- net: skbuff: propagate shared-frag marker in skb_zerocopy() - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} - ALSA: virtio: reset device before deleting virtqueues {CVE-2026-98264} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} - ALSA: caiaq: Fix potential double-free at error path {CVE-2026-98066} - ASoC: Intel: avs: Disable periods-elapsed work when closing PCM {CVE-2025-40344} - ALSA: timer: drain a slave's callback before its master detaches it {CVE-2026-68201} - ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams {CVE-2026-53242} - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - mm/hugetlb: fix list corruption in allocate_file_region_entries() {CVE-2026-74518} - rcu: Fix rcu_read_unlock() deadloop due to softirq {CVE-2026-45957} - bpf: Fix potential UAF in bpf_netns_link_update_prog {CVE-2026-90393} - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue {CVE-2025-37861} - scsi: csiostor: Fix dereference of null pointer rn {CVE-2026-45857} - scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470} - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - veth: fix NAPI leak in XDP enable error path {CVE-2026-80613} - RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852} - RDMA/iwcm: Fix workqueue list corruption by removing work_list {CVE-2026-45898} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261} - svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - xprtrdma: Fix ep kref imbalance on ADDR_CHANGE {CVE-2026-72469} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - sctp: drop a chunk if its transport was removed {CVE-2026-89478} - sctp: prevent peer transport count overflow {CVE-2026-74469} - sctp: validate embedded address parameter length {CVE-2026-74287} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} - netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - netfilter: nf_tables: use list_del_rcu for netlink hooks {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038} - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - net: gro: don't merge zcopy skbs {CVE-2026-46323} - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL {CVE-2026-98383} - bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops {CVE-2026-53078} - libceph: validate banner payload length {CVE-2026-90067} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - smb/client: fix out-of-bounds read in smb2_compound_op() {CVE-2026-46155} - fanotify: fix false positive on permission events {CVE-2026-46150} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock {CVE-2026-89712} - nfsd: defer vfree of compound ops to fix rpc_status UAF {CVE-2026-89690} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - NFSD: Fix SECINFO_NO_NAME decode error cleanup {CVE-2026-53398} - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} - gfs2: Add metapath_dibh helper {CVE-2026-45984} - gfs2: Fix slab-use-after-free in qd_put {CVE-2026-45861} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} - nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() {CVE-2026-90228} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - net: wwan: iosm: bound device offsets in the MUX downlink decoder {CVE-2026-72029} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394} - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - RDMA/ucma: Lock the handler in ucma_set_ib_path() {CVE-2026-89508} - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} - drm/xe/dma-buf: handle empty bo and UAF races {CVE-2026-52951} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - zram: fix use-after-free in zram_bvec_write_partial() {CVE-2026-53185} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - accel/ivpu: Add buffer overflow check in MS get_info_ioctl {CVE-2026-53203} - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path {CVE-2026-63794} - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() {CVE-2023-53271} - net: ifb: report ethtool stats over num_tx_queues {CVE-2026-64121} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - Squashfs: check block offset is not negative {CVE-2026-90203} - bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402} - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} - tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405} - Bluetooth: MGMT: cancel mesh send timer when hdev removed {CVE-2025-40284}