* CVE-2026-64375 - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375} * CVE-2026-53266 - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} * CVE-2025-39964 - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} * CVE-2025-38068 - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} * CVE-2024-56570 - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} * CVE-2025-21753 - btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753} * CVE-2026-46116 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} * CVE-2022-49811 - drbd: use after free in drbd_create_device() {CVE-2022-49811} * CVE-2022-49059 - nfc: nci: add flush_workqueue to prevent uaf {CVE-2022-49059} * CVE-2025-22004 - net: atm: fix use after free in lec_send() {CVE-2025-22004} * CVE-2025-21764 - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764} * CVE-2025-21762 - arp: use RCU protection in arp_xmit() {CVE-2025-21762} * CVE-2026-52934 - batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934} * CVE-2026-46090 - ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090} * CVE-2026-53131 - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} * CVE-2026-53091 - net: pull headers in qdisc_pkt_len_init() {CVE-2026-53091} * CVE-2026-52986 - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} * CVE-2025-71116 - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} * CVE-2026-43493 - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} * CVE-2026-31597 - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597} * CVE-2026-43116 - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} * CVE-2026-43458 - serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458} * CVE-2026-53002 - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} * CVE-2026-46212 - batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212} * CVE-2026-31787 - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} * CVE-2023-53357 - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357} * CVE-2026-43075 - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075} * CVE-2026-43076 - ocfs2: validate inline data i_size during inode read {CVE-2026-43076} * CVE-2025-38464 - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464} * CVE-2026-23269 - apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269} * CVE-2026-43279 - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} * CVE-2024-36013 - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} * CVE-2026-53228 - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} * CVE-2026-45970 - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} * CVE-2026-52920 - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} * CVE-2026-46270 - power: supply: rt9455: Fix use-after-free in power_supply_changed() {CVE-2026-46270} * CVE-2026-46259 - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} * CVE-2026-52998 - netfilter: xt_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} * CVE-2026-45942 - ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942} * CVE-2026-53186 - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} * CVE-2026-53253 - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} * CVE-2026-53254 - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} * CVE-2026-53112 - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112} * CVE-2026-53130 - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START {CVE-2026-53130} * CVE-2026-46006 - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} * CVE-2026-43334 - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2026-31607 - usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607} * CVE-2026-23243 - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-46149 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} * CVE-2026-53043 - ocfs2/dlm: validate qr_numregions in dlm_match_regions() {CVE-2026-53043} * CVE-2026-53016 - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} * CVE-2026-53006 - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} * CVE-2026-43190 - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} * CVE-2026-53268 - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} * CVE-2026-31580 - bcache: fix cached_dev.sb_bio use-after-free and crash {CVE-2026-31580} * CVE-2025-39691 - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691} * CVE-2026-31685 - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} * CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} * CVE-2026-31683 - batman-adv: avoid OGM aggregation when skb tailroom is insufficient {CVE-2026-31683} * CVE-2022-50021 - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} * CVE-2026-23448 - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} * CVE-2026-43050 - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} * CVE-2026-43037 - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} * CVE-2026-53224 - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} * Miscellaneous upstream changes - timers: restore uninitialised-timer detection on the arming paths - timers: Fix NULL function pointer race in timer_shutdown_sync() - timers: honour the shutdown sentinel instead of BUG()ing on rearm * Bump ABI 4.4.0-287