- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} - sctp: validate embedded address parameter length {CVE-2026-74287} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075} - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257} - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} - crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438} - crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438} - usb: free iso schedules on failed submit {CVE-2026-64348} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} - crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964} - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - net: tun: bound receive headroom {CVE-2026-81000} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} - libceph: remove debugfs files before client teardown {CVE-2026-68153} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet {CVE-2026-17523} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation {CVE-2026-43133} - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493} - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239} - net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272} - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} - blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552} - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480} - xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835} - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} - mm/kasan: fix double free for kasan pXds {CVE-2026-31686} - net_sched: qfq: Fix double list add in class with netem as child qdisc {CVE-2025-37913} - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790} - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure {CVE-2022-50401} - net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107} - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453} - bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490} - x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045} - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146} - net_sched: drr: Fix double list add in class with netem as child qdisc {CVE-2025-37915} - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111} - net_sched: red: fix a race in __red_change() {CVE-2025-38108} - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880} - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447} - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318} - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454} - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} - iio: event: Fix event FIFO reset race {CVE-2026-64496} - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174} - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() {CVE-2026-53352} - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117} - padata: Fix pd UAF once and for all {CVE-2025-38584} - xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-53147} - sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296} - ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344} - drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369} - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}