* CVE-2026-90205 - ocfs2: validate orphan slot during inode read {CVE-2026-90205} * CVE-2026-93054 - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} * CVE-2026-93103 - RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103} * CVE-2026-89833 - f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833} * CVE-2026-89878 - media: s2255: check firmware size before reading trailing marker {CVE-2026-89878} * CVE-2026-90037 - NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037} * CVE-2026-90296 - cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296} * CVE-2026-90415 - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} * CVE-2026-90081 - net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081} * CVE-2026-90420 - nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420} * CVE-2026-90116 - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} * CVE-2026-90070 - tpm: st33zp24: Return zero on status read failure {CVE-2026-90070} * CVE-2026-89845 - scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845} * CVE-2026-89944 - ASoC: hdac_hda: Fix hlink refcount leak on component registration failure {CVE-2026-89944} * CVE-2026-90018 - staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() {CVE-2026-90018} * CVE-2026-89860 - scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860} * CVE-2026-90007 - scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007} * CVE-2026-90044 - usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044} * CVE-2026-68289 - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} * CVE-2026-90143 - net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143} * CVE-2026-90111 - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} * CVE-2026-90283 - hugetlbfs: release subpool on fill_super failure {CVE-2026-90283} * CVE-2026-92521 - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} * CVE-2026-93048 - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} * CVE-2026-93160 - crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160} * CVE-2026-93199 - i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199} * CVE-2026-89953 - mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953} * CVE-2026-89822 - drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822} * CVE-2026-89937 - iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937} * CVE-2026-89993 - dmaengine: dw-edma: Initialize IRQ data before requesting IRQs {CVE-2026-89993} * CVE-2026-89972 - nvme: add missing SRCU grace period in error path {CVE-2026-89972} * CVE-2026-89892 - media: em28xx: defer audio-only extension registration {CVE-2026-89892} * CVE-2026-90023 - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023} * CVE-2026-90020 - USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020} * CVE-2026-90017 - staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017} * CVE-2026-90016 - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016} * CVE-2026-90329 - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} * CVE-2026-90202 - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers {CVE-2026-90202} * CVE-2026-93041 - dmaengine: dw-edma: Serialize abort state updates {CVE-2026-93041} * CVE-2026-90068 - ASoC: dapm: Fix off-by-one check on the second enum channel {CVE-2026-90068} * CVE-2026-90327 - phonet: pep: do not write beyond optlen in getsockopt {CVE-2026-90327} * CVE-2026-90292 - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} * CVE-2026-90203 - Squashfs: check block offset is not negative {CVE-2026-90203} * CVE-2026-93108 - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} * CVE-2026-90104 - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} * CVE-2026-90295 - cpufreq: imx6q: fix out-of-bounds write when probed more than once {CVE-2026-90295} * CVE-2026-90103 - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} * CVE-2026-90054 - tcp: fix corruption of urgent data on multi-segment retransmit {CVE-2026-90054} * CVE-2026-90335 - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} * CVE-2026-90382 - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} * CVE-2026-93055 - UDF symlink pathComponent header OOB read {CVE-2026-93055} * CVE-2026-90336 - serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336} * CVE-2026-90394 - power: supply: sc2731_charger: cancel work on remove {CVE-2026-90394} * CVE-2026-90297 - drm/sun4i: crtc: Propagate layer initialization error {CVE-2026-90297} * CVE-2026-93067 - drm/bridge: tc358767: clamp the reported AUX read size to the request {CVE-2026-93067} * CVE-2026-89816 - drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used {CVE-2026-89816} * CVE-2026-89852 - scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() {CVE-2026-89852} * CVE-2026-89979 - ALSA: pcm: Fix race between non-atomic ops and trigger-start {CVE-2026-89979} * CVE-2026-89859 - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859} * CVE-2026-89855 - scsi: qla2xxx: Serialize flash version read in reset handler {CVE-2026-89855} * CVE-2026-90031 - usb-storage: ene_ub6250: fix race between scan work and probe {CVE-2026-90031} * CVE-2026-89872 - media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link {CVE-2026-89872} * CVE-2026-89969 - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969} * CVE-2026-90033 - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} * CVE-2026-89899 - media: cec: disable delayed work before freeing an interrupted transmit {CVE-2026-89899} * CVE-2026-90011 - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} * CVE-2026-89997 - dm: fix resume-vs-remove race {CVE-2026-89997} * CVE-2026-90019 - usb: gadget: fix null pointer dereference in usb_put_function_instance() {CVE-2026-90019} * CVE-2026-89832 - f2fs: fix to clear dirty flag on folio in error path {CVE-2026-89832} * CVE-2026-90025 - usb: typec: ucsi: displayport: Fix OOB altmode array index {CVE-2026-90025} * CVE-2026-93110 - RDMA/core: Wait for RCU callbacks before unloading ib_core {CVE-2026-93110} * CVE-2026-90049 - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} * CVE-2026-93072 - irqchip/renesas-irqc: Fix generic interrupt chip leak on remove {CVE-2026-93072} * CVE-2026-90395 - power: supply: isp1704_charger: cancel work on remove {CVE-2026-90395} * CVE-2026-93049 - mtd: mtdswap: Avoid freeing registered blktrans device twice {CVE-2026-93049} * CVE-2026-93141 - usb: gadget: r8a66597: avoid double free of ep0_req in probe error path {CVE-2026-93141} * CVE-2026-90434 - isofs: release zisofs block pointer buffer head {CVE-2026-90434} * CVE-2026-90285 - scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path {CVE-2026-90285} * CVE-2026-89893 - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} * CVE-2026-89982 - i2c: mux: Fix channel node leak on adapter add failure {CVE-2026-89982} * CVE-2026-89895 - media: cobalt: Avoid freeing ALSA private data twice {CVE-2026-89895} * CVE-2022-49157 - scsi: qla2xxx: Fix premature hw access after PCI error {CVE-2022-49157} * CVE-2023-54081 - xen: speed up grant-table reclaim {CVE-2023-54081} * CVE-2024-56565 - f2fs: fix to drop all discards after creating snapshot on lvm device {CVE-2024-56565} * CVE-2025-68778 - btrfs: don't log conflicting inode if it's a dir moved in the current transaction {CVE-2025-68778} * CVE-2025-68324 - scsi: imm: Fix use-after-free bug caused by unfinished delayed work {CVE-2025-68324} * CVE-2025-40107 - can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled {CVE-2025-40107} * CVE-2026-80991 - net: ravb: serialize PTP clock teardown {CVE-2026-80991} * CVE-2026-89552 - params: fix charp corruption on allocation failure {CVE-2026-89552} * CVE-2026-80766 - HID: uclogic: fix use-after-free of inrange_timer on remove {CVE-2026-80766} * CVE-2026-80796 - nfc: nci: add data_len bound checks to activation parameter extractors {CVE-2026-80796} * CVE-2026-80863 - RDMA/rxe: Fix OOB in free_rd_atomic_resources() {CVE-2026-80863} * CVE-2026-80864 - RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp {CVE-2026-80864} * CVE-2026-80755 - selinux: reject a permission value exceeding the class permission count {CVE-2026-80755} * CVE-2025-68759 - wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() {CVE-2025-68759} * CVE-2023-53850 - iavf: use internal state to free traffic IRQs {CVE-2023-53850} * CVE-2023-54001 - staging: r8712: Fix memory leak in _r8712_init_xmit_priv() {CVE-2023-54001} * CVE-2025-68343 - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing header {CVE-2025-68343} * CVE-2023-54281 - btrfs: release path before inode lookup during the ino lookup ioctl {CVE-2023-54281} * CVE-2026-63891 - thunderbolt: property: Cap recursion depth in __tb_property_parse_dir() {CVE-2026-63891} * CVE-2025-39995 - media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe {CVE-2025-39995} * CVE-2023-54287 - tty: serial: imx: disable Ageing Timer interrupt request irq {CVE-2023-54287} * CVE-2026-63933 - iio: gyro: adis16260: fix division by zero in write_raw {CVE-2026-63933} * CVE-2026-80765 - HID: hyperv: validate initial device info bounds {CVE-2026-80765} * CVE-2026-80890 - sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890} * CVE-2025-68733 - smack: fix bug: unprivileged task can create labels {CVE-2025-68733} * CVE-2026-89539 - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539} * CVE-2026-80800 - nfc: llcp: bound the connect_sn TLV walk to the skb {CVE-2026-80800} * CVE-2026-63916 - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} * CVE-2026-80918 - HID: core: fix number/pointer type confusion on long items {CVE-2026-80918} * CVE-2026-80827 - USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827} * CVE-2026-80795 - nfc: nci: fix out-of-bounds write in nci_target_auto_activated() {CVE-2026-80795} * CVE-2026-74410 - wifi: rtw88: fix OOB read from firmware RX descriptor exceeding DMA buffer {CVE-2026-74410} * CVE-2026-80743 - ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers {CVE-2026-80743} * CVE-2026-80793 - ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793} * CVE-2026-80767 - HID: sensor: custom: Fix use-after-free in enable_sensor {CVE-2026-80767} * CVE-2026-80803 - nfc: digital: clamp SENSF_RES length to the destination buffer {CVE-2026-80803} * CVE-2026-80790 - nvmet-fc: fix invalid free in LS IOD error path {CVE-2026-80790} * CVE-2026-74293 - ASoC: fsl: fsl_audmix: Validate written enum values {CVE-2026-74293} * CVE-2026-80802 - nfc: fdp: bound the device-reported read length and fix an skb leak {CVE-2026-80802} * CVE-2026-80829 - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829} * CVE-2026-80902 - dmaengine: sun6i-dma: Fix reclaim descriptors while terminating DMA {CVE-2026-80902} * CVE-2026-80826 - USB: c67x00: fix use-after-free in c67x00_add_iso_urb() {CVE-2026-80826} * CVE-2026-80781 - HID: core: fix OOB read of field->usage in hid_set_field() {CVE-2026-80781} * CVE-2026-80881 - ocfs2: fix buffer head management in ocfs2_read_blocks() {CVE-2026-80881} * CVE-2026-80754 - Input: synaptics-rmi4 - fix F55 transmitter electrode count typo {CVE-2026-80754} * CVE-2026-63905 - usbip: vudc: Fix use after free bug in vudc_remove due to race condition {CVE-2026-63905} * CVE-2025-68804 - platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver {CVE-2025-68804} * CVE-2026-89530 - svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530} * CVE-2026-74672 - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF {CVE-2026-74672} * CVE-2026-68329 - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} * CVE-2026-80576 - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} * CVE-2026-80671 - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON {CVE-2026-80671} * CVE-2026-72398 - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} * CVE-2026-80599 - batman-adv: dat: ensure accessible eth_hdr proto field {CVE-2026-80599} * CVE-2026-89654 - ceph: fix UAF in check_new_map() on session freed during unlock {CVE-2026-89654} * CVE-2026-74378 - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe {CVE-2026-74378} * CVE-2026-74268 - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} * CVE-2026-74641 - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} * CVE-2026-63815 - f2fs: bound i_inline_xattr_size for non-inline-xattr inodes {CVE-2026-63815} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-89542 - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} * CVE-2026-74725 - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} * CVE-2026-74350 - ocfs2: validate fast symlink target during inode read {CVE-2026-74350} * CVE-2026-89671 - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} * CVE-2026-89723 - nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation {CVE-2026-89723} * CVE-2026-64363 - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} * CVE-2026-43421 - usb: gadget: f_ncm: Fix net_device lifecycle with device_move {CVE-2026-43421} * CVE-2026-53075 - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} * CVE-2026-53059 - dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059} * CVE-2026-46259 - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} * CVE-2026-43232 - net: wan: farsync: Fix use-after-free bugs caused by unfinished tasklets {CVE-2026-43232} * CVE-2026-64095 - batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095} * CVE-2026-43075 - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075} * CVE-2026-43076 - ocfs2: validate inline data i_size during inode read {CVE-2026-43076} * CVE-2025-21812 - ax25: rcu protect dev->ax25_ptr {CVE-2025-21812} * CVE-2025-40349 - hfs: validate record offset in hfsplus_bmap_alloc {CVE-2025-40349} * CVE-2025-68266 - bfs: Reconstruct file type when loading from disk {CVE-2025-68266} * CVE-2026-31788 - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788} * CVE-2026-31402 - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} * CVE-2026-93200 - i3c: master: Fix use-after-free of master->this {CVE-2026-93200} * CVE-2026-23125 - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125} * CVE-2024-57896 - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount {CVE-2024-57896} * CVE-2023-53432 - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} * CVE-2023-53680 - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680} * CVE-2026-90090 - Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path {CVE-2026-90090} * CVE-2022-48792 - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task {CVE-2022-48792} * CVE-2023-53111 - loop: Fix use-after-free issues {CVE-2023-53111} * CVE-2025-71093 - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} * CVE-2026-23001 - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001} * CVE-2026-23076 - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} * CVE-2024-56604 - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604} * CVE-2026-23235 - f2fs: fix out-of-bounds access in sysfs attribute read/write {CVE-2026-23235} * CVE-2026-90286 - drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286} * CVE-2026-22998 - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} * CVE-2024-42120 - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120} * CVE-2026-23099 - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} * Miscellaneous upstream changes - staging: rtl8712: fix potential memory leak - staging: rtl8712: check for return value of _r8712_init_xmit_priv() - perf sched: Replace BUG_ON and add NULL checks in replay event helpers - sctp: sm_statefuns: Fix spelling mistakes - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check - rose: guard rose_neigh_put() against NULL in timer expiry - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() - ip6: vti: Use ip6_tnl.net in vti6_changelink(). - smb: client: harden DFS cache against invalid target hints * Bump ABI 5.4.0-240