* CVE-2026-53091 - xfrm: Don't clobber inner headers when already set {CVE-2026-53091} - net: account for encap headers in qdisc pkt len {CVE-2026-53091} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93280 - greybus: audio: bound the topology section sizes against the fetched size {CVE-2026-93280} * CVE-2026-93213 - of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213} * CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802} * CVE-2026-93206 - PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-93268 - ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268} * CVE-2026-93782 - vhost-scsi: flush backend after device ioctls {CVE-2026-93782} * CVE-2026-93783 - Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-93783} * CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} * CVE-2026-93807 - wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers {CVE-2026-93807} * CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808} * CVE-2026-89938 - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938} * CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89912 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912} * CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} * CVE-2026-89833 - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833} * CVE-2026-90045 - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015} * CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} * CVE-2026-89859 - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859} * CVE-2026-90036 - NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036} * CVE-2026-89987 - mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987} * CVE-2026-89799 - bpf: Disable preemption in bpf_get_stackid {CVE-2026-89799} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-89822 - drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822} * CVE-2026-89929 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929} * CVE-2026-89840 - f2fs: validate MOVE_RANGE destination size {CVE-2026-89840} * CVE-2026-89913 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-89972 - nvme: add missing SRCU grace period in error path {CVE-2026-89972} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} * CVE-2026-90037 - NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-90023 - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2026-89838 - f2fs: limit recovery filename logging to stored length {CVE-2026-89838} * CVE-2026-89848 - scsi: qla2xxx: Quiesce response IRQ before freeing request queue {CVE-2026-89848} * CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017} * CVE-2026-89897 - media: cec: Serialize exclusive follower delivery {CVE-2026-89897} * CVE-2026-89877 - media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2026-90016 - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016} * CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999} * CVE-2026-90044 - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044} * CVE-2026-90029 - usb: storage: realtek_cr: fix use-after-free on disconnect {CVE-2026-90029} * CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} * CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2026-90013 - tracing: Take trace_array reference when opening options file {CVE-2026-90013} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} * CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789} * CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} * CVE-2023-54047 - drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047} * CVE-2025-40146 - blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146} * CVE-2026-68367 - usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367} * CVE-2026-89659 - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} * CVE-2026-80841 - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} * CVE-2026-80925 - vlan: fix skb_under_panic and races when toggling HW VLAN offload {CVE-2026-80925} * CVE-2026-64557 - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() {CVE-2026-64557} * CVE-2026-72390 - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-74752 - sctp: validate cookie AUTH state before use {CVE-2026-74752} * CVE-2026-68404 - wifi: cfg80211: use wiphy work for socket owner autodisconnect {CVE-2026-68404} * CVE-2026-72413 - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} * CVE-2026-63921 - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921} * CVE-2026-23050 - pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2026-63933 - iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933} * CVE-2023-54287 - tty: serial: imx: disable Ageing Timer interrupt request irq {CVE-2023-54287} * CVE-2026-63891 - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() {CVE-2026-63891} * CVE-2024-50076 - vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076} * CVE-2021-47659 - drm/plane: Move range check for format_count earlier {CVE-2021-47659} * CVE-2026-63983 - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} * CVE-2025-68342 - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data {CVE-2025-68342} * CVE-2026-63922 - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} * CVE-2023-54007 - vmci_host: fix a race condition in vmci_host_poll() causing GPF {CVE-2023-54007} * CVE-2025-68173 - ftrace: Fix softlockup in ftrace_module_enable {CVE-2025-68173} * CVE-2022-50864 - nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864} * CVE-2026-63905 - usbip: vudc: Fix use after free bug in vudc_remove due to race condition {CVE-2026-63905} * CVE-2025-40100 - btrfs: do not assert we found block group item when creating free space tree {CVE-2025-40100} * CVE-2025-40333 - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333} * CVE-2025-40160 - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160} * CVE-2026-63888 - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} * CVE-2025-68778 - btrfs: don't log conflicting inode if it's a dir moved in the current transaction {CVE-2025-68778} * CVE-2023-53799 - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799} * CVE-2026-64009 - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} * CVE-2023-54226 - af_unix: Fix data races around sk->sk_shutdown. {CVE-2023-54226} * CVE-2022-50770 - ocfs2: fix memory leak in ocfs2_mount_volume() {CVE-2022-50770} * CVE-2022-4994 - KVM: x86: wean fast IN from emulator_pio_in {CVE-2022-4994} * CVE-2024-50135 - nvme-pci: fix race condition between reset and nvme_dev_disable() {CVE-2024-50135} * CVE-2026-64011 - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011} * CVE-2026-80786 - fbdev: Wrap user-invoked calls to fb_set_var() in helper {CVE-2026-80786} * CVE-2022-50774 - crypto: qat - fix DMA transfer direction {CVE-2022-50774} * CVE-2023-53834 - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match {CVE-2023-53834} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2022-50764 - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764} * CVE-2026-80794 - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers {CVE-2026-80794} * CVE-2026-80854 - usb: gadget: f_tcm: keep port count until LUN teardown completes {CVE-2026-80854} * CVE-2026-80576 - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} * CVE-2026-80843 - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2026-74510 - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} * CVE-2026-68108 - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} * CVE-2026-74283 - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} * CVE-2026-64470 - Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470} * CVE-2026-80783 - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783} * CVE-2026-72336 - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control {CVE-2026-72336} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-72398 - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-80807 - nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807} * CVE-2026-80890 - sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-64550 - net: qualcomm: rmnet: validate MAP frame length before ingress parsing {CVE-2026-64550} * CVE-2026-80828 - ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828} * CVE-2026-72047 - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit {CVE-2026-72047} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-80764 - Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764} * CVE-2026-74341 - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} * CVE-2026-63826 - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} * CVE-2026-80782 - HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782} * CVE-2026-80798 - nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798} * CVE-2026-74649 - staging: rtl8723bs: fix missing shared-key auth challenge length check {CVE-2026-74649} * CVE-2026-68398 - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} * CVE-2026-80907 - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907} * CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-72255 - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} * CVE-2026-72374 - afs: Fix callback service message parsers to pass through -EAGAIN {CVE-2026-72374} * CVE-2026-68190 - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190} * CVE-2026-74689 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} * CVE-2026-80599 - batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-68414 - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} * CVE-2026-72472 - nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472} * CVE-2026-80796 - nfc: nci: add data_len bound checks to activation parameter extractors {CVE-2026-80796} * CVE-2026-80864 - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp {CVE-2026-80864} * CVE-2026-80797 - nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797} * CVE-2026-72085 - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085} * CVE-2026-74436 - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-74744 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} * CVE-2026-74282 - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} * CVE-2026-80800 - nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-80863 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() {CVE-2026-80863} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-80785 - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785} * CVE-2026-80755 - selinux: reject a permission value exceeding the class permission count {CVE-2026-80755} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-74289 - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} * CVE-2026-80908 - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908} * CVE-2026-74359 - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} * CVE-2026-72322 - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} * CVE-2026-74350 - ocfs2: validate fast symlink target during inode read {CVE-2026-74350} * CVE-2026-80812 - ALSA: dummy: Check card index validity at probe {CVE-2026-80812} * CVE-2026-68142 - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} * CVE-2026-72383 - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} * CVE-2026-80824 - usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824} * CVE-2026-74387 - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} * CVE-2026-80847 - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847} * CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570} * CVE-2026-72476 - dmaengine: Fix possible use after free {CVE-2026-72476} * CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} * CVE-2026-89574 - dm array: validate array block headers on read {CVE-2026-89574} * CVE-2026-89545 - sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545} * CVE-2026-89462 - power: supply: max17040: propagate register read errors {CVE-2026-89462} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89484 - lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484} * CVE-2026-80996 - net: l2tp: do not propagate multicast notification errors {CVE-2026-80996} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89531 - svcrdma: Reject connection when transport allocation fails {CVE-2026-89531} * CVE-2026-89441 - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-89553 - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-89492 - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} * CVE-2026-80974 - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-64014 - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size {CVE-2026-64014} * CVE-2026-63916 - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} * CVE-2026-63892 - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892} * CVE-2026-64010 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010} * CVE-2026-63954 - hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954} * CVE-2026-63927 - usb: dwc2: Fix use after free in debug code {CVE-2026-63927} * CVE-2026-63893 - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() {CVE-2026-63893} * CVE-2026-63915 - nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915} * CVE-2026-63904 - usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904} * CVE-2026-63957 - USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957} * CVE-2025-68750 - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750} * CVE-2023-54150 - drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150} * CVE-2026-63908 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem {CVE-2026-63908} * CVE-2026-63934 - iio: gyro: itg3200: fix i2c read into the wrong stack location {CVE-2026-63934} * CVE-2026-80819 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819} * CVE-2026-72234 - batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234} * CVE-2026-68357 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-64483 - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} * CVE-2026-63814 - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814} * CVE-2026-64505 - usb: gadget: function: rndis: add length check for header {CVE-2026-64505} * CVE-2026-72233 - batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233} * CVE-2026-80801 - nfc: microread: validate target discovery payload lengths {CVE-2026-80801} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-80752 - Input: psxpad-spi - set driver data before use {CVE-2026-80752} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-89539 - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539} * CVE-2026-89761 - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} * CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-80918 - HID: core: fix number/pointer type confusion on long items {CVE-2026-80918} * CVE-2026-64372 - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372} * CVE-2026-64423 - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} * CVE-2026-64323 - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} * CVE-2026-64322 - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} * CVE-2026-64452 - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452} * CVE-2026-64351 - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} * CVE-2026-64343 - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} * CVE-2026-64318 - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318} * CVE-2026-46208 - batman-adv: correct the del_timer_sync() rationale in batadv_tp_stop_all() {CVE-2026-46208} * CVE-2023-53039 - HID: intel-ish-hid: ipc: set dev->devc before the first dev_err() {CVE-2023-53039} * Miscellaneous upstream changes - driver core: generalize driver_override in struct device * Bump ABI 4.15.0-266