- fix: dm: fix dm_blk_report_zones {CVE-2025-38141} - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() {CVE-2025-38664} - qed: Don't collect too many protection override GRC elements {CVE-2025-39949} - drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693} - iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961} - pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691} - netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732} - net/mlx5: Check device memory pointer before usage {CVE-2025-38645} - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085} - ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127} - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683} - rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749} - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201} - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823} - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824} - svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304} - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349} - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} - scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels {CVE-2025-38288} - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766} - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689} - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}