* CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * CVE-2026-64015 - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} * CVE-2023-53282 - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282} * CVE-2026-43250 - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250} * CVE-2026-43281 - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-68093 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} * CVE-2026-89637 - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} * CVE-2026-89633 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2025-68188 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} * CVE-2026-68329 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} * CVE-2026-72157 - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} * CVE-2026-64305 - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} * CVE-2026-64304 - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} * CVE-2026-64449 - staging: vme_user: bound slave read/write to the kern_buf size {CVE-2026-64449} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} * CVE-2026-90204 - ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204} * CVE-2026-90205 - ocfs2: validate orphan slot during inode read {CVE-2026-90205} * CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-93163 - hwrng: core - fix rng list on registration error {CVE-2026-93163} * CVE-2026-93104 - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} * CVE-2026-90116 - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice {CVE-2026-93049} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-52923 - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} * CVE-2026-64007 - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} * CVE-2026-98375 - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} * CVE-2026-98312 - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} * CVE-2026-98269 - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} * CVE-2026-98194 - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} * CVE-2026-98354 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} * CVE-2024-57849 - s390/cpum_sf: Handle CPU hotplug remove during sampling {CVE-2024-57849} * CVE-2026-98222 - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98348 - wifi: libipw: reject too-short association responses {CVE-2026-98348} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-64002 - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} * CVE-2026-98193 - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-98175 - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} * CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} * CVE-2026-93826 - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} * CVE-2026-93817 - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} * CVE-2026-97908 - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908} * CVE-2026-97600 - ieee802154: cc2520: fix FIFOP work use-after-free {CVE-2026-97600} * CVE-2026-97564 - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} * CVE-2026-97536 - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} * CVE-2026-97531 - scsi: qla2xxx: Skip vport under deletion in report ID acquisition {CVE-2026-97531} * CVE-2026-93820 - PCI: rockchip: Protect root bus removal with rescan lock {CVE-2026-93820} * CVE-2026-93822 - PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822} * CVE-2026-97447 - ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447} * CVE-2026-97954 - net/rds: fix tcp stream corruption with large pages {CVE-2026-97954} * CVE-2026-98160 - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() {CVE-2026-98160} * CVE-2026-97949 - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97509 - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} * CVE-2026-93791 - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} * CVE-2026-93799 - wifi: iwlwifi: mvm: validate sta_id in BA window status notif {CVE-2026-93799} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() {CVE-2026-97572} * CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink {CVE-2026-97601} * CVE-2026-97905 - cpufreq: zero-initialize policy cpumask before sysfs publication {CVE-2026-97905} * CVE-2026-97539 - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} * CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} * CVE-2026-68158 - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} * CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} * CVE-2022-50279 - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279} * Bump ABI 4.15.0-267