* CVE-2025-39826 - net: rose: convert 'use' field to refcount_t {CVE-2025-39826} * CVE-2025-40146 - blk-mq: fix potential deadlock while nr_requests grown {CVE-2025-40146} * CVE-2024-53216 - nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216} * CVE-2026-89778 - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} * CVE-2026-23050 - pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050} * CVE-2025-68796 - f2fs: fix to avoid updating zero-sized extent in extent cache {CVE-2025-68796} * CVE-2025-68330 - iio: accel: bmc150: Fix irq assumption regression {CVE-2025-68330} * CVE-2025-40333 - f2fs: fix infinite loop in __insert_extent_tree() {CVE-2025-40333} * CVE-2025-40160 - xen/events: Return -EEXIST for bound VIRQs {CVE-2025-40160} * CVE-2023-54047 - drm/rockchip: dw_hdmi: cleanup drm encoder during unbind {CVE-2023-54047} * CVE-2025-68190 - drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() {CVE-2025-68190} * CVE-2025-68188 - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} * CVE-2026-89786 - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} * CVE-2022-50764 - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764} * CVE-2026-80785 - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785} * CVE-2026-80788 - nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations {CVE-2026-80788} * CVE-2026-80747 - drm/amdkfd: Add bounds check for CRAT subtype length {CVE-2026-80747} * CVE-2026-80907 - drm/amdgpu: Fix UVD dpb min size calculation for H264 {CVE-2026-80907} * CVE-2026-80908 - drm/amdgpu: Reject UVD message with dimensions above 4096 {CVE-2026-80908} * CVE-2026-80812 - ALSA: dummy: Check card index validity at probe {CVE-2026-80812} * CVE-2026-80948 - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948} * CVE-2025-40137 - f2fs: fix to truncate first page in error path of f2fs_truncate() {CVE-2025-40137} * CVE-2023-54150 - drm/amd: Fix an out of bounds error in BIOS parser {CVE-2023-54150} * CVE-2026-89784 - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} * CVE-2026-89783 - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} * CVE-2026-89780 - net: qualcomm: rmnet: restore skb->dev on deaggregated frames {CVE-2026-89780} * CVE-2026-89777 - vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777} * CVE-2026-89789 - gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free {CVE-2026-89789} * CVE-2025-68797 - char: applicom: fix NULL pointer dereference in ac_ioctl {CVE-2025-68797} * CVE-2025-68767 - hfsplus: Verify inode mode when loading from disk {CVE-2025-68767} * CVE-2026-63961 - usb: typec: altmodes/displayport: validate count before reading Status Update VDO {CVE-2026-63961} * CVE-2026-63904 - usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904} * CVE-2022-50864 - nilfs2: fix shift-out-of-bounds due to too large exponent of block size {CVE-2022-50864} * CVE-2025-68771 - ocfs2: fix kernel BUG in ocfs2_find_victim_chain {CVE-2025-68771} * CVE-2025-68750 - usb: potential integer overflow in usbg_make_tpg() {CVE-2025-68750} * CVE-2026-80909 - drm/amdgpu: Reject UVD message with invalid number of h265 refs {CVE-2026-80909} * CVE-2026-74402 - crypto: atmel-sha204a - fix blocking and non-blocking rng logic {CVE-2026-74402} * CVE-2026-80844 - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} * CVE-2026-80732 - ata: pata_sl82c105: fix bridge revision use-after-free {CVE-2026-80732} * CVE-2026-80823 - nfc: st21nfca: validate ATR_REQ length against the received frame {CVE-2026-80823} * CVE-2026-89733 - usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() {CVE-2026-89733} * CVE-2026-80570 - Input: synaptics-rmi4 - zero report size on F54 work error {CVE-2026-80570} * CVE-2026-80600 - batman-adv: dat: acquire ARP hw source only after skb realloc {CVE-2026-80600} * CVE-2026-74580 - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} * CVE-2026-74609 - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} * CVE-2026-68188 - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} * CVE-2026-74505 - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} * CVE-2026-74583 - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} * CVE-2026-72299 - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} * CVE-2026-89607 - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} * CVE-2026-74444 - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} * CVE-2026-72234 - batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234} * CVE-2026-68357 - watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() {CVE-2026-68357} * CVE-2026-74588 - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} * CVE-2026-74548 - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548} * CVE-2026-64563 - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} * CVE-2026-68373 - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} * CVE-2026-74556 - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} * CVE-2026-68158 - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} * CVE-2026-74656 - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} * CVE-2026-64483 - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} * CVE-2026-63814 - f2fs: validate ACL entry sizes in f2fs_acl_from_disk() {CVE-2026-63814} * CVE-2026-64505 - usb: gadget: function: rndis: add length check for header {CVE-2026-64505} * CVE-2026-63823 - keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823} * CVE-2026-72233 - batman-adv: bla: reacquire gw address after skb realloc {CVE-2026-72233} * CVE-2026-68121 - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} * CVE-2026-74660 - netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660} * CVE-2026-74255 - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} * CVE-2026-64504 - iio: accel: bmc150: clamp the device-reported FIFO frame count {CVE-2026-64504} * CVE-2026-72047 - ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit {CVE-2026-72047} * CVE-2026-68214 - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} * CVE-2026-68402 - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} * CVE-2026-72351 - gue: validate REMCSUM private option length {CVE-2026-72351} * CVE-2026-72171 - mtd: slram: remove failed entries from the device list {CVE-2026-72171} * CVE-2026-68144 - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} * CVE-2026-74667 - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} * CVE-2026-80601 - batman-adv: gw: acquire ethernet header only after skb realloc {CVE-2026-80601} * CVE-2026-68377 - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} * CVE-2026-72374 - afs: Fix callback service message parsers to pass through -EAGAIN {CVE-2026-72374} * CVE-2026-74705 - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} * CVE-2026-74630 - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} * CVE-2026-74679 - usb: gadget: f_ncm: Use unsigned int for ndp_index {CVE-2026-74679} * CVE-2026-68153 - libceph: remove debugfs files before client teardown {CVE-2026-68153} * CVE-2026-72083 - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083} * CVE-2026-68143 - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} * CVE-2026-68335 - rds: drop incoming messages that cross network namespace boundaries {CVE-2026-68335} * CVE-2026-72406 - net: sungem: fix probe error cleanup {CVE-2026-72406} * CVE-2026-74394 - RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394} * CVE-2026-68376 - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} * CVE-2026-72014 - drbd: reject data replies with an out-of-range payload size {CVE-2026-72014} * CVE-2026-64471 - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} * CVE-2026-80590 - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} * CVE-2026-74408 - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} * CVE-2026-68160 - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} * CVE-2026-72296 - net: ife: require ETH_HLEN to be pullable in ife_decode() {CVE-2026-72296} * CVE-2026-80622 - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} * CVE-2026-68363 - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} * CVE-2026-80558 - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} * CVE-2026-68199 - wifi: ath6kl: fix OOB access from firmware ADDBA window size {CVE-2026-68199} * CVE-2026-89724 - media: vicodec: fix out-of-bounds write in FWHT encoder {CVE-2026-89724} * CVE-2026-89720 - ubifs: fix out-of-bounds read in signature length check {CVE-2026-89720} * CVE-2026-89674 - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} * CVE-2026-89729 - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} * CVE-2026-89742 - rapidio: mport_cdev: fix use-after-free in dma_req_free() {CVE-2026-89742} * CVE-2026-64375 - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} * CVE-2026-64378 - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} * CVE-2026-64448 - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} * CVE-2026-64381 - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} * CVE-2026-64379 - smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379} * CVE-2026-64445 - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() {CVE-2026-64445} * CVE-2026-64440 - staging: rtl8723bs: fix OOB write in HT_caps_handler() {CVE-2026-64440} * CVE-2026-64446 - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() {CVE-2026-64446} * CVE-2026-64442 - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() {CVE-2026-64442} * CVE-2026-64443 - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop {CVE-2026-64443} * CVE-2026-64438 - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} * CVE-2026-64305 - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} * CVE-2026-64341 - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} * CVE-2026-64344 - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} * CVE-2026-64340 - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} * CVE-2026-64422 - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} * CVE-2026-64424 - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} * CVE-2026-64423 - ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423} * CVE-2026-64420 - mfd: cros_ec: Delay dev_set_drvdata() until probe success {CVE-2026-64420} * CVE-2026-64343 - USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343} * CVE-2026-64330 - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330} * CVE-2026-64449 - staging: vme_user: bound slave read/write to the kern_buf size {CVE-2026-64449} * CVE-2026-64348 - usb: free iso schedules on failed submit {CVE-2026-64348} * CVE-2026-64304 - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} * CVE-2026-64452 - 6lowpan: fix NHC entry use-after-free on error path {CVE-2026-64452} * CVE-2026-64372 - cpufreq: pcc: fix use-after-free and double free in _OSC evaluation {CVE-2026-64372} * CVE-2026-64351 - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} * CVE-2026-64342 - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342} * CVE-2026-64323 - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} * CVE-2026-64322 - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} * CVE-2026-64318 - partitions: aix: bound the pp_count scan to the ppe array {CVE-2026-64318} * CVE-2026-64320 - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} * CVE-2026-31727 - usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo {CVE-2026-31727} * CVE-2026-46275 - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths {CVE-2026-46275} * CVE-2026-43449 - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449} * CVE-2026-43015 - net: macb: fix clk handling on PCI glue driver removal {CVE-2026-43015} * CVE-2026-68156 - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} * CVE-2025-39987 - can: hi311x: populate ndo_change_mtu() to prevent buffer overflow {CVE-2025-39987} * CVE-2025-39985 - can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow {CVE-2025-39985} * CVE-2026-64237 - Input: elan_i2c - validate firmware size before use {CVE-2026-64237} * CVE-2025-68217 - Input: pegasus-notetaker - fix potential out-of-bounds access {CVE-2025-68217} * CVE-2026-43279 - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} * CVE-2026-52991 - sched/psi: fix race between file release and pressure write {CVE-2026-52991} * CVE-2026-53355 - net: rds: clear i_sends on setup unwind {CVE-2026-53355} * CVE-2026-52942 - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} * CVE-2026-53189 - mm/huge_memory: update file PMD counter before folio_put() {CVE-2026-53189} * CVE-2026-53264 - net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264} * CVE-2026-45970 - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} * CVE-2026-52920 - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} * CVE-2026-46209 - drm/gem: Fix inconsistent plane dimension calculation {CVE-2026-46209} * CVE-2026-45856 - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send {CVE-2026-45856} * CVE-2026-53040 - ocfs2: validate bg_bits during freefrag scan {CVE-2026-53040} * CVE-2026-53130 - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START {CVE-2026-53130} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2025-40082 - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-40082} * CVE-2024-53179 - cifs: fix use-after-free of signing key {CVE-2024-53179} * CVE-2024-49861 - bpf: Fix helper writes to read-only maps {CVE-2024-49861} * CVE-2022-50151 - usb: cdns3: fix random warning message when driver load {CVE-2022-50151} * CVE-2022-47519 - wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute {CVE-2022-47519} * CVE-2026-23105 - net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag {CVE-2026-23105} * CVE-2026-43158 - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} * Miscellaneous upstream changes - net: rose: split remove and free operations in rose_remove_neigh() - af_unix: read the receive queue tail length under the queue lock in unix_stream_data_wait() - media: rc: Use the correct style for SPDX License Identifier - Revert "Revert "sctp: Fix bundling of SHUTDOWN with COOKIE-ACK"" - Revert "sctp: Fix bundling of SHUTDOWN with COOKIE-ACK" * Bump ABI 5.4.0-238