- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495} - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271} - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269} - Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141} - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once {CVE-2025-40318} - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574} - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572} - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790} - nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825} - drm/xe: Make dma-fences compliant with the safe access rules {CVE-2025-38703} - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880} - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass {CVE-2025-38396} - anon_inode: explicitly block ->setattr() - anon_inode: use a proper mode internally - dynamic_dname(): drop unused dentry argument - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118} - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013} - drm/xe: Fix vm_bind_ioctl double free bug {CVE-2025-38731} - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680} - HID: core: ensure __hid_request reserves the report ID as the first byte - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891} - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853} - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691} - drm/i915: Protect access to driver and timeline name - sync_file: Protect access to driver and timeline name - dma-fence: Add safe access helpers and document the rules - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905} - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() {CVE-2025-39806} - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618} - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883} - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445} - drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389} - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249} - i40e: remove read access to debugfs files {CVE-2025-39901} - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863} - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459} - nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443} - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415} - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403} - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395} - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375} - ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346} - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240} - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180} - software node: Correct a OOB check in software_node_get_reference_args() {CVE-2025-38342} - net: atm: add lec_mutex {CVE-2025-38323} - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320} - bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280} - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245} - can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004} - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212} - exfat: fix double free in delayed_free {CVE-2025-38206} - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198} - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157} - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146} - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111} - net_sched: red: fix a race in __red_change() {CVE-2025-38108} - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103} - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077} - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} - smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024} - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request {CVE-2025-38013} - i40e: add validation for ring_len param {CVE-2025-39973} - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277} - net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301} - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154} - eventpoll: don't decrement ep refcount while still holding the ep mutex {CVE-2025-38349} - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305} - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() {CVE-2025-40294} - mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258} - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248} - dm: fix dm_blk_report_zones {CVE-2025-38141} - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy {CVE-2025-40251} - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing {CVE-2025-38568} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}