* CVE-2026-74480 - net: bridge: stop fast-leave after deleting a port group {CVE-2026-74480} * CVE-2026-74581 - net: ipv6: clear suppressed fib6 rule result {CVE-2026-74581} * CVE-2026-80714 - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} * CVE-2026-43503 - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-43503} * CVE-2026-98357 - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} * CVE-2026-98222 - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} * CVE-2026-98383 - bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL {CVE-2026-98383} * CVE-2026-68137 - net/x25: fix use-after-free in x25_kill_by_neigh() {CVE-2026-68137} * CVE-2026-64312 - crypto: pcrypt - restore callback for non-parallel fallback {CVE-2026-64312} * CVE-2026-63948 - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn {CVE-2026-63948} * CVE-2026-74267 - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen {CVE-2026-74267} * CVE-2026-93795 - blk-cgroup: fix leaks and online flag on radix_tree_insert failure {CVE-2026-93795} * CVE-2026-97535 - scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size {CVE-2026-97535} * CVE-2026-93794 - smb/client: flush dirty data before punching a hole {CVE-2026-93794} * CVE-2026-93787 - smb: client: bound dirent name against end of SMB response in cifs_filldir {CVE-2026-93787} * CVE-2026-97557 - smb: client: avoid leaking refcount in cifs_queue_oplock_break() {CVE-2026-97557} * CVE-2026-97582 - hwmon: (gpio-fan) Fix use-after-free in alarm work {CVE-2026-97582} * CVE-2026-93792 - wifi: iwlwifi: mvm: fix a possible underflow {CVE-2026-93792} * CVE-2026-97541 - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} * CVE-2026-93268 - ext4: skip extra isize expansion during mount to prevent deadlock {CVE-2026-93268} * CVE-2026-93226 - ipv6: use RCU iterator to dump route exceptions {CVE-2026-93226} * CVE-2026-93782 - vhost-scsi: flush backend after device ioctls {CVE-2026-93782} * CVE-2026-93287 - i2c: smbus: reject oversized block transfers in the common path {CVE-2026-93287} * CVE-2026-93264 - RDMA/efa: Fix PBL chunk length computation {CVE-2026-93264} * CVE-2026-90002 - ftrace: Take trace_array reference before accessing its ftrace_ops {CVE-2026-90002} * CVE-2026-90223 - nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223} * CVE-2026-80905 - net: tap: fix wrong transport_header when sending VLAN-tagged frame {CVE-2026-80905} * CVE-2026-80783 - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783} * CVE-2026-52955 - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} * Miscellaneous upstream changes - net: skbuff: propagate shared-frag marker in skb_zerocopy() * Bump ABI 5.4.0-242