- net: skbuff: propagate shared-frag marker in skb_zerocopy() - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331} - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - smb: client: harden POSIX SID length parsing {CVE-2026-64380} - RDMA: Fix use-after-free in rxe_queue_cleanup {CVE-2021-47616} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189} - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - dmaengine: Fix possible use after free {CVE-2026-72476} - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047} - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} - thunderbolt: Bound root directory content to block size {CVE-2026-53149} - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} - SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697} - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071} - Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails {CVE-2026-53071} - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} - dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} - RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794} - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935} - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer {CVE-2026-64034} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() {CVE-2026-98343} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - ice: fix double-free of tx_buf skb {CVE-2026-53009} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075}