* CVE-2026-46267 - nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267} * CVE-2026-53004 - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} * CVE-2026-98716 - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} * CVE-2026-98714 - KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded {CVE-2026-98714} * CVE-2026-98715 - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715} * CVE-2026-98662 - iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662} * CVE-2026-98430 - RDMA/efa: Keep admin queues alive while IRQ is registered {CVE-2026-98430} * CVE-2026-98769 - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769} * CVE-2026-98764 - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764} * CVE-2026-98763 - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763} * CVE-2026-46064 - ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064} * CVE-2026-98621 - net: gue: reject invalid REMCSUM offsets {CVE-2026-98621} * CVE-2026-98636 - squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636} * CVE-2026-98771 - usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771} * CVE-2026-98772 - USB: serial: fix port tear down use-after-free {CVE-2026-98772} * CVE-2026-53149 - thunderbolt: Bound root directory content to block size {CVE-2026-53149} * CVE-2026-46163 - wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163} * CVE-2026-52962 - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} * CVE-2026-98386 - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386} * CVE-2026-45916 - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916} * CVE-2026-98555 - llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555} * CVE-2023-54243 - netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243} * CVE-2026-53255 - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} * CVE-2026-98409 - watchdog: rtd119x: Avoid division by zero {CVE-2026-98409} * CVE-2026-98598 - ipv6: Prevent rt6_insert_exception() for dying fib6_info. {CVE-2026-98598} * CVE-2026-53392 - NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392} * CVE-2026-98422 - wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown {CVE-2026-98422} * CVE-2026-98393 - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393} * CVE-2026-53129 - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} * CVE-2023-53794 - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794} * CVE-2026-98494 - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494} * CVE-2026-98428 - ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428} * CVE-2026-53157 - net: phonet: free phonet_device after RCU grace period {CVE-2026-53157} * CVE-2026-98709 - wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709} * CVE-2026-98614 - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} * CVE-2026-98811 - net/sched: cls_api: reclaim an empty proto on the error path {CVE-2026-98811} * CVE-2026-43042 - mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042} * CVE-2026-98679 - iio: accel: kxcjk-1013: reject duplicate event disable {CVE-2026-98679} * CVE-2022-50860 - apparmor: Fix memleak in alloc_ns() {CVE-2022-50860} * CVE-2026-98535 - fsl/fman: Fix clk reference leak in read_dts_node() {CVE-2026-98535} * CVE-2026-98544 - bna: prevent IOC timer rearm during teardown {CVE-2026-98544} * CVE-2026-98594 - tg3: clean up PHYLIB resources on probe failure {CVE-2026-98594} * CVE-2026-98798 - net: bcmgenet: fix NULL dereference in set_coalesce before first open {CVE-2026-98798} * CVE-2026-98808 - net: systemport: Fix buffer overflow in bcm_sysport_get_stats() {CVE-2026-98808} * CVE-2026-98838 - vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838} * CVE-2026-98753 - tty: tty_port: restore TTY_IO_ERROR on activation failure {CVE-2026-98753} * CVE-2026-98749 - tty: serial: max3100: shut down timer before freeing port {CVE-2026-98749} * CVE-2026-98750 - tty: fix saved termios reset race {CVE-2026-98750} * CVE-2026-98694 - thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694} * CVE-2026-98634 - scsi: sd_zbc: Reject disks with too many zones {CVE-2026-98634} * CVE-2026-98831 - of/overlay: don't leak fragment references when changeset init fails {CVE-2026-98831} * CVE-2026-98855 - of/overlay: put property on deadprops only after changeset add succeeds {CVE-2026-98855} * CVE-2026-98582 - nfc: st21nfca: validate received frame size {CVE-2026-98582} * CVE-2026-98687 - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} * CVE-2026-98479 - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU {CVE-2026-98479} * CVE-2026-98726 - nvme-multipath: fix underflow in ANA log bounds checks {CVE-2026-98726} * CVE-2026-98578 - nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578} * CVE-2026-98481 - nfc: port100: reject frames whose declared length exceeds the received data {CVE-2026-98481} * CVE-2026-98583 - nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583} * CVE-2026-98710 - wifi: iwlegacy: 3945: free EEPROM data on remove {CVE-2026-98710} * CVE-2026-98568 - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} * CVE-2026-98862 - audit: fix exe mark UAF in kill_rules() {CVE-2026-98862} * CVE-2026-98738 - Bluetooth: Serialize SMP remote OOB data access {CVE-2026-98738} * CVE-2026-98853 - net: gso: limit recursive IP-in-IP segmentation {CVE-2026-98853} * CVE-2026-98449 - smb: client: delete compound mids on send failure before unlock {CVE-2026-98449} * CVE-2026-98454 - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} * CVE-2026-98451 - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} * CVE-2026-98457 - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} * CVE-2026-98581 - nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581} * CVE-2026-98579 - nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579} * CVE-2026-98850 - net/packet: prevent TX_RING byte count overflow {CVE-2026-98850} * CVE-2026-98490 - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} * CVE-2026-98794 - ipvs: filter some flags received in the backup server {CVE-2026-98794} * CVE-2026-98507 - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish {CVE-2026-98507} * CVE-2026-98856 - kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856} * CVE-2026-98456 - Bluetooth: mgmt: fix race in read_unconf_index_list() {CVE-2026-98456} * CVE-2026-98734 - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown {CVE-2026-98734} * CVE-2026-98824 - wifi: mac80211: validate TX status rate metadata {CVE-2026-98824} * CVE-2026-98704 - wifi: mac80211: keep fallback association elements alive {CVE-2026-98704} * CVE-2026-98705 - wifi: mac80211: account proxy paths against the mesh path limit {CVE-2026-98705} * CVE-2026-98822 - wifi: mac80211: prevent AP VLAN tx from other interfaces {CVE-2026-98822} * CVE-2026-98829 - wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829} * CVE-2026-98742 - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} * CVE-2026-98586 - sctp: hold asoc or transport before mod_timer() in timer handlers {CVE-2026-98586} * CVE-2026-46119 - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} * CVE-2026-72123 - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF {CVE-2026-72123} * CVE-2026-53354 - arm64: errata: Mitigate TLBI errata on various Arm CPUs {CVE-2026-53354} - UBUNTU: [Config] Set ARM64_ERRATUM_4118414=y {CVE-2026-53354} * CVE-2026-98175 - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} * CVE-2026-97938 - reboot: fix cad_pid use-after-free race {CVE-2026-97938} * CVE-2026-97600 - ieee802154: cc2520: fix FIFOP work use-after-free {CVE-2026-97600} * CVE-2026-93826 - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} * CVE-2026-93828 - exfat: fix handling of damaged volume in exfat_create_upcase_table() {CVE-2026-93828} * CVE-2026-64096 - batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096} * CVE-2025-68283 - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} * CVE-2026-53399 - nfsd: release layout stid on setlease failure {CVE-2026-53399} * CVE-2026-63796 - ocfs2: reject oversized group bitmap descriptors {CVE-2026-63796} * CVE-2025-40158 - ipv6: use RCU in ip6_output() {CVE-2025-40158} * CVE-2025-40135 - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} * CVE-2023-53781 - smc: Fix use-after-free in tcp_write_timer_handler(). {CVE-2023-53781} * CVE-2025-40064 - smc: Fix use-after-free in __pnet_find_base_ndev(). {CVE-2025-40064} * CVE-2026-98499 - HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() {CVE-2026-98499} * CVE-2026-98666 - iio: gyro: adis16136: fix unprotected debugfs reads {CVE-2026-98666} * CVE-2026-98757 - usb: cdns3: fix use-after-free in cdns3_gadget_exit() {CVE-2026-98757} * CVE-2026-98460 - Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460} * CVE-2026-98537 - workqueue: Fix NULL current_pwq deref in flush dependency check {CVE-2026-98537} * CVE-2026-98567 - net: xps: reject an out of range traffic class {CVE-2026-98567} * CVE-2026-98739 - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} * CVE-2026-98602 - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602} * CVE-2026-98707 - wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707} * CVE-2026-98547 - af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547} * CVE-2026-98701 - wifi: mac80211: release mesh path quota on failed additions {CVE-2026-98701} * CVE-2026-98524 - rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524} * CVE-2026-98836 - ALSA: line6: reject oversized playback packets {CVE-2026-98836} * CVE-2026-98489 - net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489} * CVE-2026-98488 - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488} * CVE-2026-98565 - net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 {CVE-2026-98565} * CVE-2026-98665 - iio: health: max30102: fix NULL dereference in interrupt handler {CVE-2026-98665} * CVE-2026-64047 - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring {CVE-2026-64047} * CVE-2026-53136 - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} * CVE-2026-53374 - drm/amdgpu: zero-initialize GART table on allocation {CVE-2026-53374} * CVE-2023-53751 - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751} * CVE-2026-46195 - smb: client: validate dacloffset before building DACL pointers {CVE-2026-46195} * CVE-2026-46191 - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} * CVE-2026-46135 - nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135} * CVE-2026-46180 - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} * CVE-2026-53195 - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} * CVE-2026-46122 - wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122} * CVE-2026-45994 - ibmasm: fix OOB reads in command_file_write due to missing size checks {CVE-2026-45994} * CVE-2026-46294 - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} * CVE-2026-53388 - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} * CVE-2025-71073 - Input: lkkbd - disable pending work before freeing device {CVE-2025-71073} * CVE-2026-64303 - spi: fsl-lpspi: terminate the RX channel on TX prepare failure path {CVE-2026-64303} * CVE-2026-64361 - hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length {CVE-2026-64361} * CVE-2026-98266 - ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266} * CVE-2026-53273 - tee: optee: prevent use-after-free when the client exits before the supplicant {CVE-2026-53273} * CVE-2026-64584 - usb: gadget: f_midi: cancel pending IN work before freeing the midi object {CVE-2026-64584} * CVE-2026-74546 - hwmon: (adt7470) Fix divide-by-zero TOCTOU crash in fan speed read {CVE-2026-74546} * CVE-2026-93239 - arm64: mm: Fix the lockless page-table walk in show_pte() {CVE-2026-93239} * CVE-2026-93784 - wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() {CVE-2026-93784} * CVE-2026-97455 - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} * CVE-2026-93808 - ALSA: usb-audio: caiaq: validate EP1 reply lengths {CVE-2026-93808} * CVE-2026-90013 - tracing: Take trace_array reference when opening options file {CVE-2026-90013} * CVE-2026-90337 - serial: core: do fallible allocations before the console can be registered {CVE-2026-90337} * CVE-2026-90435 - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} * CVE-2026-90433 - spi: oc-tiny: switch to managed controller allocation {CVE-2026-90433} * CVE-2026-90189 - null_blk: register configfs subsystem after creating default devices {CVE-2026-90189} * CVE-2026-93183 - drm/lima: call drm_mm_init() with a valid allocation range {CVE-2026-93183} * CVE-2026-90029 - usb: storage: realtek_cr: fix use-after-free on disconnect {CVE-2026-90029} * CVE-2026-90343 - wifi: cfg80211: stop PMSR before P2P and NAN teardown {CVE-2026-90343} * CVE-2026-90072 - net/sched: sfq: clamp quantum to avoid signed overflow soft lockup {CVE-2026-90072} * CVE-2026-89987 - mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987} * CVE-2024-56592 - bpf: Call free_htab_elem() after htab_unlock_bucket() {CVE-2024-56592} * CVE-2025-68342 - can: gs_usb: gs_usb_receive_bulk_callback(): check actual_length before accessing data {CVE-2025-68342} * CVE-2026-74730 - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} * CVE-2026-23112 - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112} * CVE-2026-98610 - net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610} * CVE-2026-98624 - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624} * CVE-2026-98823 - wifi: cfg80211: preserve hidden-group beacon IE ownership {CVE-2026-98823} * CVE-2026-98846 - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} * CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} * CVE-2026-98851 - netfilter: nft_flow_offload: drop flowtable reference on init error path {CVE-2026-98851} * CVE-2026-98706 - wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706} * CVE-2026-98698 - wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698} * CVE-2026-98577 - nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577} * CVE-2026-98482 - nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482} * CVE-2026-98576 - nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576} * CVE-2026-98708 - wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708} * CVE-2026-98569 - ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569} * CVE-2026-98541 - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541} * CVE-2026-98816 - bpf: Fix overflow of jump offset in constant blinding {CVE-2026-98816} * CVE-2026-98491 - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491} * CVE-2026-98526 - llc: reserve device headroom for allocated frames {CVE-2026-98526} * CVE-2026-98531 - ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST {CVE-2026-98531} * CVE-2026-98532 - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} * CVE-2026-98573 - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573} * CVE-2026-98461 - Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461} * CVE-2026-98681 - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681} * CVE-2026-98696 - USB: serial: fix driver deregistration order {CVE-2026-98696} * CVE-2026-98697 - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} * CVE-2026-98597 - net: usb: sr9700: include receive overhead in the length check {CVE-2026-98597} * CVE-2026-98612 - net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612} * CVE-2026-98663 - iio: imu: adis16480: fix unprotected debugfs reads {CVE-2026-98663} * CVE-2026-98511 - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() {CVE-2026-98511} * CVE-2026-98657 - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657} * CVE-2026-98516 - drm/nouveau: Fix bridge reference leak in nv1a_ram_new() {CVE-2026-98516} * CVE-2026-98413 - selinux: always fill AVC decision in avc_has_perm_noaudit() {CVE-2026-98413} * CVE-2026-98425 - wifi: mac80211: don't warn when an IBSS has no channel to scan {CVE-2026-98425} * CVE-2026-64114 - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} * CVE-2026-98427 - net/sched: codel: bound the dropping loop per dequeue call {CVE-2026-98427} * CVE-2026-31393 - Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access {CVE-2026-31393} * CVE-2026-53303 - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() {CVE-2026-53303} * CVE-2026-98419 - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419} * CVE-2026-53397 - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} * CVE-2026-45920 - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} * CVE-2023-54067 - btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067} * CVE-2026-43180 - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180} * CVE-2026-46022 - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() {CVE-2026-46022} * CVE-2026-46189 - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} * CVE-2026-53356 - drm/i915/gem: Fix phys BO pread/pwrite with offset {CVE-2026-53356} * CVE-2025-38129 - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129} * CVE-2026-93829 - smb: client: fix races in cifsd thread creation {CVE-2026-93829} * CVE-2026-52998 - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} * Miscellaneous upstream changes - rose: clear neighbour pointer after rose_neigh_put() in state machines * Bump ABI 5.4.0-243