- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545} - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} - ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840} - i3c: master: svc: bound IBI payload to the requested max_payload_len {CVE-2026-80951} - i3c: master: svc: Use readsb helper for reading MDB {CVE-2026-80951} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access {CVE-2026-98365} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} - drm/virtio: use uninterruptible resv lock for plane updates {CVE-2026-64098} - keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823} - exfat: fix potential use-after-free in exfat_find_dir_entry() {CVE-2026-63808} - ethtool: cmis: require exact CDB reply length {CVE-2026-63996} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() {CVE-2026-63994} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} - HID: lg-g15: cancel pending work on remove to fix a use-after-free {CVE-2026-64362} - bpf: Validate BTF repeated field counts before expansion {CVE-2026-64354} - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342} - ALSA: seq: Serialize UMP output teardown with event_input {CVE-2026-64029} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() {CVE-2026-63993} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() {CVE-2026-63992} - vsock/virtio: bind uarg before filling zerocopy skb {CVE-2026-63970} - KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() {CVE-2026-64555} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc {CVE-2025-71113} - mailbox: mailbox-test: don't free the reused channel {CVE-2026-53294} - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} - blk-mq: pop cached request if it is usable {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race {CVE-2026-64560} - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246} - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} - Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - sched/core: Make core-sched flips wait for in-flight selections {CVE-2026-89520} - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - drm/amd/pm: fix pptable use-after-free {CVE-2026-74450} - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404} - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} - tracing: Undo the registration when enabling the histogram trigger fails {CVE-2026-97918} - drm/xe: Hold a dma-buf reference for imported BOs {CVE-2026-68266} - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714} - net/ipv6: Drop HBH for BIG TCP on RX side {CVE-2026-80725} - net/ipv6: Introduce payload_len helpers {CVE-2026-80725} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - HID: sony: clean up device list on probe failure {CVE-2026-90041} - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} - RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345} - RDMA/siw: Introduce siw_destroy_cep_sock {CVE-2026-74345} - wifi: mac80211_hwsim: clamp virtio RX length before skb_put {CVE-2026-68411} - KEYS: trusted: Fix TPM teardown ordering {CVE-2026-89763} - virt: tdx-guest: Just leak decrypted memory on unrecoverable errors {CVE-2024-57793} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - drm/amdgpu: zero-initialize GART table on allocation {CVE-2026-53374} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873} - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} - ip: orphan prefetched skbs before multicast forwarding {CVE-2026-89564} - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock {CVE-2026-63945} - smb: client: fix heap overflow in DACL owner/group rewrite {CVE-2026-97555} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - exec: Cleanup POSIX timers right after de_thread() {CVE-2026-98260} - scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - RDMA/core: Fix potential use after free in ib_free_cq() {CVE-2026-92508} - HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind {CVE-2026-89625} - arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248} - rxrpc: proc: size address buffers for %pISpc output {CVE-2026-31630} - netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160} - ASoC: tas2781: bound firmware description string parsing {CVE-2026-68348} - mptcp: pm: userspace: fix use-after-free in get_local_id {CVE-2026-68169} - nexthop: initialize extack in nh_res_bucket_migrate() {CVE-2026-64576}