* CVE-2026-72463 - xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463} * CVE-2026-64600 - xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600} * CVE-2026-46175 - f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175} * CVE-2025-68254 - staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254} * CVE-2025-68255 - staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255} * CVE-2026-64268 - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268} * CVE-2025-68286 - drm/amd/display: Check NULL before accessing {CVE-2025-68286} * CVE-2026-53024 - greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024} * CVE-2026-53025 - greybus: raw: fix use-after-free on cdev close {CVE-2026-53025} * CVE-2026-52934 - batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934} * CVE-2025-68303 - platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303} * CVE-2026-64280 - fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280} * CVE-2026-64188 - net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188} * CVE-2026-64109 - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} * CVE-2026-64274 - Input: goodix - clamp the device-reported contact count {CVE-2026-64274} * CVE-2026-64270 - Input: mms114 - reject an oversized device packet size {CVE-2026-64270} * CVE-2026-64093 - batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093} * CVE-2026-64091 - batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091} * CVE-2026-53329 - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329} * CVE-2026-64298 - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} * CVE-2026-64276 - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} * CVE-2026-64273 - Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273} * CVE-2026-64271 - Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271} * CVE-2026-64266 - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} * CVE-2026-64191 - i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191} * CVE-2026-64189 - netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189} * CVE-2026-31786 - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} * CVE-2025-68799 - caif: fix integer underflow in cffrml_receive() {CVE-2025-68799} * CVE-2025-68302 - net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302} * CVE-2025-40243 - hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243} * CVE-2025-40233 - ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233} * CVE-2026-23269 - apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269} * CVE-2026-43249 - 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249} * CVE-2026-31657 - batman-adv: hold claim backbone gateways by reference {CVE-2026-31657} * CVE-2026-31598 - ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598} * CVE-2026-31768 - iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768} * CVE-2026-23216 - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} * CVE-2026-31597 - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597} * CVE-2026-46174 - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174} - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache {CVE-2026-46174} * CVE-2025-71152 - net: dsa: properly keep track of conduit reference {CVE-2025-71152} * CVE-2026-53230 - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230} * CVE-2026-53262 - l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() {CVE-2026-53262} * CVE-2026-31663 - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} * CVE-2024-36013 - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} * CVE-2022-49328 - mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328} * CVE-2026-52917 - sctp: diag: reject stale associations in dump_one path {CVE-2026-52917} * CVE-2026-46150 - fanotify: fix false positive on permission events {CVE-2026-46150} * CVE-2026-45984 - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} * CVE-2026-52943 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers {CVE-2026-52943} * CVE-2026-52956 - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} * CVE-2022-49470 - Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event {CVE-2022-49470} * CVE-2026-46052 - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} * CVE-2026-53270 - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} * CVE-2026-53133 - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133} * CVE-2026-53223 - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} * CVE-2026-46181 - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} * CVE-2026-53239 - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} * CVE-2026-45894 - iommu/vt-d: Clear Present bit before tearing down PASID entry {CVE-2026-45894} * CVE-2026-52924 - sctp: purge outqueue on stale COOKIE-ECHO handling {CVE-2026-52924} * CVE-2026-53228 - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} * CVE-2026-53212 - netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212} * CVE-2026-46056 - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} * CVE-2026-53009 - ice: fix double-free of tx_buf skb {CVE-2026-53009} * CVE-2026-46116 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} * CVE-2026-52912 - netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912} * CVE-2026-43051 - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} * CVE-2026-53016 - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} * CVE-2026-46133 - RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133} * CVE-2026-46149 - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() {CVE-2026-46149} * CVE-2026-23392 - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} * CVE-2026-31586 - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} * CVE-2026-43110 - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} * CVE-2026-52957 - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} * CVE-2026-53120 - PCI: serialize driver_override to fix use-after-free in pci_match_device() {CVE-2026-53120} * CVE-2026-46099 - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels {CVE-2026-46099} * CVE-2026-53006 - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} * CVE-2026-52993 - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} * CVE-2026-53112 - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112} * CVE-2026-52919 - batman-adv: fix tp_meter counter underflow during shutdown {CVE-2026-52919} * CVE-2026-46212 - batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212} * CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} * CVE-2025-68256 - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser {CVE-2025-68256} * CVE-2026-46006 - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} * CVE-2026-45852 - RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852} * CVE-2026-52931 - batman-adv: tp_meter: avoid use of uninit sender vars {CVE-2026-52931} * CVE-2023-53218 - rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218} * CVE-2023-53596 - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596} * CVE-2026-53072 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} * CVE-2026-43334 - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} * CVE-2026-43226 - net/rds: No shortcut out of RDS_CONN_ERROR {CVE-2026-43226} * CVE-2026-43494 - net/rds: reset op_nents when zerocopy page pin fails {CVE-2026-43494} * CVE-2026-43116 - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} * CVE-2026-31408 - Bluetooth: SCO: hold the sk before receiving a frame {CVE-2026-31408} * CVE-2026-53131 - netfilter: reject use of unset mac header for non-ethernet devices {CVE-2026-53131} * CVE-2026-52986 - netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986} * CVE-2026-53002 - netfilter: conntrack: remove sprintf usage {CVE-2026-53002} * CVE-2026-53186 - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} * CVE-2026-52918 - Bluetooth: serialize accept_q access {CVE-2026-52918} * CVE-2026-53256 - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} * CVE-2026-53253 - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} * CVE-2026-53254 - Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254} * CVE-2026-45942 - ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942} * CVE-2026-23243 - RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243} * CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-43190 - netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190} * CVE-2026-53268 - netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} * CVE-2025-40271 - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271} * CVE-2026-43049 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} * CVE-2023-54207 - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207} * CVE-2026-23098 - netrom: fix double-free in nr_route_frame() {CVE-2026-23098} * CVE-2026-31580 - bcache: fix cached_dev.sb_bio use-after-free and crash {CVE-2026-31580} * CVE-2022-50066 - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066} * CVE-2026-43458 - serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458} * CVE-2024-46859 - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859} * CVE-2023-53473 - ext4: improve error handling from ext4_dirhash() {CVE-2023-53473} * CVE-2026-31685 - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} * CVE-2026-31637 - rxrpc: reject undecryptable rxkad response tickets {CVE-2026-31637} * CVE-2026-23190 - ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190} * CVE-2025-68214 - timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214} * CVE-2026-46043 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv {CVE-2026-46043} * CVE-2025-68787 - netrom: Fix memory leak in nr_sendmsg() {CVE-2025-68787} * CVE-2026-23455 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} * CVE-2022-50303 - drm/amdkfd: Fix double release compute pasid {CVE-2022-50303} * CVE-2026-22999 - net/sched: sch_qfq: do not free existing class in qfq_change_class() {CVE-2026-22999} * CVE-2026-43117 - btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() {CVE-2026-43117} * CVE-2026-43050 - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} * CVE-2026-31759 - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759} * CVE-2026-31578 - media: as102: fix to not free memory after the device is registered in as102_usb_probe() {CVE-2026-31578} * CVE-2026-53011 - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch {CVE-2026-53011} * CVE-2026-46227 - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} * CVE-2026-46120 - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} * CVE-2026-53224 - sctp: validate embedded INIT chunk and address list lengths in COOKIE_ECHO {CVE-2026-53224} * CVE-2026-53246 - sctp: validate cached peer INIT chunk length in COOKIE_ECHO {CVE-2026-53246} * Miscellaneous upstream changes - dkms-build: prefer a pre-seeded DKMS package from debian/dkms-packages * Bump ABI 5.4.0-237