89892} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} - dmaengine: Fix possible use after free {CVE-2026-72476} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - thunderbolt: Bound root directory content to block size {CVE-2026-53149} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() {CVE-2026-63994} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}