* CVE-2026-64375 - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375} * CVE-2026-53266 - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} * CVE-2025-39964 - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} * CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} * CVE-2026-53062 - dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062} * CVE-2026-64237 - Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237} - Input: elan_i2c - validate firmware size before use {CVE-2026-64237} * CVE-2026-64109 - af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} * CVE-2025-38512 - wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512} * CVE-2025-38117 - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117} * CVE-2026-22980 - nfsd: provide locking for v4_end_grace {CVE-2026-22980} * CVE-2023-53254 - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254} * CVE-2025-37885 - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2025-37879 - 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879} * CVE-2023-53039 - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039} * CVE-2019-12456 - scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456} * CVE-2024-46812 - drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812} * CVE-2026-31761 - iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761} * CVE-2026-53120 - PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120} * CVE-2026-31598 - ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598} * CVE-2026-43075 - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075} * CVE-2024-41013 - xfs: don't walk off the end of a directory data block {CVE-2024-41013} * CVE-2026-31527 - driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527} * CVE-2022-48744 - net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744} * CVE-2023-53510 - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} * CVE-2026-23268 - apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268} * CVE-2026-23269 - apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269} * CVE-2025-21812 - ax25: rcu protect dev->ax25_ptr {CVE-2025-21812} * CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} * CVE-2026-53228 - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} * CVE-2026-53355 - net: rds: clear i_sends on setup unwind {CVE-2026-53355} * CVE-2026-45970 - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} * CVE-2023-52922 - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922} * CVE-2026-52920 - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} * CVE-2026-46270 - power: supply: rt9455: Fix use-after-free in power_supply_changed() {CVE-2026-46270} * CVE-2026-46259 - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} * CVE-2026-43233 - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233} * CVE-2026-52998 - netfilter: xt_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} * CVE-2026-46099 - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels {CVE-2026-46099} * CVE-2026-52918 - Bluetooth: serialize accept_q access {CVE-2026-52918} * CVE-2026-43116 - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} * CVE-2026-23411 - apparmor: fix race between freeing data and fs accessing it {CVE-2026-23411} - apparmor: fix race on rawdata dereference {CVE-2026-23411} * CVE-2026-43117 - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() {CVE-2026-43117} * CVE-2026-53112 - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112} * CVE-2026-46043 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} * CVE-2026-46209 - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} * CVE-2026-43051 - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} * CVE-2026-43334 - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} * CVE-2026-43226 - net/rds: No shortcut out of RDS_CONN_ERROR {CVE-2026-43226} * CVE-2026-43038 - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038} * CVE-2026-43037 - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} * CVE-2026-31607 - usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607} * CVE-2026-23455 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} * CVE-2026-53040 - ocfs2: validate bg_bits during freefrag scan {CVE-2026-53040} * CVE-2026-43190 - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} * CVE-2026-53268 - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} * CVE-2026-23273 - macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273} * CVE-2026-43187 - xfs: delete attr leaf freemap entries when empty {CVE-2026-43187} * CVE-2026-43158 - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} * CVE-2026-31500 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} * CVE-2026-31788 - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788} * CVE-2025-71073 - Input: lkkbd - disable pending work before freeing device {CVE-2025-71073} * CVE-2026-43241 - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access {CVE-2026-43241} * CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475} * CVE-2026-80861 - usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89552 - params: fix charp corruption on allocation failure {CVE-2026-89552} * CVE-2026-80948 - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-89671 - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} * CVE-2026-89468 - power: supply: lp8788-charger: fix use-after-free on remove {CVE-2026-89468} * CVE-2026-64378 - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} * CVE-2026-89666 - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} * CVE-2026-89610 - ntfs: verify run length exceeding volume boundary {CVE-2026-89610} * CVE-2026-80928 - smack: fix cred UAF in smack_file_send_sigiotask() {CVE-2026-80928} * CVE-2026-64424 - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} * CVE-2026-64422 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} * CVE-2026-64363 - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} * CVE-2026-64446 - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() {CVE-2026-64446} * CVE-2026-64445 - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() {CVE-2026-64445} * CVE-2026-64440 - staging: rtl8723bs: fix OOB write in HT_caps_handler() {CVE-2026-64440} * CVE-2026-64348 - usb: free iso schedules on failed submit {CVE-2026-64348} * CVE-2026-64344 - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} * CVE-2026-64341 - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} * CVE-2026-64340 - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} * CVE-2025-68324 - scsi: imm: Fix use-after-free bug caused by unfinished delayed work {CVE-2025-68324} * CVE-2026-63991 - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() {CVE-2026-63991} * CVE-2025-40137 - f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-80619 - apparmor: fix potential UAF in aa_replace_profiles {CVE-2026-80619} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-80754 - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo {CVE-2026-80754} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-72226 - batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226} * CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} * CVE-2026-74255 - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} * CVE-2026-64504 - iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504} * CVE-2026-68214 - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} * CVE-2026-80909 - drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909} * CVE-2026-80840 - ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840} * CVE-2026-80781 - HID: core: fix OOB read of field->usage in hid_set_field() {CVE-2026-80781} * CVE-2026-80765 - HID: hyperv: validate initial device info bounds {CVE-2026-80765} * CVE-2026-80826 - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() {CVE-2026-80826} * CVE-2026-72351 - gue: validate REMCSUM private option length {CVE-2026-72351} * CVE-2026-72171 - mtd: slram: remove failed entries from the device list {CVE-2026-72171} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-80601 - batman-adv: gw: acquire ethernet header only after skb realloc {CVE-2026-80601} * CVE-2026-80802 - nfc: fdp: bound the device-reported read length and fix an skb leak {CVE-2026-80802} * CVE-2026-80829 - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-80790 - nvmet-fc: fix invalid free in LS IOD error path {CVE-2026-80790} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-64546 - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} * CVE-2026-80803 - nfc: digital: clamp SENSF_RES length to the destination buffer {CVE-2026-80803} * CVE-2026-72083 - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-80844 - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} * CVE-2026-72406 - net: sungem: fix probe error cleanup {CVE-2026-72406} * CVE-2026-80767 - HID: sensor: custom: Fix use-after-free in enable_sensor {CVE-2026-80767} * CVE-2026-80793 - ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80823 - nfc: st21nfca: validate ATR_REQ length against the received frame {CVE-2026-80823} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-72014 - drbd: reject data replies with an out-of-range payload size {CVE-2026-72014} * CVE-2026-64471 - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} * CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} * CVE-2026-74725 - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} * CVE-2026-74408 - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * CVE-2026-80622 - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-80830 - usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-80814 - rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-80795 - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() {CVE-2026-80795} * CVE-2026-80827 - USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-43421 - usb: gadget: u_ether: guard the gadget pointer in eth_get_drvinfo() {CVE-2026-43421} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2026-31786 - xen: fix buffer overflow in buildid_show (XSA-485) {CVE-2026-31786} * CVE-2026-53329 - drm/amd/display: Use array_size() in dal_vector_reserve() {CVE-2026-53329} * CVE-2026-63887 - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74287 - sctp: validate embedded address parameter length {CVE-2026-74287} * Miscellaneous upstream changes - xfs: fix transaction leak in xfs_reflink_allocate_cow() - xfs: cow unwritten conversion uses uninitialized dfops * Bump ABI 4.15.0-265