- dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - mm/damon/core: validate ranges in damon_set_regions() {CVE-2026-68165} - netpoll: Fix deadlock in memory allocation under spinlock {CVE-2025-68169} - drm/amdkfd: Check bounds on CRIU restore queue type and mqd size {CVE-2026-68258} - gve: fix Rx queue stall on alloc failure {CVE-2026-68129} - drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved {CVE-2026-68234} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} - media: v4l2-ctrls: validate HEVC active reference counts {CVE-2026-68206} - drm/i915/hdcp: check streams[] bounds before overflow {CVE-2026-68253} - drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() {CVE-2026-68245} - drm/amdgpu/gfx10: replace BUG_ON() with WARN_ON() {CVE-2026-68115} - drm/i915: Return NULL on error in active_instance {CVE-2026-68248} - smb: client: validate DFS referral PathConsumed {CVE-2026-68343} - ext4: fix use-after-free in update_super_work when racing with umount {CVE-2026-31446} - debugobjects: Plug race against a concurrent OOM disable {CVE-2026-68090} - HID: wacom: stop hardware after post-start probe failures {CVE-2026-68091} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() {CVE-2026-68264} - net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD {CVE-2026-68288} - drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() {CVE-2026-68113} - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} - drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436} - drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269} - Bluetooth: MGMT: revalidate LOAD_CONN_PARAM queued update {CVE-2026-68394} - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} - wifi: mt76: mt7925: fix crash in reset link replay {CVE-2026-68307} - Bluetooth: hci_sync: extend conn_hash lookup critical sections {CVE-2026-68393} - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243} - block: fix memory leak in __blkdev_issue_zero_pages {CVE-2026-68348} - drm/amdgpu/gfx: fix cleaner shader IB buffer overflow {CVE-2026-68276} - tracing: Do not call map->ops->elt_free() if elt_alloc() fails {CVE-2026-64173} - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362} - ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448} - drm/nouveau: fix reversed error cleanup order in ucopy functions {CVE-2026-68271} - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} - drm/vmwgfx: Validate vmw_surface_metadata::array_size {CVE-2026-68446} - net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM {CVE-2026-68296} - Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275} - iomap: fix out-of-bounds bitmap_set() with zero-length range {CVE-2026-68145} - vsock: fix lock inversion in vsock_assign_transport() {CVE-2025-40231} - ASoC: nau8821: Cancel delayed work on component remove {CVE-2026-45963} - ext4: validate p_idx bounds in ext4_ext_correct_indexes {CVE-2026-31449} - ipc: fix memleak if msg_init_ns failed in create_ipc_ns {CVE-2024-53175} - tls: make sure to abort the stream if headers are bogus {CVE-2025-39946} - ipv6: prevent infinite loop in rt6_nlmsg_size() {CVE-2025-38588} - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL {CVE-2026-23386} - xsk: validate MTU against usable frame size on bind {CVE-2026-43092} - RDMA/irdma: Harden depth calculation functions {CVE-2026-31491} - iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() {CVE-2026-31505} - net/ip6_tunnel: Prevent perpetual tunnel growth {CVE-2025-40173} - net/mlx5: Fix deadlock between devlink lock and esw->wq {CVE-2026-43468} - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458} - fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling {CVE-2026-52946} - nvmet: move async event work off nvmet-wq {CVE-2026-31557} - wifi: ath12k: Avoid memory leak while enabling statistics {CVE-2025-37743} - net: hns3: add vlan list lock to protect vlan list {CVE-2022-49182} - dmaengine: idxd: Fix leaking event log memory {CVE-2026-31440} - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192} - maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate() {CVE-2025-38364} - vfs: Don't leak disconnected dentries on umount {CVE-2025-40105} - mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure {CVE-2026-23142} - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure {CVE-2026-23142} - ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size {CVE-2026-52961} - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues {CVE-2026-23166} - mm/migrate: fix shmem xarray update during migration {CVE-2025-22015} - KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish {CVE-2026-31591} - mm: call ->free_folio() directly in folio_unmap_invalidate() {CVE-2026-31589} - bpf: Check skb->transport_header is set in bpf_skb_check_mtu {CVE-2025-68363} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds {CVE-2026-68391} - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} - drm/amdgpu/gfx11: replace BUG_ON() with WARN_ON() {CVE-2026-68246} - drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers {CVE-2026-68277} - drm/xe: Open-code GGTT MMIO access protection {CVE-2026-23466} - netfilter: conntrack: add missing netlink policy validations {CVE-2026-31407} - futex: Prevent use-after-free during requeue-PI {CVE-2025-39977} - net: openvswitch: fix middle attribute validation in push_nsh() action {CVE-2025-68785} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption {CVE-2026-53281} - bpf: Free reuseport cBPF prog after RCU grace period {CVE-2026-52910} - net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd() {CVE-2026-31700} - net: mana: Use pci_name() for debugfs directory naming {CVE-2026-53324} - netfilter: ctnetlink: ignore explicit helper on new expectations {CVE-2026-43025} - media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID {CVE-2025-40016} - net/mlx5: fw_tracer, Validate format string parameters {CVE-2025-68816} - ext4: avoid infinite loops caused by residual data {CVE-2026-31448} - Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ {CVE-2026-43134} - ext4: publish jinode after initialization {CVE-2026-31450} - drm/amdkfd: validate SVM ioctl nattr against buffer size {CVE-2026-46197} - drm/i915/gem: Fix phys BO pread/pwrite with offset {CVE-2026-53356} - net/mlx5: HWS, change error flow on matcher disconnect {CVE-2025-21751} - RDMA/irdma: Prevent rereg_mr for non-mem regions {CVE-2026-68419} - net/mlx5e: xsk: Fix unlocked writing to ICOSQ {CVE-2026-64210} - hwmon: (lm90) Add lock protection to lm90_alert {CVE-2026-64213} - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} - RDMA/siw: Remove direct link to net_device {CVE-2024-57857} - tracing: Fix reading strings from synthetic events {CVE-2022-50255} - ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() {CVE-2026-43437} - HID: core: Mitigate potential OOB by removing bogus memset() {CVE-2026-43048} - xfrm: Wait for RCU readers during policy netns exit {CVE-2026-43091} - wifi: mac80211: fix FILS discovery and unsol BPR double free {CVE-2026-64568} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation {CVE-2026-68257} - maple_tree: set MA_STATE_PREALLOC on zero-allocation early exits {CVE-2025-38364} - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} - iommu/amd: serialize sequence allocation under concurrent TLB invalidations {CVE-2026-43253} - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' {CVE-2025-38593} - Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete {CVE-2026-43059} - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers {CVE-2026-43059} - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete {CVE-2026-43059} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} - nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133} - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() {CVE-2026-53250} - spi: imx: fix use-after-free on unbind {CVE-2026-45996} - xdp: produce a warning when calculated tailroom is negative {CVE-2026-23343} - cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed() {CVE-2026-23327} - gve: Fix stats report corruption on queue count change {CVE-2026-23262}