* CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706} * CVE-2026-98836 - ALSA: line6: reject oversized playback packets {CVE-2026-98836} * CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} * CVE-2026-98614 - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} * CVE-2026-98610 - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610} * CVE-2026-98524 - rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524} * CVE-2026-98547 - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547} * CVE-2026-98850 - net/packet: prevent TX_RING byte count overflow {CVE-2026-98850} * CVE-2026-98577 - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577} * CVE-2026-98482 - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482} * CVE-2026-98576 - nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576} * CVE-2026-98624 - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624} * CVE-2026-98794 - ipvs: filter some flags received in the backup server {CVE-2026-98794} * CVE-2026-98698 - wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698} * CVE-2026-98526 - llc: reserve device headroom for allocated frames {CVE-2026-98526} * CVE-2026-98532 - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} * CVE-2026-98569 - ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569} * CVE-2026-98541 - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541} * CVE-2026-98573 - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573} * CVE-2026-98567 - net: xps: reject an out of range traffic class {CVE-2026-98567} * CVE-2026-98457 - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} * CVE-2026-98460 - Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460} * CVE-2026-98636 - squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636} * CVE-2026-98772 - USB: serial: fix port tear down use-after-free {CVE-2026-98772} * CVE-2026-98697 - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} * CVE-2026-98769 - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769} * CVE-2026-98764 - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764} * CVE-2026-98838 - vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838} * CVE-2026-98578 - nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578} * CVE-2026-98583 - nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583} * CVE-2026-98612 - net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612} * CVE-2026-98722 - mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722} * CVE-2026-98657 - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657} * CVE-2026-98623 - drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623} * CVE-2026-98732 - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732} * CVE-2026-98393 - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393} * CVE-2026-53255 - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} * CVE-2026-53397 - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} * CVE-2026-53129 - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} * CVE-2025-40349 - hfs: validate record offset in hfsplus_bmap_alloc {CVE-2025-40349} * CVE-2026-52962 - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} * CVE-2026-98401 - net: iptunnel: fix stale transport header during tunnel decapsulation {CVE-2026-98401} * CVE-2023-54067 - btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067} * CVE-2026-53149 - thunderbolt: Bound root directory content to block size {CVE-2026-53149} * CVE-2026-46163 - wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163} * CVE-2026-46122 - wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122} * CVE-2026-43015 - net: macb: fix clk handling on PCI glue driver removal {CVE-2026-43015} * CVE-2025-68797 - char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797} * CVE-2025-68366 - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} * CVE-2026-46064 - ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064} * CVE-2026-90041 - HID: sony: clean up device list on probe failure {CVE-2026-90041} * CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link {CVE-2026-89872} * CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak {CVE-2026-89881} * CVE-2024-56592 - bpf: Call free_htab_elem() after htab_unlock_bucket() {CVE-2024-56592} * CVE-2023-54183 - media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() {CVE-2023-54183} * Bump ABI 4.15.0-270