- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818} - drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199} - drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230} - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - ALSA: usb: Fix UAF at delayed release of MIDI2 EPs {CVE-2026-74642} - ALSA: usb-audio: fix use-after-free in ump_to_endpoint() {CVE-2026-74501} - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730} - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} - exec: do_close_on_exec() before taking exec_update_lock {CVE-2026-64371} - proc: Fix broken error paths for namespace links {CVE-2026-64371} - proc: protect ptrace_may_access() with exec_update_lock (part 1) {CVE-2026-64371} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes {CVE-2026-74503} - ALSA: timer: Forcibly close timer instances at closing {CVE-2026-53193} - usb: typec: ucsi: Fix race condition and ordering in port unregistration {CVE-2026-74441} - arp: do not assume dev_hard_header() does not change skb->head {CVE-2026-22988} - netfilter: nft_ct: fix use-after-free in timeout object destroy {CVE-2026-31665} - md/raid10: fix writes_pending and barrier reference leaks on discard failures {CVE-2026-72438} - md/raid10: fix deadlock with check operation and nowait requests {CVE-2026-46050} - mm: introduce and use {pgd,p4d}_populate_kernel() {CVE-2025-39844} - vsock/virtio: fix zerocopy completion for multi-skb sends {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting {CVE-2026-52994} - mm: do file ownership checks with the proper mount idmap {CVE-2026-64294} - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} - SUNRPC: auth_gss: fix memory leaks in XDR decoding error paths {CVE-2026-45870} - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig {CVE-2026-53208} - slip: bound decode() reads against the compressed packet length {CVE-2026-45843} - net: tls: fix strparser anchor skb leak on offload RX setup failure {CVE-2026-52974} - netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272} - rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() {CVE-2026-23458} - mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr {CVE-2025-21938} - bpf: Fix NULL deref in map_kptr_match_type for scalar regs {CVE-2026-53032} - bpf: Explicitly check accesses to bpf_sock_addr {CVE-2025-40078} - nexthop: Forbid FDB status change while nexthop is in a group {CVE-2025-39980} - bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN {CVE-2026-31525} - x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() {CVE-2025-21913} - ptr_ring: do not block hard interrupts in ptr_ring_resize_multiple() {CVE-2024-57994} - drm/i915/vrr: require valid min/max vfreq for VRR {CVE-2026-68254} - libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954} - gfs2: prevent NULL pointer dereference during unmount {CVE-2026-53048} - smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path {CVE-2026-31708} - ext4: reject mount if bigalloc with s_first_data_block != 0 {CVE-2026-31447} - NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324} - netfilter: x_tables: guard option walkers against 1-byte tail reads {CVE-2026-43452} - smb: client: Fix refcount leak for cifs_sb_tlink {CVE-2025-40103} - smb: client: harden POSIX SID length parsing {CVE-2026-64380} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} - bpf: Allow LPM map access from sleepable BPF programs {CVE-2026-64352} - bpf: Consistently use bpf_rcu_lock_held() everywhere {CVE-2026-64352} - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621} - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} - Revert "thermal/drivers/hwmon: Cleanup coding style a bit" {CVE-2026-74604} - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path {CVE-2026-64303} - usb: typec: ucsi: ccg: Fix use-after-free of ucsi on remove {CVE-2026-64329} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib {CVE-2026-31566} - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer {CVE-2026-64034} - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion {CVE-2025-37891} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 {CVE-2026-53143} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - net: tun: bound receive headroom {CVE-2026-81000} - smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257} - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} - xsk: require at least 16 bytes of TX metadata {CVE-2026-74710} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - smb: client: fix use-after-free of iface in cifs_try_adding_channels() {CVE-2026-74608} - smb: mark the new channel addition log as informational log with cifs_info {CVE-2026-74608} - smb: client: Fix use-after-free in cifs_try_adding_channels() {CVE-2026-74608} - udf: reject VAT indexes equal to the entry count {CVE-2026-89525} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 {CVE-2026-45878} - smb: client: fix double-free in SMB2_open() replay {CVE-2026-64382} - smb: client: fix change notify replay double-free {CVE-2026-64384} - smb: client: fix query_info() replay double-free {CVE-2026-64386} - smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379} - net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete {CVE-2026-72072} - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} - video: screen_info: Relocate framebuffers behind PCI bridges {CVE-2025-38427} - erofs: fix the out-of-bounds nameoff handling for trailing dirents {CVE-2026-46078} - ceph: fix memory leak in ceph_direct_read_write() {CVE-2024-56710} - KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12 {CVE-2026-46071} - drm/amdgpu: Release VFCT ACPI table reference {CVE-2026-68238} - dm cache metadata: fix memory leak on metadata abort retry {CVE-2026-53060} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching {CVE-2026-52999} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457} - bpf: Preserve id of register in sync_linked_regs() {CVE-2026-45933} - bpf: Fix regsafe() for pointers to packet {CVE-2026-43030} - ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe {CVE-2025-68241} - perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list {CVE-2025-21895} - net: openvswitch: remove never-working support for setting nsh fields {CVE-2025-40254} - tracing: Fix race condition in kprobe initialization causing NULL pointer dereference {CVE-2025-40042} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled {CVE-2026-68085} - media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216} - Bluetooth: SMP: derive legacy responder STK authentication from MITM state {CVE-2026-31773} - Bluetooth: fix memory leak in error path of hci_alloc_dev() {CVE-2026-53252} - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394} - ext4: refresh inline data size before write operations {CVE-2025-68264} - kernfs: Relax constraint in draining guard {CVE-2025-38282} - netfilter: x_tables: ensure names are nul-terminated {CVE-2026-43028} - nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net {CVE-2026-89682} - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} - can: isotp: fix use-after-free race with concurrent NETDEV_UNREGISTER {CVE-2026-72125} - can: isotp: use unconditional synchronize_rcu() in isotp_release() {CVE-2026-72126} - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} - mm/debug_vm_pgtable: clear page table entries at destroy_args() {CVE-2025-39776} - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - usb: free iso schedules on failed submit {CVE-2026-64348} - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} - drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884} - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - drm/xe: Use local fence in error path of xe_migrate_clear {CVE-2025-37869} - nvmet-auth: validate reply message payload bounds against transfer length {CVE-2026-64319} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} - smb: client: fix query directory replay double-free {CVE-2026-64387} - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} - xfs: don't swallow dquot recovery verification errors {CVE-2026-80529} - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} - net: mana: validate rx_req_idx to prevent out-of-bounds array access {CVE-2026-64018} - bpf: Simplify sanitize_err() signature {CVE-2026-74720} - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} - smb: client: fix double-free in SMB2_flush() replay {CVE-2026-64383} - smb: client: fix double-free in SMB2_ioctl() replay {CVE-2026-64385} - smb: client: fix double-free in SMB2_close() replay {CVE-2026-64597} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() {CVE-2026-72069} - dm-verity: fix buffer overflow in FEC calculation {CVE-2026-72098} - dm-verity-fec: replace {MAX,MIN}_RSN with {MIN,MAX}_ROOTS {CVE-2026-72098} - dm-verity-fec: fix the size of dm_verity_fec_io::erasures {CVE-2026-72098} - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - locking/spinlock/debug: Fix data-race in do_raw_write_lock {CVE-2025-68336} - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). {CVE-2026-53353} - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). {CVE-2025-22005} - x86/fpu: Ensure shadow stack is active before "getting" registers {CVE-2025-21632} - perf/core: Add RCU read lock protection to perf_iterate_ctx() {CVE-2025-21889} - KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU {CVE-2026-31593} - genetlink: fix genl_bind() invoking bind() after -EPERM {CVE-2025-39926} - fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044} - rxrpc: Only put the call ref if one was acquired {CVE-2026-31638} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835} - bpf: Fix OOB in pcpu_init_value {CVE-2026-53076} - pid: Add a judgment for ns null in pid_nr_ns {CVE-2025-40178} - arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR {CVE-2024-57878} - kunit: Fix potential null dereference in kunit_device_driver_test() {CVE-2024-56773} - arm64/fpsimd: Discard stale CPU state when handling SME traps {CVE-2025-38170} - mm: hugetlb: avoid soft lockup when mprotect to large memory area {CVE-2025-40153} - perf/x86/intel: KVM: Mask PEBS_ENABLE loaded for guest with vCPU's value. {CVE-2025-37936} - KVM: x86: check for nEPT/nNPT in slow flush hypercalls {CVE-2026-46131} - netfilter: nf_tables: always walk all pending catchall elements {CVE-2026-23278} - openvswitch: validate MPLS set/set_masked payload length {CVE-2026-31679} - tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280} - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing {CVE-2025-68185} - devlink: fix xa_alloc_cyclic() error handling {CVE-2025-22017} - net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir {CVE-2026-53014} - ethtool: cmis_cdb: use correct rpl size in ethtool_cmis_module_poll() {CVE-2025-37791} - xfrm: prevent policy_hthresh.work from racing with netns teardown {CVE-2026-31516} - blk-cgroup: fix disk reference leak in blkcg_maybe_throttle_current() {CVE-2026-53126} - rxrpc: Fix key reference count leak from call->key {CVE-2026-31639} - xsk: fix refcount underflow in error path {CVE-2023-53698} - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} - octeontx2-af: Workaround SQM/PSE stalls by disabling sticky {CVE-2026-43296} - drm/xe/userptr: fix EFAULT handling {CVE-2025-21880} - bpf: fix mm lifecycle in open-coded task_vma iterator {CVE-2026-53085} - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() {CVE-2026-46201} - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} - netfilter: ipset: stop hash:* range iteration at end {CVE-2026-52921} - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} - tee: fix NULL pointer dereference in tee_shm_put {CVE-2025-39865} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU {CVE-2026-64287} - regulator: core: fix locking in regulator_resolve_supply() error path {CVE-2026-46252} - tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func() {CVE-2026-46196} - exit: prevent preemption of oopsing TASK_DEAD task {CVE-2026-46173} - EFI/CPER: don't dump the entire memory region {CVE-2026-43171} - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178} - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350} - svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails {CVE-2026-89534} - mptcp: avoid deadlock on fallback while reinjecting - mptcp: plug races between subflow fail and subflow creation {CVE-2025-38552} - mptcp: make fallback action and fallback decision atomic