* CVE-2022-49416 - wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416} * CVE-2022-49685 - iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685} * CVE-2021-47670 - can: peak_usb: fix use after free bugs {CVE-2021-47670} * CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706} * CVE-2026-98610 - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610} * CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} * CVE-2026-98614 - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} * CVE-2026-98547 - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547} * CVE-2026-98579 - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579} * CVE-2026-98581 - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581} * CVE-2026-98577 - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577} * CVE-2026-98482 - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482} * CVE-2026-98576 - nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576} * CVE-2026-98624 - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624} - netlink: use blocking notifier {CVE-2026-98624} * CVE-2026-98794 - ipvs: filter some flags received in the backup server {CVE-2026-98794} * CVE-2026-98829 - wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829} * CVE-2026-98708 - wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708} * CVE-2026-98707 - wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707} * CVE-2026-98532 - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} * CVE-2026-98541 - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541} * CVE-2026-98461 - Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461} * CVE-2026-98621 - net: gue: reject invalid REMCSUM offsets {CVE-2026-98621} * CVE-2026-98526 - llc: reserve device headroom for allocated frames {CVE-2026-98526} * CVE-2026-98555 - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555} * CVE-2026-98573 - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573} * CVE-2026-98739 - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} * CVE-2026-98457 - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} * CVE-2026-98460 - Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460} * CVE-2026-98856 - kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856} * CVE-2026-98636 - squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636} * CVE-2026-98681 - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681} * CVE-2026-98771 - usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771} * CVE-2026-98772 - USB: serial: fix port tear down use-after-free {CVE-2026-98772} * CVE-2026-98696 - USB: serial: fix driver deregistration order {CVE-2026-98696} * CVE-2026-98697 - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} * CVE-2026-98769 - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769} * CVE-2026-98764 - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764} * CVE-2026-98763 - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763} * CVE-2026-98753 - tty: tty_port: restore TTY_IO_ERROR on activation failure {CVE-2026-98753} * CVE-2026-98582 - nfc: st21nfca: validate received frame size {CVE-2026-98582} * CVE-2026-98578 - nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578} * CVE-2026-98481 - nfc: port100: reject frames whose declared length exceeds the received data {CVE-2026-98481} * CVE-2026-98583 - nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583} * CVE-2026-98710 - wifi: iwlegacy: 3945: free EEPROM data on remove {CVE-2026-98710} * CVE-2026-98612 - net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612} * CVE-2026-98594 - tg3: clean up PHYLIB resources on probe failure {CVE-2026-98594} * CVE-2026-98494 - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494} * CVE-2026-98488 - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488} * CVE-2026-98489 - net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489} * CVE-2026-98722 - mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722} * CVE-2026-98662 - iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662} * CVE-2026-98608 - drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() {CVE-2026-98608} * CVE-2026-98609 - drm/virtio: fix object leak when drm_gem_handle_create() fails {CVE-2026-98609} * CVE-2026-98623 - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623} * CVE-2026-98511 - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() {CVE-2026-98511} * CVE-2026-98732 - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732} * CVE-2026-98819 - Bluetooth: btintel: validate DDC record lengths {CVE-2026-98819} * CVE-2026-63806 - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() {CVE-2026-63806} * CVE-2026-53004 - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} * CVE-2026-53157 - net: phonet: free phonet_device after RCU grace period {CVE-2026-53157} * CVE-2026-46267 - nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267} * CVE-2026-98425 - wifi: mac80211: don't warn when an IBSS has no channel to scan {CVE-2026-98425} * CVE-2026-98406 - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver {CVE-2026-98406} * CVE-2023-53821 - ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821} * CVE-2023-53705 - ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705} * CVE-2026-98393 - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393} * CVE-2025-68283 - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} * CVE-2026-43407 - libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407} * CVE-2025-68799 - caif: fix integer underflow in cffrml_receive() {CVE-2025-68799} * CVE-2025-40271 - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271} * CVE-2025-68767 - hfsplus: Verify inode mode when loading from disk {CVE-2025-68767} * CVE-2025-40351 - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() {CVE-2025-40351} * CVE-2023-53804 - nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() {CVE-2023-53804} * CVE-2023-54127 - fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() {CVE-2023-54127} * CVE-2022-50747 - hfs: Fix OOB Write in hfs_asc2mac {CVE-2022-50747} * CVE-2023-53862 - hfs: fix missing hfs_bnode_get() in __hfs_bnode_create {CVE-2023-53862} * CVE-2026-63796 - ocfs2: reject oversized group bitmap descriptors {CVE-2026-63796} * CVE-2025-68771 - ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771} * CVE-2025-40055 - ocfs2: fix double free in user_cluster_connect() {CVE-2025-40055} * CVE-2023-54187 - f2fs: fix potential corruption when moving a directory {CVE-2023-54187} * CVE-2026-45920 - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} * CVE-2026-46191 - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} * CVE-2026-53195 - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} * CVE-2022-50732 - staging: rtl8192u: Fix use after free in ieee80211_rx() {CVE-2022-50732} * CVE-2023-54284 - media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284} * CVE-2026-98386 - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386} * CVE-2022-50656 - nfc: pn533: Clear nfc_target before being used {CVE-2022-50656} * CVE-2026-46069 - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} * CVE-2023-54286 - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace {CVE-2023-54286} * CVE-2026-46163 - wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163} * CVE-2026-46122 - wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122} * CVE-2025-68724 - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724} * CVE-2025-40106 - comedi: fix divide-by-zero in comedi_buf_munge() {CVE-2025-40106} * CVE-2026-46022 - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() {CVE-2026-46022} * CVE-2026-46064 - ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064} * CVE-2026-45994 - ibmasm: fix OOB reads in command_file_write due to missing size checks {CVE-2026-45994} * CVE-2023-53800 - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800} * CVE-2026-46294 - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} * CVE-2023-52515 - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} * CVE-2025-68330 - iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330} * CVE-2025-68797 - char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797} * CVE-2026-90116 - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} * CVE-2026-80599 - batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599} * CVE-2026-74341 - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} * CVE-2026-72083 - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083} * CVE-2023-53839 - dccp: fix data-race around dp->dccps_mss_cache {CVE-2023-53839} * CVE-2026-80890 - sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890} * CVE-2026-68365 - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} * CVE-2019-12456 - scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456} * CVE-2025-39863 - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863} * CVE-2025-38483 - comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483} * CVE-2026-64015 - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} * CVE-2026-43250 - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250} * CVE-2026-43281 - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281} * CVE-2026-23060 - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060} * CVE-2025-39817 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} * CVE-2025-38180 - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180} * CVE-2026-23235 - f2fs: fix out-of-bounds access in sysfs attribute read/write {CVE-2026-23235} * CVE-2026-52923 - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} * CVE-2025-39797 - xfrm: Duplicate SPI Handling {CVE-2025-39797} * CVE-2025-38401 - mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401} * CVE-2022-49834 - nilfs2: fix use-after-free bug of ns_writer on remount {CVE-2022-49834} * CVE-2025-38230 - jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230} * CVE-2026-98312 - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} * CVE-2026-98269 - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} * CVE-2025-38685 - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} * CVE-2026-98222 - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287} * CVE-2026-93781 - scsi: core: Do not block on tag allocation in scsi_eh_lock_door() {CVE-2026-93781} * CVE-2026-93231 - lockd: fix swapped arguments in nlmsvc_match_ip() {CVE-2026-93231} * CVE-2026-80841 - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} * CVE-2026-97938 - reboot: fix cad_pid use-after-free race {CVE-2026-97938} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93206 - PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-90207 - ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207} * CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056} * CVE-2026-80907 - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907} * CVE-2026-89492 - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} * CVE-2022-50864 - nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864} * CVE-2026-89838 - f2fs: limit recovery filename logging to stored length {CVE-2026-89838} * CVE-2026-89666 - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} * CVE-2024-50289 - media: av7110: fix a spectre vulnerability {CVE-2024-50289} * CVE-2023-53728 - posix-timers: Ensure timer ID search-loop limit is valid {CVE-2023-53728} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2025-68343 - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header {CVE-2025-68343} * CVE-2026-80783 - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} * CVE-2022-50764 - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764} * CVE-2026-90235 - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235} * CVE-2026-90105 - vxlan: fix reading neigh ha {CVE-2026-90105} * CVE-2026-92499 - ext4: validate readdir offset before accessing dirent {CVE-2026-92499} * CVE-2023-54226 - af_unix: Fix data races around sk->sk_shutdown. {CVE-2023-54226} * CVE-2026-80807 - nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807} * CVE-2025-40160 - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160} * CVE-2026-90234 - NFS: Return a delegation the client fails to record {CVE-2026-90234} * CVE-2023-53799 - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799} * CVE-2026-80947 - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} * CVE-2022-50868 - hwrng: amd - Fix PCI device refcount leak {CVE-2022-50868} * CVE-2026-90418 - nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-80847 - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847} * CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314} * CVE-2026-80996 - net: l2tp: do not propagate multicast notification errors {CVE-2026-80996} * CVE-2026-89531 - svcrdma: Reject connection when transport allocation fails {CVE-2026-89531} * CVE-2026-63916 - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} * CVE-2026-80828 - ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828} * CVE-2026-89552 - params: fix charp corruption on allocation failure {CVE-2026-89552} * CVE-2023-53796 - f2fs: fix information leak in f2fs_move_inline_dirents() {CVE-2023-53796} * CVE-2026-80854 - usb: gadget: f_tcm: keep port count until LUN teardown completes {CVE-2026-80854} * CVE-2023-54180 - btrfs: handle case when repair happens with dev-replace {CVE-2023-54180} * CVE-2026-80861 - usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861} * CVE-2026-90138 - vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-80800 - nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800} * CVE-2022-50660 - wifi: ipw2200: fix memory leak in ipw_wdev_init() {CVE-2022-50660} * CVE-2022-50857 - rapidio: rio: fix possible name leak in rio_register_mport() {CVE-2022-50857} * CVE-2023-53808 - wifi: mwifiex: fix memory leak in mwifiex_histogram_read() {CVE-2023-53808} * CVE-2022-50821 - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails {CVE-2022-50821} * CVE-2026-80875 - ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875} * CVE-2026-90109 - net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue {CVE-2026-90109} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89877 - media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877} * CVE-2023-54007 - vmci_host: fix a race condition in vmci_host_poll() causing GPF {CVE-2023-54007} * CVE-2023-53853 - netlink: annotate accesses to nlk->cb_running {CVE-2023-53853} * CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053} * CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075} * CVE-2026-90076 - net/sched: fq: add overflow bounds to quantum and initial quantum {CVE-2026-90076} * CVE-2025-40333 - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2025-68750 - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750} * CVE-2023-53802 - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function {CVE-2023-53802} * CVE-2026-80908 - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908} * CVE-2026-89441 - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} * CVE-2026-80948 - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2023-54134 - autofs: fix memory leak of waitqueues in autofs_catatonic_mode {CVE-2023-54134} * CVE-2023-54311 - ext4: fix deadlock when converting an inline directory in nojournal mode {CVE-2023-54311} * CVE-2026-80755 - selinux: reject a permission value exceeding the class permission count {CVE-2026-80755} * CVE-2026-89484 - lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484} * CVE-2026-80843 - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843} * CVE-2026-80764 - Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764} * CVE-2026-80974 - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974} * CVE-2026-89468 - power: supply: lp8788-charger: fix use-after-free on remove {CVE-2026-89468} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-64448 - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-89861 - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-90112 - net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2023-53788 - ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() {CVE-2023-53788} * CVE-2023-54045 - audit: fix possible soft lockup in __audit_inode_child() {CVE-2023-54045} * CVE-2025-40137 - f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137} * CVE-2022-50840 - scsi: snic: Fix possible UAF in snic_tgt_create() {CVE-2022-50840} * CVE-2022-50566 - mtd: Fix device name leak when register device failed in add_mtd_device() {CVE-2022-50566} * CVE-2022-50716 - wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out {CVE-2022-50716} * CVE-2026-63954 - hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954} * CVE-2026-63915 - nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915} * CVE-2023-54087 - ubi: Fix possible null-ptr-deref in ubi_free_volume() {CVE-2023-54087} * CVE-2022-50849 - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP {CVE-2022-50849} * CVE-2022-50834 - nfc: Fix potential resource leaks {CVE-2022-50834} * CVE-2023-53845 - nilfs2: fix infinite loop in nilfs_mdt_get_block() {CVE-2023-53845} * CVE-2026-63957 - USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957} * CVE-2023-53831 - net: read sk->sk_family once in sk_mc_loop() {CVE-2023-53831} * CVE-2022-50876 - usb: musb: Fix musb_gadget.c rxstate overflow bug {CVE-2022-50876} * CVE-2023-54032 - btrfs: fix race when deleting quota root from the dirty cow roots list {CVE-2023-54032} * CVE-2023-54314 - media: af9005: Fix null-ptr-deref in af9005_i2c_xfer {CVE-2023-54314} * CVE-2023-54282 - media: tuners: qt1010: replace BUG_ON with a regular error {CVE-2023-54282} * CVE-2023-54264 - fs/sysv: Null check to prevent null-ptr-deref bug {CVE-2023-54264} * CVE-2026-80819 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819} * CVE-2026-80801 - nfc: microread: validate target discovery payload lengths {CVE-2026-80801} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-80765 - HID: hyperv: validate initial device info bounds {CVE-2026-80765} * CVE-2026-80826 - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() {CVE-2026-80826} * CVE-2026-80802 - nfc: fdp: bound the device-reported read length and fix an skb leak {CVE-2026-80802} * CVE-2026-80844 - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} * CVE-2026-80767 - HID: sensor: custom: Fix use-after-free in enable_sensor {CVE-2026-80767} * CVE-2026-80830 - usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830} * CVE-2026-80876 - ring-buffer: Fix event length with forced 8-byte alignment {CVE-2026-80876} * CVE-2026-80814 - rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814} * CVE-2026-80827 - USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-64095 - batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095} * CVE-2023-52922 - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922} * CVE-2026-23076 - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} * Bump ABI 4.4.0-291