* CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * CVE-2025-39945 - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} * CVE-2022-50315 - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315} * CVE-2025-38459 - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459} * CVE-2025-38323 - net: atm: add lec_mutex {CVE-2025-38323} * CVE-2026-97540 - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} * CVE-2026-97564 - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} * CVE-2023-54213 - USB: sisusbvga: Add endpoint checks {CVE-2023-54213} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-80782 - HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782} * CVE-2026-90056 - net: fec: only stop PTP if it was initialized {CVE-2026-90056} * CVE-2026-80812 - ALSA: dummy: Check card index validity at probe {CVE-2026-80812} * CVE-2022-50776 - clk: st: Fix memory leak in st_of_quadfs_setup() {CVE-2022-50776} * CVE-2026-80798 - nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798} * CVE-2026-93061 - gpu: host1x: Avoid stack over-read in debug output helpers {CVE-2026-93061} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-90345 - wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345} * CVE-2026-80794 - nfc: nci: fix uninit-value in the RF discover/activated NTF handlers {CVE-2026-80794} * CVE-2026-80793 - ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793} * CVE-2026-89822 - drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822} * CVE-2026-63933 - iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-90104 - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} * CVE-2026-90335 - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} * CVE-2026-90336 - serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2024-50076 - vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076} * CVE-2022-50641 - HSI: omap_ssi: Fix refcount leak in ssi_probe {CVE-2022-50641} * CVE-2026-80797 - nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once {CVE-2026-90295} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-89925 - KVM: s390: Fix memory leak in guest debug handling {CVE-2026-89925} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2023-54115 - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() {CVE-2023-54115} * CVE-2022-50664 - media: dvb-frontends: fix leak of memory fw {CVE-2022-50664} * CVE-2026-63991 - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() {CVE-2026-63991} * CVE-2022-50708 - HSI: ssi_protocol: fix potential resource leak in ssip_pn_open() {CVE-2022-50708} * CVE-2026-64014 - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size {CVE-2026-64014} * CVE-2022-50749 - acct: fix potential integer overflow in encode_comp_t() {CVE-2022-50749} * CVE-2026-64010 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010} * CVE-2023-54111 - pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups {CVE-2023-54111} * CVE-2026-63927 - usb: dwc2: Fix use after free in debug code {CVE-2026-63927} * CVE-2023-53724 - mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() {CVE-2023-53724} * CVE-2022-49077 - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) {CVE-2022-49077} * CVE-2022-50850 - scsi: ipr: Fix WARNING in ipr_init() {CVE-2022-50850} * CVE-2022-49166 - ntfs: add sanity check on allocation size {CVE-2022-49166} * CVE-2022-50872 - ARM: OMAP2+: Fix memory leak in realtime_counter_init() {CVE-2022-50872} * CVE-2022-50887 - regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() {CVE-2022-50887} * CVE-2026-63908 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem {CVE-2026-63908} * CVE-2026-63934 - iio: gyro: itg3200: fix i2c read into the wrong stack location {CVE-2026-63934} * CVE-2023-54110 - usb: rndis_host: Secure rndis_query check against int overflow {CVE-2023-54110} * CVE-2023-54044 - spmi: Add a check for remove callback when removing a SPMI driver {CVE-2023-54044} * CVE-2022-49100 - virtio_console: eliminate anonymous module_init & module_exit {CVE-2022-49100} * CVE-2026-80909 - drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909} * CVE-2026-80781 - HID: core: fix OOB read of field->usage in hid_set_field() {CVE-2026-80781} * CVE-2026-80829 - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829} * CVE-2026-80803 - nfc: digital: clamp SENSF_RES length to the destination buffer {CVE-2026-80803} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80823 - nfc: st21nfca: validate ATR_REQ length against the received frame {CVE-2026-80823} * CVE-2026-74725 - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} * CVE-2026-80795 - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() {CVE-2026-80795} * CVE-2026-80918 - HID: core: fix number/pointer type confusion on long items {CVE-2026-80918} * CVE-2026-64191 - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} * Bump ABI 4.4.0-289