- net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222} - net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223} - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} - writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378} - writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378} - fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378} - libceph: validate banner payload length {CVE-2026-90067} - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} - NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} - RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345} - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991} - Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676} - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482} - nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386} - bpf: mark a NULL call argument precise {CVE-2026-98019} - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262} - ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262} - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} - fanotify: fix false positive on permission events {CVE-2026-46150} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} - sctp: stream: fully roll back denied add-stream state {CVE-2026-52929} - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246} - sctp: diag: reject stale associations in dump_one path {CVE-2026-52917} - sctp: Hold sock lock while iterating over address list {CVE-2026-52917} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - PCI: use generic driver_override infrastructure {CVE-2026-53120} - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} - Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid {CVE-2026-53255} - drm/amd/pm: fix pptable use-after-free {CVE-2026-74450} - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} - tracing: Take trace_array reference when opening options file {CVE-2026-90013} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc {CVE-2026-98588} - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794} - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} - media: em28xx: defer audio-only extension registration {CVE-2026-89892} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - ALSA: bcd2000: Fix race between rawmidi and disconnect {CVE-2026-98316} - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} - xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947} - net: qrtr: ns: Fix use-after-free in driver remove() {CVE-2026-46047} - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} - svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530} - svcrdma: Reject Write/Reply chunks with segcount 0 {CVE-2026-93228} - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} - net: add more sanity checks to qdisc_pkt_len_init() {CVE-2024-49948} - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} - mlxsw: pci: Don't store pci_device_id {CVE-2026-90421} - ata: ata_generic: Don't store pci_device_id {CVE-2026-90421} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} - nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} - Input: alps - fix use-after-free bugs caused by dev3_register_work {CVE-2025-68822} - ACPI: platform: Use acpi_bus_get_primary_device() {CVE-2026-100072} - ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251} - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962} - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882} - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800} - drm/amdgpu: zero-initialize GART table on allocation {CVE-2026-53374} - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} - net: Introduce skb tc depth field to track packet loops {CVE-2026-63983} - net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319} - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} - skbuff: introduce skb_pull_data {CVE-2026-53254} - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - mm/huge_memory: update file PMD counter before folio_put() {CVE-2026-53189} - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - sched/psi: Create the psimon kthread outside of cgroup_mutex {CVE-2026-52991} - sched/psi: fix race between file release and pressure write {CVE-2026-52991} - cgroup/psi: Set of->priv to NULL upon file release {CVE-2026-52991} - wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() {CVE-2022-50880} - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}