- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807} - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available {CVE-2026-64561} - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53271} - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() {CVE-2025-37912} - wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr() {CVE-2026-53318} - dpll: Prevent duplicate registrations {CVE-2026-23129} - pinmux: fix race causing mux_owner NULL with active mux_usecount {CVE-2025-38632} - HID: apple: validate feature-report field count to prevent NULL pointer dereference {CVE-2025-38557} - thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146} - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466} - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469} - scsi: target: Reset t_task_cdb pointer in error case {CVE-2025-68782} - ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388} - drm/xe/reg_sr: Fix leak on xa_store failure {CVE-2026-23418} - ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459} - md/raid10: wait barrier before returning discard request with REQ_NOWAIT {CVE-2025-40325} - nbd: defer config put in recv_work {CVE-2025-68372} - nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference {CVE-2026-23148} - net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064} - net/mlx5e: Disable MACsec offload for uplink representor profile {CVE-2025-38020} - serial: imx: fix tx statemachine deadlock {CVE-2023-52456} - dm-thin: fix metadata refcount underflow {CVE-2026-46107} - net/mlx5e: xsk: Fix DMA and xdp_frame leak on XDP_TX xmit failure {CVE-2026-53229} - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} - usbnet:fix NPE during rx_complete {CVE-2025-22050} - platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it {CVE-2025-21645} - driver core: class: Fix wild pointer dereferences in API class_dev_iter_next() {CVE-2025-21810} - usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916} - ALSA: seq: dummy: fix UMP event stack overread {CVE-2026-53241} - pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled {CVE-2026-31655} - net/mlx5: Bridge, fix the crash caused by LAG state check {CVE-2025-21970} - ALSA: timer: Don't take register_mutex with copy_from/to_user() {CVE-2025-23134} - md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070} - nvmet-fc: move lsop put work to nvmet_fc_ls_req_op {CVE-2025-40171} - iommu: Fix potential memory leak in iopf_queue_remove_device() {CVE-2025-21770} - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035} - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997} - can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625} - nvme-tcp: fix the memleak while create new ctrl failed {CVE-2024-56632} - ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3() {CVE-2026-46146} - pmdomain: imx8m-blk-ctrl: fix out-of-range access of bc->domains {CVE-2026-23187} - wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path {CVE-2025-22128} - octeon_ep: Fix memory leak in octep_device_setup() {CVE-2026-23160} - pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030} - net: tun: fix tun_napi_alloc_frags() {CVE-2024-56372} - wifi: iwlwifi: mvm: clean up ROC on failure {CVE-2025-21906} - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275} - dpll: fix xa_alloc_cyclic() error handling {CVE-2025-22016} - usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758} - RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242} - wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092} - scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() {CVE-2025-68229} - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697} - drm/display/dp_mst: Add protection against 0 vcpi {CVE-2025-71305} - ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe() {CVE-2025-37793} - drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() {CVE-2026-53190} - HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520} - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522} - wifi: rtw88: Fix alignment fault in rtw_core_enable_beacon() {CVE-2025-71229} - wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi {CVE-2026-53105} - net: bonding: fix NULL pointer dereference in bond_do_ioctl() {CVE-2026-53337} - firmware_loader: Fix possible resource leak in fw_log_firmware_info() {CVE-2024-53202} - drm/virtio: Fix driver removal with disabled KMS {CVE-2026-53347} - vxlan: Fix uninit-value in vxlan_vnifilter_dump() {CVE-2025-21716} - gpiolib: Fix crash on error in gpiochip_get_ngpios() {CVE-2025-21783} - drm/tegra: nvdec: Fix dma_alloc_coherent error check {CVE-2025-38543} - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088} - HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047} - scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() {CVE-2025-40115} - drm/xe/vm: Clear the scratch_pt pointer on error {CVE-2025-39811} - ice: ptp: don't WARN when controlling PF is unavailable {CVE-2026-43346} - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card {CVE-2025-40085} - regmap: maple: free entry on mas_store_gfp() failure {CVE-2026-23260} - ALSA: usb-audio: Bound MIDI 2.0 endpoint descriptor scans {CVE-2026-52964} - wifi: brcmfmac: Fix error pointer dereference {CVE-2026-53093} - usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288} - scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473} - HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111} - drm/hyperv: Fix address space leak when Hyper-V DRM device is removed {CVE-2025-21978} - tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320} - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180} - wifi: rtw88: fix device leak on probe failure {CVE-2026-31604} - zram: do not forget to endio for partial discard requests {CVE-2026-46089} - drm/vmwgfx: Return the correct value in vmw_translate_ptr functions {CVE-2026-23317} - usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432} - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler {CVE-2026-45922} - PCI: Fix reset_method_store() memory leak {CVE-2024-56745} - rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079} - dm-integrity: Avoid divide by zero in table status in Inline mode {CVE-2025-21874} - net: stmmac: fix integer underflow in chain mode {CVE-2026-31649} - net/mlx5e: TC, delete flows only for existing peers {CVE-2026-23173} - idpf: fix checksums set in idpf_rx_rsc() {CVE-2025-21890} - be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264} - wifi: ath12k: fix dma_free_coherent() pointer {CVE-2026-23135} - scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() {CVE-2026-45872} - bus: mhi: host: Fix race between unprepare and queue_buf {CVE-2025-23151} - x86/tdx: Fix data leak in mmio_read() {CVE-2024-46794} - wifi: ath11k: fix memory leaks in beacon template setup {CVE-2026-53113} - Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027} - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() {CVE-2025-22117} - thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147} - pps: fix warning in pps_register_cdev when register device fail {CVE-2025-40070} - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102} - usb: xhci: Prevent interrupt storm on host controller error (HCE) {CVE-2026-43488} - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used {CVE-2025-38113} - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() {CVE-2026-45982} - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() {CVE-2025-40211} - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304} - smb: client: fix off-by-8 bounds check in check_wsl_eas() {CVE-2026-31614} - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339} - efi: Fix reservation of unaccepted memory table {CVE-2026-45851} - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access {CVE-2026-46094} - X.509: Fix out-of-bounds access when parsing extensions {CVE-2026-31430} - topology: Keep the cpumask unchanged when printing cpumap {CVE-2024-57917} - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} - net: mana: fix use-after-free in add_adev() error path {CVE-2026-43056} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation {CVE-2026-43133} - RDMA/irdma: Fix double free related to rereg_user_mr {CVE-2026-43120} - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329} - ACPI: pfr_update: Fix the driver update version check {CVE-2025-39701} - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early {CVE-2025-39861} - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112} - wifi: mac80211: increase scan_ies_len for S1G {CVE-2025-39957} - clsact: Fix use-after-free in init/destroy rollback asymmetry {CVE-2026-23413} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry {CVE-2026-43114} - netfilter: bpf: defer hook memory release until rcu readers are done {CVE-2026-23412} - bpf: Fix stack-out-of-bounds write in devmap {CVE-2026-23359} - wifi: mt76: mt7921: fix a potential clc buffer length underflow {CVE-2026-46136} - wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() {CVE-2026-23363} - wifi: rtl8xxxu: fix slab-out-of-bounds in rtl8xxxu_sta_add {CVE-2025-71234} - crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode {CVE-2025-71231} - io_uring: fix incorrect io_kiocb reference in io_link_skb {CVE-2025-39963} - octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() {CVE-2025-39944} - ixgbe: fix incorrect map used in eee linkmode {CVE-2025-39922} - mm/damon/sysfs: fix use-after-free in state_show() {CVE-2025-39877} - Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140} - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} - iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676} - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239} - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957} - bnxt_en: Fix RSS context delete logic {CVE-2026-43260} - eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx} {CVE-2025-21973} - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093} - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file {CVE-2024-42138} - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480}