- media: bttv: fix use after free error due to btv->timeout timer {CVE-2023-52847} - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087} - wifi: mwifiex: Fix OOB and integer underflow when rx packets {CVE-2023-53226} - vsock: Fix transport_* TOCTOU {CVE-2025-38461} - ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757} - perf/aux: Fix AUX buffer serialization {CVE-2024-46713} - locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836} - media: stk1160: fix bounds checking in stk1160_copy_video() {CVE-2024-38621} - ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} - ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() {CVE-2022-48738} - partitions: mac: fix handling of bogus partition table {CVE-2025-21772} - ALSA: oss: Fix PCM OSS buffer allocation overflow {CVE-2022-49292} - usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704} - vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214} - ppdev: Add an error check in register_device {CVE-2024-36015} - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} - enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659} - dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929} - dlm: fix plock invalid read {CVE-2022-49407} - rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev {CVE-2022-48759} - bpf: Don't use tnum_range on array range checking for poke descriptors {CVE-2022-49985} - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001} - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185} - dm integrity: fix memory corruption when tag_size is less than digest size {CVE-2022-49044} - drm/radeon: possible buffer overflow {CVE-2023-52867} - ata: sata_dwc_460ex: Fix crash due to OOB write {CVE-2022-49073} - fs/jfs: Add validity check for db_maxag and db_agpref {CVE-2023-52804} - net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581} - thermal: core: prevent potential string overflow {CVE-2023-52868} - ACPI: CPPC: Avoid out of bounds access when parsing _CPC data {CVE-2022-49145} - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} - igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332} - do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498} - drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119} - wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408} - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229} - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} - net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125} - net: stmmac: fix dma queue left shift overflow issue {CVE-2022-49592} - iio: adc: at91: call input_free_device() on allocated iio_dev {CVE-2024-57904} - crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373} - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 {CVE-2022-50228} - soundwire: cadence: fix invalid PDI offset {CVE-2024-38635} - wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} - ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365} - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans {CVE-2023-53034} - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297} - scsi: mpt3sas: Fix use-after-free warning {CVE-2022-48695} - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730} - scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841} - Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386} - scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322} - ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705} - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} - wifi: rtlwifi: remove unused dualmac control leftovers {CVE-2024-58072} - wifi: rtlwifi: remove unused timer and related code {CVE-2024-58072} - net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019} - wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864} - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} - ext4: move where set the MAY_INLINE_DATA flag is set {CVE-2025-22121} - ext4: introduce ITAIL helper {CVE-2025-22121} - ext4: improve xattr consistency checking and error reporting {CVE-2025-22121} - net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789} - mm: fix zswap writeback race condition {CVE-2023-53178} - fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367} - dma-buf/dma-resv: check if the new fence is really later {CVE-2022-49935}