- ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641} - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669} - ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517} - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209} - nfsd: make sure exp active before svc_export_show {CVE-2024-56558} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961} - dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064} - net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - Squashfs: check block offset is not negative {CVE-2026-90203} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304} - nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686} - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}