- mac802154: llsec: reject frames shorter than the authentication tag {CVE-2026-68125} - KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428} - wifi: mwifiex: fix NULL dereference when the AP has HT-cap but no HT-oper {CVE-2026-68197} - bpf: account for current allocated stack depth in widen_imprecise_scalars() {CVE-2025-68208} - tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322} - smb: client: fix potential cfid UAF in smb2_query_info_compound {CVE-2025-40320} - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} - binfmt_misc: set have_execfd only once the interpreter is opened {CVE-2026-68186} - tracing: Fix resource leak on mmiotrace trace_pipe close {CVE-2026-68175} - tipc: fix u16 MTU truncation in media and bearer MTU validation {CVE-2026-68297} - net: gro: fix double aggregation of flush-marked skbs {CVE-2026-68136} - bpf, sockmap: Reject unhashed UDP sockets on sockmap update {CVE-2026-68386} - wifi: brcmfmac: fix 802.1X-SHA256 call trace warning {CVE-2026-68304} - udf: fix partition descriptor append bookkeeping {CVE-2026-45991} - Bluetooth: SCO: fix race conditions in sco_sock_connect() {CVE-2026-43023} - smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195} - smb/client: fix out-of-bounds read in symlink_data() {CVE-2026-46185} - net: rtnetlink: zero ifla_vf_broadcast to avoid stack infoleak in rtnl_fill_vfinfo {CVE-2026-46132} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} - RDMA/mana: Validate rx_hash_key_len {CVE-2026-46145} - scsi: qla2xxx: Completely fix fcport double free {CVE-2026-43414} - bpf: Fix bpf_xdp_store_bytes proto for read-only arg {CVE-2026-45886} - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} - wifi: mac80211: use safe list iteration in radar detect work {CVE-2026-46166} - RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads {CVE-2026-46114} - nfsd: never defer requests during idmap lookup {CVE-2026-45983} - drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287} - openvswitch: cap upcall PID array size and pre-size vport replies {CVE-2026-45840} - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} - dm mirror: fix integer overflow in create_dirty_log() {CVE-2026-46023} - netfilter: nft_inner: Fix IPv6 inner_thoff desync {CVE-2026-46244} - drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() {CVE-2026-68429} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - RDMA/rxe: Fix race condition in QP timer handlers {CVE-2026-45910} - wifi: mac80211: remove station if connection prep fails {CVE-2026-46125} - tcp: call sk_data_ready() after listener migration {CVE-2026-46015} - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk {CVE-2025-38289} - net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - io-wq: check that the predecessor is hashed in io_wq_remove_pending() {CVE-2026-46274} - wifi: mac80211: drop stray 'static' from fast-RX rx_result {CVE-2026-46152} - io_uring/poll: fix signed comparison in io_poll_get_ownership() {CVE-2026-52933} - xfrm: espintcp: do not reuse an in-progress partial send {CVE-2026-52935} - Bluetooth: btusb: validate Realtek vendor event length {CVE-2026-68339} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag {CVE-2026-53218} - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp {CVE-2026-53071} - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} - wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync {CVE-2026-53103} - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - Bluetooth: eir: Fix possible crashes on eir_create_adv_data {CVE-2025-38303} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - iommu/vt-d: Flush cache for PASID table before using it {CVE-2026-45862} - USB: serial: io_ti: fix heap overflow in get_manuf_info() {CVE-2026-53196} - tcp: restrict SO_ATTACH_FILTER to priv users {CVE-2026-53236} - netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove {CVE-2026-52947} - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} - ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options {CVE-2026-53249} - wifi: nl80211: reject oversized EMA RNR lists {CVE-2026-53182} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - bpf: Validate node_id in arena_alloc_pages() {CVE-2026-53031} - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch {CVE-2026-53011} - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} - ALSA: timer: Fix UAF at snd_timer_user_params() {CVE-2026-53192} - netfilter: nft_ct: fix missing expect put in obj eval {CVE-2026-52970} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - crypto: af_alg - Cap AEAD AD length to 0x80000000 {CVE-2026-52972} - scsi: target: core: Fix integer overflow in UNMAP bounds check {CVE-2026-53021} - gve: prevent ethtool ops after shutdown {CVE-2025-38735} - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath {CVE-2026-43112} - wifi: cfg80211: advance loop vars in cfg80211_merge_profile() {CVE-2026-64174} - blk-cgroup: fix UAF in __blkcg_rstat_flush() {CVE-2026-63802} - serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails {CVE-2026-53384} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr {CVE-2026-53391} - pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800} - USB: serial: omninet: fix memory corruption with small endpoint {CVE-2026-63928} - ice: fix double free in ice_sf_eth_activate() error path {CVE-2026-46162} - net/sched: netem: fix queue limit check to include reordered packets {CVE-2026-52984} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() {CVE-2026-46172} - octeontx2-af: Fix PF driver crash with kexec kernel booting {CVE-2026-46249} - platform/x86/intel/pmt: fix a crashlog NULL pointer access {CVE-2025-38559} - md/raid10: fix divide-by-zero in setup_geo() with zero far_copies {CVE-2026-46161} - usb: usblp: fix heap leak in IEEE 1284 device ID via short response {CVE-2026-46151} - media: saa7164: add ioremap return checks and cleanups {CVE-2026-46235} - usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl {CVE-2026-46167} - drm/amdgpu/sdma4: replace BUG_ON with WARN_ON in fence emission {CVE-2026-46220} - drm/amdkfd: Clear VRAM on allocation to prevent stale data exposure {CVE-2026-46229} - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} - vsock: fix buffer size clamping order {CVE-2026-46234} - vsock/virtio: fix accept queue count leak on transport mismatch {CVE-2026-46214} - sound: ua101: fix division by zero at probe {CVE-2026-46184} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - ext4: fix memory leak in ext4_ext_shift_extents() {CVE-2026-45948} - HID: playstation: Add missing check for input_ff_create_memless {CVE-2026-45969} - SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path {CVE-2026-45964} - inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails {CVE-2026-46040} - md/raid5: fix soft lockup in retry_aligned_read() {CVE-2026-46051} - mptcp: handle fastopen disconnect correctly {CVE-2025-21705} - net: qrtr: ns: Free the node during ctrl_cmd_bye() {CVE-2026-46038} - ALSA: ctxfi: Add fallback to default RSR for S/PDIF {CVE-2026-46049} - iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode {CVE-2026-43130} - ALSA: usb-audio: stop parsing UAC2 rates at MAX_NR_RATES {CVE-2026-46018} - KVM: nSVM: Sync interrupt shadow to cached vmcb12 after VMRUN of L2 {CVE-2026-45987} - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access {CVE-2026-31393} - fat: avoid parent link count underflow in rmdir {CVE-2026-45915} - ipmi: Check event message buffer response for bad data {CVE-2026-46128} - KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 {CVE-2026-46082} - ice: fix PTP Call Trace during PTP release {CVE-2026-68133} - net/mlx5: Clean up only new IRQ glue on request_irq() failure {CVE-2025-40250} - netfilter: reject zero shift in nft_bitwise {CVE-2026-46101} - ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() {CVE-2026-46088} - net: remove WARN_ON_ONCE when accessing forward path array {CVE-2026-45847} - ipvs: skip ipv6 extension headers for csum checks {CVE-2026-45850} - Bluetooth: L2CAP: Fix type confusion in l2cap_ecred_reconf_rsp() {CVE-2026-43062} - netfilter: nft_ct: drop pending enqueued packets on removal {CVE-2026-43060} - bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() {CVE-2026-45839} - netfilter: nft_ct: add seqadj extension for natted connections {CVE-2025-68206} - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO {CVE-2026-45841} - bpf: fix end-of-list detection in cgroup_storage_get_next_key() {CVE-2026-45838} - slip: reject VJ receive packets on instances with no rstate array {CVE-2026-45842} - netfilter: x_tables: avoid leaking percpu counter pointers {CVE-2026-53219} - drm/amdgpu: Add bounds checking to ib_{get,set}_value {CVE-2026-46218} - net: openvswitch: fix possible kfree_skb of ERR_PTR {CVE-2026-53227} - wifi: mt76: mt7921: Place upper limit on station AID {CVE-2026-53317} - vsock/vmci: fix sk_ack_backlog leak on failed handshake {CVE-2026-53181} - tty: hvc_iucv: fix off-by-one in number of supported devices {CVE-2026-53306} - bnxt_en: Fix NULL pointer dereference {CVE-2026-53177} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329} - scsi: sg: Resolve soft lockup issue when opening /dev/sgX {CVE-2026-53304} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - audit: fix incorrect inheritable capability in CAPSET records {CVE-2026-53287} - wifi: ath11k: fix potential buffer underflow in ath11k_hal_rx_msdu_list_get() {CVE-2026-68355} - 6lowpan: fix off-by-one in multicast context address compression {CVE-2026-53263} - wifi: mt76: mt7925: guard link STA in decap offload {CVE-2026-68311} - netfilter: synproxy: add mutex to guard hook reference counting {CVE-2026-53269} - net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr {CVE-2026-53245} - tipc: fix infinite loop in __tipc_nl_compat_dumpit {CVE-2026-68313} - wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} - drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs {CVE-2026-53135} - smb/client: handle overlapping allocated ranges in fallocate {CVE-2026-68388} - scsi: target: tcm_loop: Fix NULL ptr dereference - pNFS: Handle RPC size limit for layoutcommits - mailbox: add sanity check for channel array {CVE-2026-53295} - ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all() - vsock/vmci: fix UAF when peer resets connection during handshake - tracing/histogram: Fix a potential memory leak for kstrdup() {CVE-2022-48768} - netlabel: validate unlabeled address and mask attribute lengths {CVE-2026-53238} - Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2025-38052} - crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231} - net/sched: taprio: fix NULL pointer dereference in class dump - pmdomain: core: Fix detach procedure for virtual devices in genpd {CVE-2026-46292} - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle - net/sched: cls_fw: fix NULL dereference of "old" filters before change() {CVE-2026-31421} - can: af_can: fix NULL pointer dereference in can_rx_register() {CVE-2022-49863} - net/sched: sch_netem: fix out-of-bounds access in packet corruption {CVE-2026-31675} - i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl {CVE-2026-52948} - nexthop: fix IPv6 route referencing IPv4 nexthop {CVE-2026-53012} - PCI: Fix lock symmetry in pci_slot_unlock() - Input: uinput - take event lock when submitting FF request "event" - wifi: mac80211: tear down new links on vif update error path {CVE-2026-64574} - KVM: Reject wrapped offset in kvm_reset_dirty_gfn() {CVE-2026-52969} - ipv4: fib: free fib_alias with kfree_rcu() on insert error path {CVE-2026-64572} - Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del() - netdevsim: zero initialize struct iphdr in dummy sk_buff {CVE-2026-52985} - xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert {CVE-2026-64579} - HID: usbhid: fix deadlock in hid_post_reset() {CVE-2026-53037} - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} - RDMA/siw: Reject MPA FPDU length underflow before signed receive math - ALSA: usb-audio: Bound MIDI endpoint descriptor scans {CVE-2026-52963} - mptcp: reset when MPTCP opts are dropped after join - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows {CVE-2026-43501} - bpf: Reject fragmented frames in devmap {CVE-2026-64576} - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling - Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189} - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206} - nvme: fix memory allocation in nvme_pr_read_keys() {CVE-2026-23244} - thunderbolt: Clamp XDomain response data copy to allocation size - drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() {CVE-2026-53330} - arm64: cputype: Add MIDR_CORTEX_A76AE - accel/ivpu: Fix signed integer truncation in IPC receive {CVE-2026-53202}