* CVE-2025-68214 - timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214} * CVE-2024-58093 - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093} * CVE-2026-72463 - xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463} * CVE-2026-64600 - xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600} * CVE-2026-64095 - batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095} * CVE-2026-64274 - Input: goodix - clamp the device-reported contact count {CVE-2026-64274} * CVE-2026-64273 - Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64188 - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188} * CVE-2026-64096 - batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096} * CVE-2026-64093 - batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093} * CVE-2026-64091 - batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091} * CVE-2026-64298 - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} * CVE-2026-64276 - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} * CVE-2026-64271 - Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271} * CVE-2026-64266 - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} * CVE-2026-64218 - batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218} * CVE-2026-64191 - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} * CVE-2026-64115 - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} * CVE-2026-64114 - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} * CVE-2026-64113 - ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113} * CVE-2026-64103 - scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103} * CVE-2026-43249 - 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249} * CVE-2025-39686 - comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686} * CVE-2025-38068 - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} * CVE-2025-39901 - i40e: remove read access to debugfs files {CVE-2025-39901} * CVE-2023-54207 - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207} * CVE-2023-53446 - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446} * CVE-2022-50422 - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422} * CVE-2022-50066 - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066} * CVE-2025-71152 - net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152} * CVE-2026-53131 - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} * CVE-2026-31685 - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} * CVE-2026-31768 - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768} * CVE-2026-43458 - serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458} - serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458} * CVE-2023-53338 - lwt: Fix return values of BPF xmit ops {CVE-2023-53338} * CVE-2026-43076 - ocfs2: validate inline data i_size during inode read {CVE-2026-43076} * CVE-2026-31657 - batman-adv: hold claim backbone gateways by reference {CVE-2026-31657} * CVE-2023-53117 - fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117} * CVE-2022-50103 - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103} * CVE-2025-38464 - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464} * CVE-2026-43421 - usb: gadget: f_ncm: Fix net_device lifecycle with device_move {CVE-2026-43421} * CVE-2026-46174 - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174} * CVE-2026-43279 - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} * CVE-2026-52917 - sctp: diag: reject stale associations in dump_one path {CVE-2026-52917} * CVE-2023-52935 - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935} * CVE-2026-46275 - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths {CVE-2026-46275} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2024-36013 - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} * CVE-2026-46090 - ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090} * CVE-2026-53230 - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230} * CVE-2026-31663 - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} * CVE-2026-52942 - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} * CVE-2026-53223 - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} * CVE-2026-46056 - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} * CVE-2026-52943 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers {CVE-2026-52943} * CVE-2026-53270 - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} * CVE-2026-52924 - sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924} * CVE-2026-52956 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} * CVE-2026-46052 - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} * CVE-2026-46181 - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} * CVE-2026-43232 - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets {CVE-2026-43232} * CVE-2026-43339 - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339} * CVE-2026-53075 - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} * CVE-2026-52912 - netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912} * CVE-2026-52986 - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} * CVE-2026-53072 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} * CVE-2026-45942 - ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942} * CVE-2026-46175 - f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175} * CVE-2026-46208 - batman-adv: stop tp_meter sessions during mesh teardown {CVE-2026-46208} * CVE-2026-53024 - greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024} * CVE-2026-53025 - greybus: raw: fix use-after-free on cdev close {CVE-2026-53025} * CVE-2026-52934 - batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934} * CVE-2026-53256 - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} * CVE-2026-53186 - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} * CVE-2026-53253 - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} * CVE-2026-53254 - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} * CVE-2026-53130 - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START {CVE-2026-53130} * CVE-2026-52931 - batman-adv: tp_meter: avoid use of uninit sender vars {CVE-2026-52931} * CVE-2026-52919 - batman-adv: fix tp_meter counter underflow during shutdown {CVE-2026-52919} * CVE-2026-46006 - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} * CVE-2026-46212 - batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212} * CVE-2026-43493 - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} * CVE-2026-31402 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2025-39866 - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} * CVE-2026-23243 - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-53002 - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} * CVE-2026-46149 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} * CVE-2026-43110 - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} * CVE-2026-46133 - RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133} * CVE-2026-53016 - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} * CVE-2026-52957 - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} * CVE-2026-31580 - bcache: fix cached_dev.sb_bio use-after-free and crash {CVE-2026-31580} * CVE-2026-23099 - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} * CVE-2025-38024 - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024} * CVE-2023-53357 - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357} * CVE-2025-39759 - btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759} * CVE-2026-23204 - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} - net: add skb_header_pointer_careful() helper {CVE-2026-23204} * CVE-2022-50021 - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} * CVE-2026-43088 - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088} * CVE-2026-23448 - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} * CVE-2026-31396 - net: macb: fix use-after-free access to PTP clock {CVE-2026-31396} * CVE-2026-31683 - batman-adv: avoid OGM aggregation when skb tailroom is insufficient {CVE-2026-31683} * CVE-2026-31417 - net/x25: Fix overflow when accumulating packets {CVE-2026-31417} * CVE-2026-43050 - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} * CVE-2026-31759 - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759} * CVE-2026-31578 - media: as102: fix to not free memory after the device is registered in as102_usb_probe() {CVE-2026-31578} * CVE-2026-23098 - netrom: fix double-free in nr_route_frame() {CVE-2026-23098} * CVE-2026-31780 - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation {CVE-2026-31780} * CVE-2026-31597 - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597} * CVE-2026-53091 - net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091} * CVE-2026-53006 - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} * CVE-2026-46150 - fanotify: fix false positive on permission events {CVE-2026-46150} * CVE-2026-46116 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} * CVE-2026-52993 - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} * CVE-2026-31787 - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} * CVE-2026-23083 - fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083} * CVE-2025-38584 - padata: Fix pd UAF once and for all {CVE-2025-38584} * CVE-2023-53556 - iavf: Fix use-after-free in free_netdev {CVE-2023-53556} * CVE-2023-52796 - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796} * CVE-2026-43236 - drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release {CVE-2026-43236} * CVE-2026-53224 - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} * Miscellaneous upstream changes - dkms-build: prefer a pre-seeded DKMS package from debian/dkms-packages * Bump ABI 4.15.0-264