* CVE-2024-36894 - usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894} * CVE-2026-97447 - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447} * CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} * CVE-2026-93826 - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} * CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954} * CVE-2026-97949 - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97539 - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} * CVE-2026-74510 - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} * CVE-2026-90320 - ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320} * CVE-2026-90321 - ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321} * CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-74752 - sctp: validate cookie AUTH state before use {CVE-2026-74752} * CVE-2026-74387 - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} * CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} * CVE-2026-89659 - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} * CVE-2026-80576 - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-72398 - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-72322 - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} * CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095} * CVE-2026-72472 - nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472} * CVE-2026-90045 - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045} * CVE-2026-90421 - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-68329 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} * CVE-2026-89448 - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} * CVE-2026-64001 - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001} * CVE-2026-64305 - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} * CVE-2026-64348 - usb: free iso schedules on failed submit {CVE-2026-64348} * CVE-2026-64422 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} * CVE-2026-90180 - block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180} * CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-89574 - dm array: validate array block headers on read {CVE-2026-89574} * CVE-2026-90433 - spi: oc-tiny: switch to managed controller allocation {CVE-2026-90433} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-74350 - ocfs2: validate fast symlink target during inode read {CVE-2026-74350} * CVE-2026-89637 - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} * CVE-2026-89633 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} * CVE-2026-89610 - ntfs: verify run length exceeding volume boundary {CVE-2026-89610} * CVE-2026-72171 - mtd: slram: remove failed entries from the device list {CVE-2026-72171} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} * CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475} * CVE-2026-68108 - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} * CVE-2026-89671 - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} * CVE-2026-64009 - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} * CVE-2026-93117 - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-74689 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} * CVE-2026-89545 - sunrpc: defer rq_argp and rq_resp free until after RCU grace period {CVE-2026-89545} * CVE-2026-74283 - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-64471 - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-89553 - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-63826 - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-68093 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-64546 - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} * CVE-2026-63888 - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} * CVE-2026-72413 - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-90044 - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74744 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-72383 - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-74359 - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} * CVE-2026-68414 - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-64449 - staging: vme_user: bound slave read/write to the kern_buf size {CVE-2026-64449} * CVE-2026-90013 - tracing: Take trace_array reference when opening options file {CVE-2026-90013} * CVE-2026-90204 - ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204} * CVE-2026-90205 - ocfs2: validate orphan slot during inode read {CVE-2026-90205} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-90037 - NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037} * CVE-2026-63922 - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} * CVE-2026-64011 - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011} * CVE-2026-72234 - batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-80928 - smack: fix cred UAF in smack_file_send_sigiotask() {CVE-2026-80928} * CVE-2026-64424 - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} * CVE-2026-64363 - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} * CVE-2026-64343 - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} * CVE-2026-64341 - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} * CVE-2026-64340 - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} * CVE-2026-64344 - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2025-68324 - scsi: imm: Fix use-after-free bug caused by unfinished delayed work {CVE-2025-68324} * CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-64483 - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} * CVE-2026-63814 - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814} * CVE-2026-64505 - usb: gadget: function: rndis: add length check for header {CVE-2026-64505} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-68140 - net/iucv: fix use-after-free of a severed iucv_path {CVE-2026-68140} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-72226 - batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226} * CVE-2026-74255 - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} * CVE-2026-64504 - iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504} * CVE-2026-72351 - gue: validate REMCSUM private option length {CVE-2026-72351} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-80601 - batman-adv: gw: acquire ethernet header only after skb realloc {CVE-2026-80601} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-68397 - net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397} * CVE-2026-72406 - net: sungem: fix probe error cleanup {CVE-2026-72406} * CVE-2026-72014 - drbd: reject data replies with an out-of-range payload size {CVE-2026-72014} * CVE-2026-68141 - net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() {CVE-2026-68141} * CVE-2026-74408 - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} * CVE-2026-80622 - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-68474 - powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access() {CVE-2026-68474} * CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation {CVE-2026-89723} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-81003 - net/iucv: filter frames in afiucv_hs_rcv() by ingress device {CVE-2026-81003} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-64372 - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372} * CVE-2026-64423 - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} * CVE-2026-64322 - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} * CVE-2022-50401 - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure {CVE-2022-50401} * CVE-2026-64452 - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452} * CVE-2026-64351 - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} * CVE-2026-64342 - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342} * CVE-2026-64318 - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318} * CVE-2026-64109 - af_unix: read the receive queue tail length under the queue lock in unix_stream_data_wait() {CVE-2026-64109} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2026-23455 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} * CVE-2026-64115 - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} * CVE-2026-64114 - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} * CVE-2026-64096 - batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096} * CVE-2026-64237 - Input: elan_i2c - validate firmware size before use {CVE-2026-64237} * CVE-2026-64113 - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} * CVE-2026-64103 - scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103} * CVE-2026-64298 - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} * CVE-2026-64266 - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} * CVE-2026-64271 - Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64274 - Input: goodix - clamp the device-reported contact count {CVE-2026-64274} * CVE-2026-64273 - Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273} * CVE-2026-52942 - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} * CVE-2026-46056 - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} * CVE-2026-53270 - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} * CVE-2025-71073 - Input: lkkbd - disable pending work before freeing device {CVE-2025-71073} * CVE-2019-19377 - btrfs: Don't submit any btree write bio if the fs has errors {CVE-2019-19377} * Bump ABI 4.4.0-288