* CVE-2026-90267 - scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-90337 - serial: core: do fallible allocations before the console can be registered {CVE-2026-90337} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-90106 - net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106} * CVE-2026-90150 - pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150} * CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222} * CVE-2026-90235 - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235} * CVE-2026-92499 - ext4: validate readdir offset before accessing dirent {CVE-2026-92499} * CVE-2026-90259 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259} * CVE-2026-90418 - nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-90189 - null_blk: register configfs subsystem after creating default devices {CVE-2026-90189} * CVE-2026-90194 - ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194} * CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-90138 - vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053} * CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-53176 - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120} * CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143} * CVE-2026-90104 - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-90335 - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} * CVE-2026-90336 - serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336} * CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit {CVE-2026-90054} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-97582 - hwmon: (gpio-fan) Fix use-after-free in alarm work {CVE-2026-97582} * CVE-2026-93792 - wifi: iwlwifi: mvm: fix a possible underflow {CVE-2026-93792} * CVE-2026-97541 - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} * CVE-2026-93814 - spi: core: Abort active target transfer on controller suspend {CVE-2026-93814} * CVE-2023-54311 - ext4: fix deadlock when converting an inline directory in nojournal mode {CVE-2023-54311} * CVE-2026-80851 - gtp: serialize PDP context updates {CVE-2026-80851} * CVE-2026-89527 - svcrdma: Use svc_xprt_put to free listener on create failure {CVE-2026-89527} * CVE-2026-80875 - ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875} * Bump ABI 4.15.0-268