- Rebased onto Oracle UEK base 5.4.17-2136.357.2.el7uek - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564} - ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison {CVE-2026-53309} - ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043} - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} - scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166} - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} - scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075} - i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900} - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532} - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597} - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089} - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318} - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397} - Squashfs: check metadata block offset is within range {CVE-2026-23388} - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381} - wifi: mac80211: fix NULL deref in mesh_matches_local() {CVE-2026-23396} - icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398} - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382} - net: usb: kalmia: validate USB endpoints {CVE-2026-23365} - wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367} - drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() {CVE-2026-23356} - batman-adv: reject oversized global TT response buffers {CVE-2026-31659} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206} - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} - media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405} - sysctl: Fix data races in proc_douintvec(). {CVE-2022-49641} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778} - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885} - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083} - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745} - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724} - fou: remove warn in gue_gro_receive on unsupported protocol {CVE-2024-44940} - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929} - NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945} - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731} - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159} - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154} - net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977} - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061} - libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991} - net/sched: sch_qfq: do not free existing class in qfq_change_class() {CVE-2026-22999} - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089} - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991} - HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556} - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664} - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115} - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073} - media: xc2028: avoid use-after-free in load_firmware_cb() {CVE-2024-43900} - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285} - ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} - net/rds: zero per-item info buffer before handing it to visitors {CVE-2026-52995} - KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113} - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331} - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53163} - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038} - net: skbuff: fix missing zerocopy reference in pskb_carve helpers {CVE-2026-52943} - net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504} - net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null {CVE-2022-50073} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} - batman-adv: hold claim backbone gateways by reference {CVE-2026-31657} - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker {CVE-2026-63890} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - smb: client: reject userspace cifs.spnego descriptions {CVE-2026-46243} - tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322} - tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320} - tun: free page on short-frame rejection in tun_xdp_one() {CVE-2026-46321} - ptrace: slightly saner 'get_dumpable()' logic {CVE-2026-46333} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - net: skbuff: preserve shared-frag marker during coalescing {CVE-2026-46300} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193} - xfrm: esp: avoid in-place decrypt on shared skb frags {CVE-2026-43284} - crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-43077} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-43078} - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-43033} - crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-46028} - crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431} - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120} - net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}