* CVE-2026-53266 - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} * CVE-2025-39964 - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} * CVE-2025-39827 - net: rose: include node references in rose_neigh refcount {CVE-2025-39827} * CVE-2026-93140 - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} * CVE-2026-90112 - net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112} * CVE-2026-90237 - netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237} * CVE-2026-93051 - misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051} * CVE-2026-90379 - wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379} * CVE-2026-90302 - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} * CVE-2026-90383 - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} * CVE-2026-90320 - ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320} * CVE-2026-93047 - drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047} * CVE-2026-93192 - drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192} * CVE-2026-93050 - ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050} * CVE-2026-90311 - thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311} * CVE-2026-93191 - smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191} * CVE-2026-93042 - dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042} * CVE-2026-93056 - usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056} * CVE-2026-93203 - batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203} * CVE-2026-93204 - batman-adv: dat: atomically update mac addresses {CVE-2026-93204} * CVE-2026-90000 - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} * CVE-2026-90431 - remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431} * CVE-2026-93202 - i3c: master: Fix recursive locking during device registration {CVE-2026-93202} * CVE-2026-90347 - arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347} * CVE-2026-90267 - scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267} * CVE-2026-92500 - ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500} * CVE-2026-93196 - nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196} * CVE-2026-90207 - ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207} * CVE-2026-90307 - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} * CVE-2026-90110 - inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110} * CVE-2026-90293 - IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293} * CVE-2026-89838 - f2fs: limit recovery filename logging to stored length {CVE-2026-89838} * CVE-2026-93177 - drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177} * CVE-2026-89823 - drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823} * CVE-2026-90041 - HID: sony: clean up device list on probe failure {CVE-2026-90041} * CVE-2026-90015 - xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015} * CVE-2026-93095 - hfsplus: validate thread record before delete key rebuild {CVE-2026-93095} * CVE-2026-92522 - ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522} * CVE-2026-90328 - HID: steam: Reject short reads {CVE-2026-90328} * CVE-2026-92481 - pinctrl: mediatek: free EINT resources on unbind {CVE-2026-92481} * CVE-2026-90421 - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} * CVE-2026-89952 - mtd: rawnand: validate ONFI extended parameter page sections {CVE-2026-89952} * CVE-2026-89927 - KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock {CVE-2026-89927} * CVE-2026-90245 - fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245} * CVE-2026-90102 - NFSv4/pnfs: key the data server cache on the NFS version {CVE-2026-90102} * CVE-2026-93178 - drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup {CVE-2026-93178} * CVE-2026-92480 - scsi: ufs: core: Validate string descriptors {CVE-2026-92480} * CVE-2026-90106 - net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106} * CVE-2026-89847 - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} * CVE-2026-90036 - NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036} * CVE-2026-93179 - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read {CVE-2026-93179} * CVE-2026-89856 - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} * CVE-2026-92482 - pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip {CVE-2026-92482} * CVE-2026-90294 - IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294} * CVE-2026-92499 - ext4: validate readdir offset before accessing dirent {CVE-2026-92499} * CVE-2026-90150 - pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150} * CVE-2026-90222 - nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222} * CVE-2026-90235 - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235} * CVE-2026-90105 - vxlan: fix reading neigh ha {CVE-2026-90105} * CVE-2026-93172 - mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug {CVE-2026-93172} * CVE-2026-90149 - NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers {CVE-2026-90149} * CVE-2026-90248 - net/sched: cls_api: fix teardown of an adopted proto on insert-race loss {CVE-2026-90248} * CVE-2026-90196 - ASoC: SOF: validate topology volume range before allocation {CVE-2026-90196} * CVE-2026-90234 - NFS: Return a delegation the client fails to record {CVE-2026-90234} * CVE-2026-90298 - drm/sun4i: tcon: Drop TCON TOP device reference {CVE-2026-90298} * CVE-2026-93151 - nvmet-rdma: fix response resource leak on queue teardown {CVE-2026-93151} * CVE-2026-90259 - btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259} * CVE-2026-89881 - media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak {CVE-2026-89881} * CVE-2026-90418 - nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418} * CVE-2026-93053 - speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053} * CVE-2026-90314 - remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() {CVE-2026-90314} * CVE-2026-92498 - wifi: ath6kl: avoid buffer overreads in WMI event handlers {CVE-2026-92498} * CVE-2026-93039 - ASoC: meson: Keep link pointers valid on realloc failure {CVE-2026-93039} * CVE-2026-89936 - iio: dac: m62332: Fix regulator reference count imbalance {CVE-2026-89936} * CVE-2026-89901 - media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref {CVE-2026-89901} * CVE-2026-89848 - scsi: qla2xxx: Quiesce response IRQ before freeing request queue {CVE-2026-89848} * CVE-2026-90303 - ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults {CVE-2026-90303} * CVE-2026-90187 - null_blk: free zones array on device power-off {CVE-2026-90187} * CVE-2026-90151 - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} * CVE-2026-90125 - smb: client: fix request buffer leak in smb2_new_read_req() {CVE-2026-90125} * CVE-2026-89840 - f2fs: validate MOVE_RANGE destination size {CVE-2026-89840} * CVE-2026-90160 - lwt_bpf: Restore reserved headroom after xmit program {CVE-2026-90160} * CVE-2026-92525 - RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] {CVE-2026-92525} * CVE-2026-90315 - PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers {CVE-2026-90315} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-93117 - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} * CVE-2026-90062 - netfilter: nf_tables: move hardware offload step after building the chain blob {CVE-2026-90062} * CVE-2026-90214 - ASoC: xilinx: formatter_pcm: fix stream_data leak on open error {CVE-2026-90214} * CVE-2026-89946 - ASoC: cs35l33: drain threaded IRQ before runtime suspend {CVE-2026-89946} * CVE-2026-89945 - ASoC: cs35l34: drain threaded IRQ before runtime suspend {CVE-2026-89945} * CVE-2026-90194 - ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194} * CVE-2026-93037 - RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037} * CVE-2026-89938 - iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF {CVE-2026-89938} * CVE-2026-89999 - HID: wacom: validate report length in wacom_intuos_pro2_bt_irq {CVE-2026-89999} * CVE-2026-93170 - dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers {CVE-2026-93170} * CVE-2026-89846 - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} * CVE-2026-89813 - drm/amdgpu: force complete the KIQ ring fences on reset {CVE-2026-89813} * CVE-2026-89913 - KVM: arm64: vgic-v3: take an LPI reference in vgic_v3_save_pending_tables {CVE-2026-89913} * CVE-2026-89864 - scsi: qla2xxx: Bound i2c->length in I2C bsg handlers {CVE-2026-89864} * CVE-2026-92524 - irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() {CVE-2026-92524} * CVE-2026-90032 - media: usbtv: keep device alive while ALSA card exists {CVE-2026-90032} * CVE-2026-89929 - KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU {CVE-2026-89929} * CVE-2026-90386 - i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices {CVE-2026-90386} * CVE-2026-90225 - nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225} * CVE-2026-90138 - vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138} * CVE-2026-93040 - dmaengine: dw-edma: Serialize channel state checks {CVE-2026-93040} * CVE-2026-90141 - ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141} * CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} * CVE-2026-89890 - media: go7007: defer the ALSA v4l2 put until card release {CVE-2026-89890} * CVE-2026-89948 - batman-adv: bla: fix freeing of claims on meshif deletion {CVE-2026-89948} * CVE-2026-89865 - scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers {CVE-2026-89865} * CVE-2026-89843 - scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak {CVE-2026-89843} * CVE-2026-90180 - block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180} * CVE-2026-90227 - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() {CVE-2026-90227} * CVE-2026-89883 - media: rc: sunxi-cir: Unregister rc device on probe failure {CVE-2026-89883} * CVE-2026-89912 - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912} * CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} * CVE-2026-90109 - net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue {CVE-2026-90109} * CVE-2026-90058 - net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058} * CVE-2026-93188 - HID: roccat: bound device-supplied profile index {CVE-2026-93188} * CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} * CVE-2026-89949 - batman-adv: dat: avoid unaligned fault in IP extraction {CVE-2026-89949} * CVE-2026-89965 - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} * CVE-2026-89854 - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} * CVE-2026-89968 - nvmet-tcp: reject unsolicited H2CData PDUs {CVE-2026-89968} * CVE-2026-89871 - media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure {CVE-2026-89871} * CVE-2026-89897 - media: cec: Serialize exclusive follower delivery {CVE-2026-89897} * CVE-2026-89877 - media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877} * CVE-2026-93189 - HID: core: quiesce input in hid_hw_stop() to prevent use-after-free {CVE-2026-93189} * CVE-2026-90053 - net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053} * CVE-2026-90182 - blk-iocost: clear delay state when freeing policy data {CVE-2026-90182} * CVE-2026-89954 - mtd: afs: validate v2 image info bounds {CVE-2026-89954} * CVE-2026-89858 - scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() {CVE-2026-89858} * CVE-2026-89973 - nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973} * CVE-2026-90419 - nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419} * CVE-2026-90075 - net/sched: fq_codel: clamp default quantum and mtu {CVE-2026-90075} * CVE-2026-90416 - RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416} * CVE-2026-90226 - nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226} * CVE-2026-90076 - net/sched: fq: add overflow bounds to quantum and initial quantum {CVE-2026-90076} * CVE-2026-90056 - net: fec: only stop PTP if it was initialized {CVE-2026-90056} * CVE-2026-90411 - nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request {CVE-2026-90411} * CVE-2026-93159 - crypto: atmel-sha204a - fix heap info leak on I2C transfer failure {CVE-2026-93159} * CVE-2026-90360 - regulator: core: use system_freezable_wq for init complete work {CVE-2026-90360} * CVE-2026-90403 - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} * CVE-2026-89879 - media: s2255: bound JPEG frame size before copying into the buffer {CVE-2026-89879} * CVE-2026-89821 - drm/amd/display: avoid divide-by-zero in __is_lut_linear() {CVE-2026-89821} * CVE-2026-53176 - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176} * CVE-2026-92509 - RDMA/core: Fix potential use after free in counter_release() {CVE-2026-92509} * CVE-2026-93163 - hwrng: core - fix rng list on registration error {CVE-2026-93163} * CVE-2026-90055 - usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055} * CVE-2026-90088 - Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088} * CVE-2026-90318 - fat: release buffer head after rebuilding parent {CVE-2026-90318} * CVE-2026-90126 - rtc: pcf8563: fix clock provider leak on unbind {CVE-2026-90126} * CVE-2026-90345 - wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345} * CVE-2026-90073 - net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073} * CVE-2026-90263 - btrfs: check if root is readonly when setting posix acl {CVE-2026-90263} * CVE-2026-90334 - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} * CVE-2026-93104 - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} * CVE-2026-90216 - ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216} * CVE-2026-93120 - usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120} * CVE-2026-89876 - media: tda18250: fix possible integer overflow {CVE-2026-89876} * CVE-2026-89887 - media: i2c: ov7740: fix use-after-destroy in remove {CVE-2026-89887} * CVE-2026-89951 - batman-adv: fix stale receive device on merged fragments {CVE-2026-89951} * CVE-2026-89850 - scsi: qla2xxx: Don't query firmware state while chip is down {CVE-2026-89850} * CVE-2026-90034 - usb: image: mdc800: change kmalloc() to kzalloc() {CVE-2026-90034} * CVE-2026-80786 - fbdev: Wrap user-invoked calls to fb_set_var() in helper {CVE-2026-80786} * CVE-2023-54023 - btrfs: fix race between balance and cancel/pause {CVE-2023-54023} * CVE-2025-68173 - ftrace: Fix softlockup in ftrace_module_enable {CVE-2025-68173} * CVE-2026-80757 - selinux: reject a class permission count below its inherited common {CVE-2026-80757} * CVE-2026-74256 - bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check {CVE-2026-74256} * CVE-2026-80830 - usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830} * CVE-2026-80886 - serial: msm: Disable DMA for kernel console UART {CVE-2026-80886} * CVE-2026-80824 - usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824} * CVE-2026-80814 - rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814} * CVE-2025-38584 - padata: Fix pd UAF once and for all {CVE-2025-38584} * CVE-2025-38259 - ASoC: codecs: wcd9335: Fix missing free of regulator supplies {CVE-2025-38259} * CVE-2024-50067 - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067} * CVE-2026-80854 - usb: gadget: f_tcm: keep port count until LUN teardown completes {CVE-2026-80854} * CVE-2026-89740 - serial: imx: serialize imx_uart_ports[] lifetime {CVE-2026-89740} * CVE-2026-89666 - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} * CVE-2026-80847 - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847} * CVE-2026-80861 - usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861} * CVE-2026-89468 - power: supply: lp8788-charger: fix use-after-free on remove {CVE-2026-89468} * CVE-2026-80974 - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974} * CVE-2026-89528 - svcrdma: Reject Read lists that exceed the page budget {CVE-2026-89528} * CVE-2026-89531 - svcrdma: Reject connection when transport allocation fails {CVE-2026-89531} * CVE-2026-89527 - svcrdma: Use svc_xprt_put to free listener on create failure {CVE-2026-89527} * CVE-2026-89492 - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} * CVE-2026-89441 - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} * CVE-2026-89719 - zram: fix out-of-bounds access in read_block_state() {CVE-2026-89719} * CVE-2026-89718 - zram: fix out-of-bounds access in writeback_store() {CVE-2026-89718} * CVE-2026-80996 - net: l2tp: do not propagate multicast notification errors {CVE-2026-80996} * CVE-2026-80841 - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} * CVE-2026-80925 - vlan: fix skb_under_panic and races when toggling HW VLAN offload {CVE-2026-80925} * CVE-2026-89484 - lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484} * CVE-2026-89462 - power: supply: max17040: propagate register read errors {CVE-2026-89462} * CVE-2026-80901 - ipvs: fix the checksum validations {CVE-2026-80901} * CVE-2026-74395 - RDMA/mlx5: Fix devx subscribe-event unwind NULL dereference {CVE-2026-74395} * CVE-2026-80884 - ntb: Store original DMA address for future release {CVE-2026-80884} * CVE-2026-80789 - nvmet-tcp: bound SGL data length before allocating command buffers {CVE-2026-80789} * CVE-2026-80913 - selinux: require every boolean value to be defined {CVE-2026-80913} * CVE-2026-80797 - nfc: pn533: purge fragmented skbs during cleanup {CVE-2026-80797} * CVE-2026-80738 - bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie {CVE-2026-80738} * CVE-2026-80737 - serial: amba-pl011: synchronize DMA teardown {CVE-2026-80737} * CVE-2026-80798 - nfc: llcp: reject PDUs shorter than the LLCP header {CVE-2026-80798} * CVE-2026-80840 - ipv6: seg6: clear IPv4 control block on IPIP decapsulation {CVE-2026-80840} * CVE-2026-80764 - Bluetooth: hci_event: fix LE list UAF on reset {CVE-2026-80764} * CVE-2026-80851 - gtp: serialize PDP context updates {CVE-2026-80851} * CVE-2026-80828 - ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828} * CVE-2026-80807 - nilfs2: reject invalid block index in GC ioctl {CVE-2026-80807} * CVE-2026-80852 - tls: device: fix out-of-bounds write in tls_append_frag() {CVE-2026-80852} * CVE-2026-80733 - net: remove WARN_ON_ONCE() from sk_mc_loop() {CVE-2026-80733} * CVE-2026-80782 - HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782} * CVE-2026-80843 - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843} * CVE-2023-53834 - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match {CVE-2023-53834} * CVE-2022-50774 - crypto: qat - fix DMA transfer direction {CVE-2022-50774} * CVE-2023-53799 - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799} * CVE-2024-50135 - nvme-pci: fix race condition between reset and nvme_dev_disable() {CVE-2024-50135} * CVE-2022-50766 - btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer {CVE-2022-50766} * CVE-2025-40100 - btrfs: do not assert we found block group item when creating free space tree {CVE-2025-40100} * CVE-2025-40180 - mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop {CVE-2025-40180} * CVE-2025-68344 - ALSA: wavefront: Fix integer overflow in sample size validation {CVE-2025-68344} * CVE-2024-50166 - fsl/fman: Fix refcount handling of fman-related devices {CVE-2024-50166} * CVE-2025-71193 - phy: qcom-qusb2: Fix NULL pointer dereference on early suspend {CVE-2025-71193} * CVE-2023-53815 - posix-timers: Prevent RT livelock in itimer_delete() {CVE-2023-53815} * CVE-2026-80742 - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} * CVE-2026-80875 - ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875} * CVE-2026-80809 - ocfs2: fix missing metadata reservation for large xattrs {CVE-2026-80809} * CVE-2026-74321 - btrfs: fix invalid pointer dereference in __btrfs_run_delayed_refs() {CVE-2026-74321} * CVE-2026-80731 - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731} * CVE-2026-72378 - afs: Fix error code in afs_extract_vl_addrs() {CVE-2026-72378} * CVE-2026-80752 - Input: psxpad-spi - set driver data before use {CVE-2026-80752} * CVE-2026-80801 - nfc: microread: validate target discovery payload lengths {CVE-2026-80801} * CVE-2026-72165 - mtd: rawnand: fix condition in 'nand_select_target()' {CVE-2026-72165} * CVE-2026-80877 - afs: Fix vllist leak {CVE-2026-80877} * CVE-2026-80819 - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819} * CVE-2026-63934 - iio: gyro: itg3200: fix i2c read into the wrong stack location {CVE-2026-63934} * CVE-2025-68777 - Input: ti_am335x_tsc - fix off-by-one error in wire_order validation {CVE-2025-68777} * CVE-2026-63908 - Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem {CVE-2026-63908} * CVE-2025-40116 - usb: host: max3421-hcd: Fix error pointer dereference in probe cleanup {CVE-2025-40116} * CVE-2025-68339 - atm/fore200e: Fix possible data race in fore200e_open() {CVE-2025-68339} * CVE-2026-63957 - USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957} * CVE-2023-53840 - usb: early: xhci-dbc: Fix a potential out-of-bound memory access {CVE-2023-53840} * CVE-2025-68328 - firmware: stratix10-svc: fix bug in saving controller data {CVE-2025-68328} * CVE-2026-63915 - nfc: hci: fix out-of-bounds read in HCP header parsing {CVE-2026-63915} * CVE-2026-63893 - thunderbolt: property: Reject u32 wrap in tb_property_entry_valid() {CVE-2026-63893} * CVE-2026-63927 - usb: dwc2: Fix use after free in debug code {CVE-2026-63927} * CVE-2026-63954 - hpfs: fix a crash if hpfs_map_dnode_bitmap fails {CVE-2026-63954} * CVE-2026-64010 - nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc() {CVE-2026-64010} * CVE-2026-63892 - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892} * CVE-2026-64014 - Input: usbtouchscreen - clamp NEXIO data_len/x_len to URB buffer size {CVE-2026-64014} * CVE-2025-68364 - ocfs2: relax BUG() to ocfs2_error() in __ocfs2_move_extent() {CVE-2025-68364} * CVE-2026-63991 - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() {CVE-2026-63991} * CVE-2026-63971 - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} * CVE-2025-71069 - f2fs: invalidate dentry cache on failed whiteout creation {CVE-2025-71069} * CVE-2026-64011 - nfc: llcp: Fix use-after-free in llcp_sock_release() {CVE-2026-64011} * CVE-2026-63888 - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} * CVE-2026-89476 - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} * CVE-2026-89574 - dm array: validate array block headers on read {CVE-2026-89574} * CVE-2026-63962 - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() {CVE-2026-63962} * CVE-2026-63983 - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} * CVE-2026-80994 - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} * CVE-2026-80928 - smack: fix cred UAF in smack_file_send_sigiotask() {CVE-2026-80928} * CVE-2026-89448 - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} * CVE-2026-89633 - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} * CVE-2026-80976 - seg6: reset IP6CB after IPv6 decapsulation {CVE-2026-80976} * CVE-2026-63922 - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} * CVE-2026-80982 - net/smc: fix use-after-free in smc_rx_pipe_buf_release() {CVE-2026-80982} * CVE-2026-89487 - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} * CVE-2026-89478 - sctp: drop a chunk if its transport was removed {CVE-2026-89478} * CVE-2026-81001 - slip: fix use-after-free in sl_sync() {CVE-2026-81001} * CVE-2026-89537 - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} * CVE-2026-80971 - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} * CVE-2026-63930 - iio: buffer: hw-consumer: fix use-after-free in error path {CVE-2026-63930} * CVE-2026-72389 - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} * CVE-2025-40351 - hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() {CVE-2025-40351} * CVE-2026-64009 - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} * CVE-2026-81000 - net: tun: bound receive headroom {CVE-2026-81000} * CVE-2026-80676 - Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676} * CVE-2026-74510 - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} * CVE-2026-72472 - nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472} * CVE-2026-68367 - usb: gadget: f_tcm: synchronize delayed set_alt with teardown {CVE-2026-68367} * CVE-2026-74450 - drm/amd/pm: fix pptable use-after-free {CVE-2026-74450} * CVE-2026-74637 - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} * CVE-2026-68404 - wifi: cfg80211: use wiphy work for socket owner autodisconnect {CVE-2026-68404} * CVE-2026-89480 - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} * CVE-2026-72084 - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} * CVE-2026-74720 - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} * CVE-2026-74631 - net: smc: fix splice entry lifetime imbalance in smc_rx_splice {CVE-2026-74631} * CVE-2026-89762 - apparmor: fix cred UAF caused by begin_current_label_crit_section() {CVE-2026-89762} * CVE-2026-89659 - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} * CVE-2026-89488 - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} * CVE-2026-72390 - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390} * CVE-2026-72255 - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} * CVE-2026-74387 - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} * CVE-2026-74565 - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} * CVE-2026-74575 - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} * CVE-2026-80536 - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} * CVE-2026-89637 - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} * CVE-2026-68398 - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} * CVE-2026-68426 - xfrm: fix stale skb->prev after async crypto steals a GSO segment {CVE-2026-68426} * CVE-2026-89708 - nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown {CVE-2026-89708} * CVE-2026-74752 - sctp: validate cookie AUTH state before use {CVE-2026-74752} * CVE-2026-64557 - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() {CVE-2026-64557} * CVE-2026-72336 - Bluetooth: 6lowpan: hold L2CAP conn across debugfs control {CVE-2026-72336} * CVE-2026-64550 - net: qualcomm: rmnet: validate MAP frame length before ingress parsing {CVE-2026-64550} * CVE-2026-74345 - RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345} * CVE-2026-72404 - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404} * CVE-2026-64543 - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} * CVE-2026-72157 - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} * CVE-2026-74589 - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} * CVE-2026-74651 - staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() {CVE-2026-74651} * CVE-2026-68190 - staging: rtl8723bs: fix OOB reads in rtw_get_wps_ie() {CVE-2026-68190} * CVE-2026-74649 - staging: rtl8723bs: fix missing shared-key auth challenge length check {CVE-2026-74649} * CVE-2026-74582 - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} * CVE-2026-74669 - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} * CVE-2026-89553 - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-74550 - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} * CVE-2026-74569 - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} * CVE-2026-68108 - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} * CVE-2026-72129 - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} * CVE-2026-74700 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} * CVE-2026-63826 - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} * CVE-2026-68138 - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} * CVE-2026-89549 - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} * CVE-2026-74377 - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377} * CVE-2026-64470 - Bluetooth: btusb: fix use-after-free on marvell probe failure {CVE-2026-64470} * CVE-2026-89550 - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} * CVE-2026-89655 - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} * CVE-2026-64541 - net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket {CVE-2026-64541} * CVE-2026-72322 - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} * CVE-2026-68236 - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} * CVE-2026-89699 - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} * CVE-2026-89481 - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} * CVE-2026-68093 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} * CVE-2026-74704 - net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter {CVE-2026-74704} * CVE-2026-74289 - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} * CVE-2026-74436 - rxrpc: serialize kernel accept preallocation with socket teardown {CVE-2026-74436} * CVE-2026-64583 - usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583} * CVE-2026-74283 - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} * CVE-2026-74479 - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} * CVE-2026-74341 - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} * CVE-2026-74628 - net/x25: fix use-after-free of the socket by its timers {CVE-2026-74628} * CVE-2026-64468 - binder: fix UAF in binder_free_transaction() {CVE-2026-64468} * CVE-2026-74746 - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} * CVE-2026-89656 - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} * CVE-2026-89475 - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475} - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2026-89475} - devm-helpers: Add resource managed version of work init {CVE-2026-89475} - workqueue: Add resource managed version of delayed work init {CVE-2026-89475} * CVE-2026-68142 - geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142} * CVE-2026-74688 - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} * CVE-2026-68399 - bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399} * CVE-2026-72085 - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085} * CVE-2026-72413 - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} * CVE-2026-74689 - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} * CVE-2026-72323 - ipv4: igmp: Fix potential UAF in igmp_gq_start_timer() {CVE-2026-72323} * CVE-2026-74359 - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} * CVE-2026-74454 - drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size {CVE-2026-74454} * CVE-2026-74496 - fou: Fix use-after-free in fou_create() {CVE-2026-74496} * CVE-2026-80681 - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} * CVE-2026-68414 - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-72288 - KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling {CVE-2026-72288} * CVE-2026-68202 - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} * CVE-2026-64546 - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} * CVE-2026-89559 - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} * CVE-2026-89469 - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} * CVE-2026-89575 - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} * CVE-2026-89555 - mpls: reload header after pskb_may_pull() {CVE-2026-89555} * CVE-2026-89504 - regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer {CVE-2026-89504} * CVE-2026-89569 - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} * CVE-2026-89761 - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} * CVE-2026-89494 - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} * CVE-2026-89548 - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} * CVE-2026-89477 - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} * CVE-2026-89495 - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} * CVE-2026-74744 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} * CVE-2026-74282 - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} * CVE-2026-68198 - wifi: ath6kl: fix use-after-free in aggr_reset_state() {CVE-2026-68198} * CVE-2026-74386 - nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386} * CVE-2026-68155 - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} * CVE-2026-72383 - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} * CVE-2026-72476 - dmaengine: Fix possible use after free {CVE-2026-72476} * CVE-2026-74597 - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} * CVE-2026-74587 - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} * CVE-2026-72491 - net/9p: fix race condition on rdma->state in trans_rdma.c {CVE-2026-72491} * CVE-2026-80619 - apparmor: fix potential UAF in aa_replace_profiles {CVE-2026-80619} * CVE-2026-64548 - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} * CVE-2026-74499 - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} * CVE-2026-68365 - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} * CVE-2026-68320 - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} * CVE-2026-74498 - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} * CVE-2026-74682 - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} * CVE-2026-72226 - batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226} * CVE-2026-74469 - sctp: prevent peer transport count overflow {CVE-2026-74469} * CVE-2026-74287 - sctp: validate embedded address parameter length {CVE-2026-74287} * CVE-2026-63887 - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} * CVE-2026-90413 - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} * Miscellaneous upstream changes - net: rose: fix a typo in rose_clear_routes() - lockdep: fix build of the preemption assertion macros on 5.4 * Bump ABI 5.4.0-239