* CVE-2026-99999 - ipv4: validate checksum_start before completing checksum {CVE-2026-99999} * CVE-2026-43250 - usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() {CVE-2026-43250} * CVE-2026-43281 - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281} * CVE-2025-38595 - xen: fix UAF in dmabuf_exp_from_pages() {CVE-2025-38595} * CVE-2026-89610 - ntfs: verify run length exceeding volume boundary {CVE-2026-89610} * CVE-2026-74540 - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} * CVE-2023-52935 - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935} * CVE-2026-64225 - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225} * CVE-2026-31489 - spi: meson-spicc: Fix double-put in remove path {CVE-2026-31489} * CVE-2026-53068 - drm/komeda: fix integer overflow in AFBC framebuffer size check {CVE-2026-53068} * CVE-2026-64249 - fpga: region: fix use-after-free in child_regions_with_firmware() {CVE-2026-64249} * CVE-2026-64007 - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} * CVE-2026-98320 - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} * CVE-2026-98248 - arm64: percpu: Fix LSE operations on {8,16}-bit types {CVE-2026-98248} * CVE-2026-98375 - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} * CVE-2026-98312 - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} * CVE-2026-98269 - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} * CVE-2026-98194 - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} * CVE-2026-98354 - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} * CVE-2026-64015 - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} * CVE-2026-63800 - pNFS: Fix use-after-free in pnfs_update_layout() {CVE-2026-63800} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98348 - wifi: libipw: reject too-short association responses {CVE-2026-98348} * CVE-2026-98217 - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-64002 - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} * CVE-2026-52923 - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} * CVE-2026-98276 - net: lock the socket in sock_gettstamp() {CVE-2026-98276} * CVE-2026-63967 - iio: imu: st_lsm6dsx: fix stack leak in tagged FIFO buffer {CVE-2026-63967} * CVE-2026-63912 - xfrm: esp: restore combined single-frag length gate {CVE-2026-63912} * CVE-2026-98193 - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} * CVE-2026-98185 - wifi: mwifiex: validate scan response extents {CVE-2026-98185} * CVE-2026-98171 - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} * CVE-2026-97540 - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} * CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} * CVE-2026-97908 - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908} * CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} * CVE-2026-93817 - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} * CVE-2026-98017 - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} * CVE-2026-98019 - bpf: mark a NULL call argument precise {CVE-2026-98019} * CVE-2026-97940 - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} * CVE-2026-97949 - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97935 - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} * CVE-2026-93781 - scsi: core: Do not block on tag allocation in scsi_eh_lock_door() {CVE-2026-93781} * CVE-2026-97904 - cpufreq: initialize policy rwsem before sysfs publication {CVE-2026-97904} * CVE-2026-97427 - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} * CVE-2026-98160 - staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init() {CVE-2026-98160} * CVE-2026-97532 - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path {CVE-2026-97532} * CVE-2026-97565 - smb: client: reject short READ responses in CIFSSMBRead() {CVE-2026-97565} * CVE-2026-93785 - cifs: validate idmap key payload length {CVE-2026-93785} * CVE-2026-97509 - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} * CVE-2026-93816 - f2fs: validate inline dentry name lengths before conversion {CVE-2026-93816} * CVE-2026-93799 - wifi: iwlwifi: mvm: validate sta_id in BA window status notif {CVE-2026-93799} * CVE-2026-93791 - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} * CVE-2026-97598 - ipv4: fib: bound automatic table ID allocation {CVE-2026-97598} * CVE-2026-93789 - wifi: iwlwifi: bound aligned TLV advance in FW parser {CVE-2026-93789} * CVE-2026-98077 - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} * CVE-2026-98027 - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-97572 - bnxt_en: Propagate RX ring init failures in bnxt_init_nic() {CVE-2026-97572} * CVE-2026-97910 - ASoC: sprd: validate compress buffer sizes against fixed allocations {CVE-2026-97910} * CVE-2026-98015 - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} * CVE-2026-97601 - ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink {CVE-2026-97601} * CVE-2026-97539 - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} * CVE-2026-98096 - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} * CVE-2026-97596 - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} * CVE-2026-97923 - tracing: Free histogram the var ref when its initialization fails {CVE-2026-97923} * CVE-2026-93803 - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} * CVE-2026-93286 - net: appletalk: fix NULL pointer dereference in aarp_send_ddp() {CVE-2026-93286} * CVE-2026-93213 - of: fix out-of-bounds read in of_alias_scan() stem parser {CVE-2026-93213} * CVE-2026-93802 - wifi: rsi: validate beacon length before fixed buffer copy {CVE-2026-93802} * CVE-2026-93797 - wifi: iwlwifi: mvm: fix an off-by-1 boundary check {CVE-2026-93797} * CVE-2026-93206 - PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206} * CVE-2026-93262 - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} * CVE-2026-97448 - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} * CVE-2026-97408 - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} * CVE-2026-90045 - USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045} * CVE-2026-90204 - ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204} * Bump ABI 5.4.0-241