- Update to upstream stable Linux 5.10.273 - netfilter: nf_tables: wait for an RCU grace period on the flowtable transaction error path {CVE-2026-23392} - netfilter: nf_tables: unconditionally bump set->nelems before insertion {CVE-2026-23272} - netfilter: nf_tables: always increment set element count - Revert "netfilter: nf_tables: always increment set element count" - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419} - loop: Fix use-after-free issues {CVE-2023-53111} - xfrm: prevent policy_hthresh.work from racing with netns teardown - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589} - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} - nvme-tcp: Do not reset transport on data digest errors - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} - nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t() - Revert "nvme-tcp: fix host memory disclosure on R2T for a read command" - Revert "nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}" - signal: don't retarget shared signals in a dying thread group - KEYS: Fix key_reject_and_link() race with keyring restriction {CVE-2026-99245} - keys: Protect the read method check against type removal {CVE-2026-99222} - keys: make keyring indexes independent of kernel addresses {CVE-2026-99223} - keys: Protect the type name while describing a key {CVE-2026-99224} - keys: Check the authorization payload in process keyring searches {CVE-2026-99225} - keys: Avoid the owner account dereference in named keyring lookup {CVE-2026-99226} - tracing: Fix 64-bit and signed histogram fields on 32-bit kernels - tracing: Unregister field variable histograms when the command fails {CVE-2026-99234} - tracing: Save the event file instead of the compatible histogram {CVE-2026-99235} - tracing: Reject incomplete event filter expressions {CVE-2026-99236} - Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn {CVE-2026-99239} - Bluetooth: L2CAP: access chan->conn safely in get/setsockopt {CVE-2026-90093} - net_sched: codel: fix stale state for empty flows in fq_codel - Revert "netfilter: nf_tables: unconditionally bump set->nelems before insertion" - Revert "net: bonding: fix use-after-free in bond_xmit_broadcast()" - xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf {CVE-2026-99132} - cifs: add revalidation on FSCTL failure in smb2_duplicate_extents() - dm-integrity: fix infinite loop on discard with large tag size {CVE-2026-99135} - drm/i915/dmc: Harden DMC firmware payload parsing {CVE-2026-99118} - futex: Fix mm reuse handling for FUT_OFF_MMSHARED {CVE-2026-99169} - i2c: viai2c-wmt: Fix clock leak in wmt_i2c_probe() {CVE-2026-99161} - net: bridge: mcast: don't truncate the port group walk on teardown {CVE-2026-99117} - ipv4: udp: Create exceptions before socket matching {CVE-2026-99077} - dm-integrity: require stable writes for internal hash modes - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - Revert "netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}" - mm/huge_memory: transfer the pmd dirty bit to the folio on zap {CVE-2026-89987} - Input: byd - synchronize timer deletion before freeing private data {CVE-2026-80572} - unicode: free the map after a grace period {CVE-2026-99180} - watch_queue: Fix note pool publication race in watch_queue_set_size() {CVE-2026-99179} - hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur {CVE-2025-21656} - KVM: arm64: vgic-its: Don't dereference a NULL collection on ITT save {CVE-2026-89912} - scsi: st: Fix use-after-free race between st_remove() and st_open() {CVE-2026-99156} - tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields {CVE-2026-99163} - net/sched: cls_flower: validate mask pointer after nla_next() {CVE-2026-99112} - KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots - OPP: Fix race between OPP addition and lookup {CVE-2026-74405} - Revert "OPP: Fix race between OPP addition and lookup" - net/sched: cls_u32: skip hash tables in u32_bind_class() {CVE-2026-74739} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - Revert "security/keys: fix missed RCU read section on lookup" - drm/amdgpu: Fix VCE 3 ring align_mask - mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF {CVE-2026-74672} - ipv4: avoid divide by zero in fib_rebalance {CVE-2026-99121} - s390/pci: Fix leak of uninitialized kernel data in SCLP report {CVE-2026-99124} - s390/ctcm: Prevent XID null dereference {CVE-2026-99126} - sctp: validate chunk length in the inqueue parser {CVE-2026-99128} - tipc: protect node reset trace dump with node lock {CVE-2026-99246} - dm-ebs: fix incorrect device offset check in ebs_ctr() - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} - dm cache: fix issue with background work locking {CVE-2026-99256} - dm cache: fix demotion stats in passthrough mode - tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) {CVE-2026-99138} - wifi: p54: validate firmware record lengths {CVE-2026-99100} - tracing: Fix the shift out of bounds in the log2 histogram modifier - drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr {CVE-2026-99150} - drm/amdgpu/sdma3: Work around POLL_REGMEM / FENCE hang - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} - scsi: libiscsi: Validate the ITT reflected in a Reject PDU {CVE-2026-99153} - scsi: libiscsi: Reject a negative task index from parse_pdu_itt {CVE-2026-99154} - i2c: qcom-cci: Fix HALT_ACK reset request being dropped - tools: gpio: fix building from the top level with O= - sctp: revalidate output stream after association connect wait {CVE-2026-99165} - net: rds: fix uninitialized trans dereference in CM event handler {CVE-2026-99166} - net/sched: fix use-after-free in __tcf_action_put() {CVE-2026-99167} - fsnotify: prevent mark additions during connector teardown {CVE-2026-99175} - KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry {CVE-2026-99176} - autofs: ignore notification errors from a replaced pipe {CVE-2026-99181} - netlink: avoid hashing the network namespace pointer {CVE-2026-99201} - net: initialize net->net_cookie at netns setup - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203} - exit: fix lost-update race on the child_subreaper bitfields - clone: add CLONE_AUTOREAP - samples: pidfd: fix userprogs typo - ocfs2/dlm: Protect the recovery list during debugfs reads {CVE-2026-99204} - scsi: target: iscsi: Fix race in discovery auth updates {CVE-2026-99206} - scsi: st: Save the visited block for the partition the drive is in - nios2: fix __wsum type degradation in csum_fold() - netlink: reset skb headers before unicast and multicast filtering {CVE-2026-99211} - netlink: Reverse the patch which removed filtering - netlink: remove netlink_broadcast_filtered - ASoC: nau8822: Fix the 128x oversampling switch bits - ASoC: wm8978: Fix the 128x oversampling switch bits - ASoC: max98371: Fix the Speaker DHT Min Volume bits - ASoC: pcm3168a: Fix the DAC zero flag polarity bit - ASoC: cs42l52: Fix the NG Type Switch bit - ASoC: cs42l56: Put the Limiter Cushion control on the limiter register - ASoC: stm32: spdifrx: fix synchronization state check - vsock: treat TCP_CLOSING as once-established {CVE-2026-99213} - Drivers: hv: Don't reset VMBus connection state on error/exit paths {CVE-2026-99216} - power: supply: ds2780: Fix ds2780_get_capacity() returning raw value - bpf: fix potential 32-bit overflow when accessing ARRAY map element {CVE-2022-50167} - skmsg: Skip zero length skb in sk_msg_recvmsg {CVE-2024-41048} - KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082} - Revert "KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082}" - xfs: fix unmount hang with unflushable inodes stuck in the AIL - xfs: factor out stale buffer item completion - xfs: rearrange code in xfs_buf_item.c - xfs: catch stale AGF/AGF metadata - xfs: xfs_ifree_cluster vs xfs_iflush_shutdown_abort deadlock - xfs: buffer pins need to hold a buffer reference - xfs: fix intermittent hang during quotacheck - xfs: fix super block buf log item UAF during force shutdown - xfs: remove xfs_buf_t typedef - xfs: aborting inodes on shutdown may need buffer lock - xfs: log items should have a xlog pointer, not a mount - xfs: convert XLOG_FORCED_SHUTDOWN() to xlog_is_shutdown() - xfs: don't nest icloglock inside ic_callback_lock - xfs: improve the code that checks recovered refcount intent items - xfs: hoist recovered refcount intent checks out of xfs_cui_item_recover - xfs: improve the code that checks recovered rmap intent items - xfs: hoist recovered rmap intent checks out of xfs_rui_item_recover - xfs: improve the code that checks recovered bmap intent items - xfs: hoist recovered bmap intent checks out of xfs_bui_item_recover - netfilter: nf_tables: fix crash when nf_trace is enabled - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc - namespace: handle mount locking for automounts correctly {CVE-2026-98977} - fcntl: refuse F_SET_RW_HINT on an immutable inode - namespace: don't copy an unmounted mount tree {CVE-2026-98992} - namespace: unhash a dentry before detaching the mounts on it {CVE-2026-98981} - drm/i915/gt: Unmask interrupts only when ACTIVE is true {CVE-2026-99005} - drm/fb-helper: defer setup when fbdev_probe() fails, not just on -EAGAIN {CVE-2026-99007} - scsi: ch: Do not keep references to data transfer element devices {CVE-2026-99019} - optee: register TEE devices only once fully initialized {CVE-2026-99024} - pmdomain: rockchip: propagate subdomain add errors - pmdomain: rockchip: don't ignore clock lookup errors on attach - pmdomain: rockchip: fix clock leak on domain probe failure - dm: fix reading free memory in do_resume {CVE-2026-99036} - highmem: round down the address passed to kunmap_flush_on_unmap() - Revert "highmem: round down the address passed to kunmap_flush_on_unmap()" - namespace: check the mounts before reading their parents in pivot_root() {CVE-2026-98985} - namespace: don't inherit MNT_UMOUNT in clone_mnt() {CVE-2026-98993} - drm/vmwgfx: validate pitch coming from userspace {CVE-2026-99002} - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex {CVE-2026-99009} - net: team: stop reusing skb after queue override {CVE-2026-99027} - net: team: fix NULL pointer dereference in team_xmit during mode change {CVE-2026-64190} - net: team: Rename port_disabled team mode op to port_tx_disabled - net: team: Remove unused team_mode_op, port_enabled - net: bridge: avoid recursive multicast port cleanup {CVE-2026-99031} - netfilter: nf_tables: fix bidirectional offload regression - Revert "netfilter: nf_tables: fix bidirectional offload regression" - mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge - mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP - EDAC/amd64: Mask UMC chip select to the four implemented selects - selinux: fix data race on AVC latest_notif - wifi: brcmfmac: fix P2P device removal race in brcmf_detach() {CVE-2026-99061} - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} - HID: steam: Clean up locking {CVE-2026-98943} - HID: steam: Refactor registration {CVE-2026-98944} - HID: steam: Rearrange teardown sequence {CVE-2026-98945} - HID: steam: Fully unregister controller when hidraw is opened - HID: hid-steam: Make client_opened a counter - HID: hid-steam: Fix cleanup in probe() - drm/amd/display: Don't replace a sink mode that shares the native totals - can: fix unique skb identifier regression under RPS - net: openvswitch: validate transport header presence in set_ipv6_addr {CVE-2026-99088} - net/mlx5e: Order ICOSQ cc update after CQ doorbell - flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect() {CVE-2026-98950} - flow_dissector: avoid u16 truncation of skb->len when computing thoff {CVE-2026-98955} - ASoC: samsung: i2s: enable op_clk in probe to balance runtime PM {CVE-2026-99089} - nvmet: use the local P2P device on metadata allocation failure {CVE-2026-98964} - cxgb4/ch_ktls: disable softirqs around tid_list erases {CVE-2026-98967} - net/sched: em_text: reject unterminated algo before autoload {CVE-2026-98969} - drm/vc4: Free the BO cache size list on teardown {CVE-2026-98970} - drm/aspeed: Balance the display clock enable on teardown - staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop {CVE-2026-64444} - namespace: refuse an automount below a mount that is in no namespace {CVE-2026-98979} - dcache: don't put a mountpoint on a dentry that's being removed {CVE-2026-98984} - namespace: check a submount for references right before unmounting it {CVE-2026-98990} - fs: refuse fspick() on internal superblocks - drm/amdgpu: make Mac FB workaround generic - drm/i915/gem: Prevent overstepping exec array boundary {CVE-2026-99006} - Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown {CVE-2026-99008} - Bluetooth: RFCOMM: free the skb when the DLC has no owner {CVE-2026-99010} - Bluetooth: hci_sock: Serialize dead-device detachment {CVE-2026-99015} - scsi: qedi: Initialize callback state before registration - regulator: ltc3676: don't read the write-only HRST and CLIRQ registers {CVE-2026-99022} - openvswitch: fix soft lockup in the netlink flow dump {CVE-2026-99025} - net: usb: ax88179_178a: fix rx frame length for non-last packets - net/smc: protect clcsock lifetime in smc_getname {CVE-2026-99032} - net/packet: guard the ll header push in packet_rcv_spkt() {CVE-2026-99033} - mmc: sdhci-sprd: disable runtime PM on remove {CVE-2026-99034} - mmc: mtk-sd: Cancel request timeout work on remove {CVE-2026-99035} - mmc: cavium-thunderx: destroy slot platform devices on remove - mmc: cavium-octeon: destroy slot platform devices on remove - dm-snap: reject the transient exception store for snapshot-merge - dm-crypt: reject the lmk IV mode with AEAD ciphers {CVE-2026-99037} - memstick: rtsx_usb_ms: complete requests after eject instead of dropping them {CVE-2026-99038} - memstick: core: wait for request completion before freeing card {CVE-2026-99039} - KEYS: Fix add_key() race with keyring restriction {CVE-2026-99040} - keys: finalize persistent keyring timeout after link attempt - ibmveth: h_free logical LAN on open-fail after register {CVE-2026-99045} - sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute - selinux: preserve NATIVE_LABELS on already-initialized sb in set_mnt_opts {CVE-2026-99052} - Revert "wifi: libertas: reject short monitor TX frames" - tipc: hold a reference to nodes found by link name {CVE-2026-99053} - Revert "tipc: hold a reference to nodes found by link name {CVE-2026-99053}" - tipc: destroy topsrv workqueues before closing connections {CVE-2026-99054} - strparser: make sure __strp_recv isn't running before tearing down the parser {CVE-2026-99056} - xen/netfront: don't leak the skb when xennet_fill_frags() fails {CVE-2026-99057} - workqueue: Fix NULL current_pwq deref in chained work check {CVE-2026-99058} - wireguard: noise: reject response consumption after intermediate initiation {CVE-2026-99059} - dm ioctl: don't let data_start run past the buffer {CVE-2026-99063} - btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode() {CVE-2026-99067} - crypto: drbg - Fix ineffective sanity check - HID: uhid: convert to hid_safe_input_report() - HID: core: introduce hid_safe_input_report() - iio: adc: max1363: sign-extend bipolar differential channel reads - iio: adc: aspeed: propagate reset deassert errors - wifi: mac80211: set info->band for 802.3 encap offload frames {CVE-2026-98700} - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} - Revert "KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716}" - mm/hugetlb: fix avoid_reserve to allow taking folio from subpool - fs: Free any excess xarray nodes in clear_inode() {CVE-2026-99080} - wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709} - wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708} - tty: port: fix tty_port_tty_vhangup() race {CVE-2026-98752} - tty: introduce and use tty_port_tty_vhangup() helper - bnxt_en: fix DMA mapping length for padded small packets {CVE-2026-99081} - USB: serial: fix driver deregistration order {CVE-2026-98696} - USB: serial: clean up core error labels - wifi: mac80211: account proxy paths against the mesh path limit {CVE-2026-98705} - mtd: spinand: Enable QE on all dies - mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722} - USB: serial: fix ioctl hangup race {CVE-2026-98695} - thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694} - wifi: mac80211: keep fallback association elements alive {CVE-2026-98704} - drm/amd/display: Mark DCE 6.4 as not APU - serial: fix TIOCMIWAIT race - tty: vt: fix memory leak in vc_allocate() - Input: s6sy761 - fix resume ordering and restore sensing - tty: serial: max3100: shut down timer before freeing port {CVE-2026-98749} - tty: abort break signalling on hangup {CVE-2026-98751} - tty: tty_port: restore TTY_IO_ERROR on activation failure {CVE-2026-98753} - usb: typec: ucsi: acpi: Assume UCSI 1.2 on Acer Nitro ANV15-41 - usb: cdns3: fix use-after-free in cdns3_gadget_exit() {CVE-2026-98757} - usb: ohci-spear: disable controller wakeup on removal - usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() - usb: octeon-hcd: fix the FIFO-flush timeout computation - drm/amdgpu/gfx6: fix firmware leak on teardown {CVE-2026-98784} - drm/amdgpu: fix ACP MFD device leak on init failure {CVE-2026-98779} - drm/amdgpu: reset VI ASIC on MacBookPro14,3 - drm/amdgpu: reset VI ASIC on MacBookPro15,1 - drm/amd/pm/si: Fix updating clock limits on AC/DC - fsverity: add dependency on 64K or smaller pages - arm64: errata: Add Cortex-A725 erratum 3821522 workaround - arm64: errata: Factor out broken AMU const counter cap - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} - perf: Require kernel access for text poke events {CVE-2026-98655} - tty: fix saved termios reset race {CVE-2026-98750} - Revert "tty: fix saved termios reset race {CVE-2026-98750}" - soc: qcom: geni-se: Correct QUP Core ICC vote constants - drm/amd/pm/si: Check AMD_IS_MOBILITY flag for PPSMC_SYSTEMFLAG_GPIO_DC - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638} - Revert "smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions" - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - Revert "xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}" - usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling - usb: typec: tcpm: fix debug accessory mode detection for sink ports - net: usb: qmi_wwan: add Quectel EG120K-EA - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} - ALSA: seq: Clear variable event pointer on read {CVE-2026-74339} - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089} - vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive(). {CVE-2026-74406} - staging: vchiq_arm: Avoid NULL ptr deref in vchiq_dump_platform_instances {CVE-2022-49106} - RDMA/hns: Fix WQ_MEM_RECLAIM warning {CVE-2026-46265} - wifi: wlcore: Fix runtime PM leak in wlcore_remove() - wifi: wlcore: Convert to platform remove callback returning void - wifi: wl12xx: Drop if with an always false condition - smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681} - mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages - page_pool: always add GFP_NOWARN for ATOMIC allocations {CVE-2025-68321} - vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF {CVE-2026-98840} - SUNRPC: reject duplicate CREDS_VALUE options {CVE-2026-89539} - SUNRPC: fix gssx_dec_option_array error path bugs {CVE-2026-89544} - drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read {CVE-2026-93179} - arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved {CVE-2023-52561} - net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode {CVE-2023-53733} - Revert "loop: Fix use-after-free issues {CVE-2023-53111}" - iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657} - iio: proximity: isl29501: Fix return type of isl29501_register_write - iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662} - iio: imu: adis16480: fix unprotected debugfs reads {CVE-2026-98663} - iio: imu: adis16400: fix unprotected debugfs reads {CVE-2026-98664} - iio: gyro: adis16136: fix unprotected debugfs reads {CVE-2026-98666} - iio: adc: sun4i-gpadc-iio: drop underflowing pm_runtime_put() calls - iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure {CVE-2026-98671} - iio: accel: sca3000: fix frequency divider condition check - iio: accel: kxcjk-1013: reject duplicate event disable {CVE-2026-98679} - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} - USB: serial: option: add Compal EXC-T1 support - USB: serial: option: add Quectel RG660QB - USB: serial: option: add Compal EXM-G1x support - USB: serial: option: add Quectel EG060W - USB: serial: option: add support for SIMCom SIM8260C - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} - USB: serial: ssu100: fix baud rate overflow - USB: serial: quatech2: fix baud rate overflow - USB: serial: cp210x: add Corsair AX1500i Power Supply - wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698} - wifi: mac80211: release mesh path quota on failed additions {CVE-2026-98701} - wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706} - wifi: iwlegacy: 3945: free EEPROM data on remove {CVE-2026-98710} - wifi: cw1200: fix TX padding OOB read leaking heap data to device {CVE-2026-98711} - mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB - mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ {CVE-2026-98721} - nvme-multipath: fix underflow in ANA log bounds checks {CVE-2026-98726} - kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856} - ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857} - Revert "ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857}" - Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732} - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735} - Bluetooth: hci_core: Fix inquiry cache timestamps on 64-bit systems - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} - ALSA: ua101: reject mismatched capture/playback packet sizes {CVE-2026-98741} - serial: vt8500: Fix clock reference leak in vt8500_serial_probe() - serial: tegra: don't clear the Tx FIFO on an Rx-only reset - tty: serial: qcom_geni_serial: Keep console RX functional after deep idle - tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup {CVE-2026-98754} - tty: vcc: zero-initialize control packet in vcc_send_ctl() {CVE-2026-98755} - tty: amiserial: fix broken TIOCMIWAIT - usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe {CVE-2026-98756} - usb: typec: ucsi: displayport: Current CAM OOB index fixup - usb: typec: ucsi: Get the connector fwnode based on reg value - usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763} - usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764} - USB: gadget: dummy-hcd: Fix wait for outstanding request completions {CVE-2026-98765} - usb: gadget: aspeed-vhub: cancel wake work on device removal {CVE-2026-98766} - usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769} - usb: ohci-st: disable controller wakeup on removal - usb: ohci-s3c2410: disable controller wakeup on removal - usb: ohci-da8xx: disable controller wakeup on cleanup - usb: hub: use shorter 120ms post resume hold for SS root hubs {CVE-2026-98933} - usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - Revert "USB: serial: fix port tear down use-after-free {CVE-2026-98772}" - USB: cdc-acm: fix racy TIOCMIWAIT implementation - Input: synaptics - limit T440p InterTouch quirk to LEN0036 - Revert "Input: synaptics - limit T440p InterTouch quirk to LEN0036" - Input: synaptics - add LEN205b entry to smbus_pnp_ids for ThinkPad T490 - Input: i8042 - add nomux quirk for Fujitsu LIFEBOOK U7410 - Input: atkbd - skip deactivate for Lenovo IdeaPad Slim 3 15IWC11 - kgdboc: Fix tty driver reference leak in configure_kgdboc() - drm/radeon: Read the VRAM VBIOS signature with readb() - PCI: Accept AtomicOps already enabled by the hypervisor - i2c: at91: release DMA channels when probe defers - ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel() {CVE-2026-98934} - net: add and use skb_get_hash_net - netfilter: nf_tables: avoid skb access on nf_stolen {CVE-2022-49622} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - Revert "ipvs: filter some flags received in the backup server {CVE-2026-98794}" - ipvs: do not create invisible templates - ipvs: fix missing counter decrement in lblc - Revert "ipvs: fix missing counter decrement in lblc {CVE-2026-98857}" - tcp: refresh TS.Recent for accepted old ACKs - net/sched: sch_codel: match the no-drop threshold to the packet size - Revert "net/sched: sch_codel: match the no-drop threshold to the packet size" - net/sched: fq_codel: match the no-drop threshold to the packet size - Revert "net/sched: fq_codel: match the no-drop threshold to the packet size" - tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805} - Revert "tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805}" - net: systemport: Fix RUNT MIB counter register offset calculation - netfilter: ipset: do not update comments from kernel-side adds - Bluetooth: btintel: validate DDC record lengths {CVE-2026-98819} - Bluetooth: hci_core: free the HCI ID if naming fails - ASoC: codecs: rt274: Fix format setting for 44100 rate - wifi: cfg80211: preserve hidden-group beacon IE ownership {CVE-2026-98823} - wifi: ath11k: reset ar->num_stations on hardware start {CVE-2026-98936} - ASoC: wm8903: Move the DRC QR threshold to the register that holds it - of/overlay: don't create "//" paths for fragments targeting the root - of/overlay: don't leak fragment references when changeset init fails {CVE-2026-98831} - nvmet: preserve device path on allocation failure - scsi: qla2xxx: Fix NVMe abort reference leak on repeated abort - scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860} - hsr: Remove WARN_ONCE() in hsr_addr_is_self(). {CVE-2026-53353} - ALSA: line6: reject oversized playback packets {CVE-2026-98836} - ALSA: caiaq: unregister the input device when probe fails {CVE-2026-98837} - vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838} - of/irq: add missing of_node_put() for interrupt parent node - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} - Revert "vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568}" - rds_tcp: close NULL deref window in rds_tcp_set_callbacks - openvswitch: add nf_ct_is_confirmed check before assigning the helper - drm/msm/adreno: Assign msm_gpu->pdev earlier to avoid nullptrs {CVE-2024-49901} - wifi: cfg80211: avoid double free if updating BSS fails - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} - rtc: spear: initialize IRQ state before requesting alarm IRQ {CVE-2026-98847} - net/packet: prevent TX_RING byte count overflow {CVE-2026-98850} - netfilter: nft_flow_offload: drop flowtable reference on init error path {CVE-2026-98851} - of/overlay: put property on deadprops only after changeset add succeeds {CVE-2026-98855} - of/irq: Fix remaining refcount leaks in of_irq_init() - audit: fix exe mark UAF in kill_rules() {CVE-2026-98862} - smb: client: close completed creates on compound wait errors {CVE-2026-98450} - smb: client: close handle after create-context parsing failure {CVE-2026-98453} - smb/client: pass cifs_open_info_data to SMB2_open() - smb/client: use stack-allocated smb2_file_all_info in smb3_query_mf_symlink() - HID: alps: unregister DualPoint Stick input device on remove {CVE-2026-98502} - HID: hid-alps: Use pm_ptr instead of #ifdef CONFIG_PM - HID: hid-alps: use default remove for hid device - HID: core: remove #ifdef CONFIG_PM from hid_driver - Bluetooth: btusb: Add IMC Networks QCA9377 to quirks table - Bluetooth: mgmt: fix race in read_unconf_index_list() {CVE-2026-98456} - smb: client: validate POSIX create context length - tools/thermal/tmon: Fix compilation warning for wrong format - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} - Revert "smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451}" - net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486} - pinctrl: sunxi: keep a shadow copy of the data register output latches - pinctrl: sunxi: Use devm_clk_get_enabled() helpers - pinctrl: sunxi: Refactor register/offset calculation - net: ipconfig: bound DHCP option construction {CVE-2026-98493} - net: ipconfig: Remove outdated comment and indent code block - drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() {CVE-2026-98511} - drm/nouveau: switch over to the new pin interface - perf test bpf: Address error about non-null argument for epoll_pwait 2nd arg - perf tools: Fix a asan issue in parse_events_multi_pmu_add() - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} - Revert "smb: client: fix create context out-of-bounds reads {CVE-2026-98454}" - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - Revert "net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490}" - mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish {CVE-2026-98507} - perf/x86/intel: Remove anythread_deprecated bit from perf_capabilities - drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() {CVE-2026-98519} - tcp: prevent collapsing skbs across boundary in rtx queue {CVE-2026-98549} - smb: client: fix smbd_connection leak on cifs_get_tcp_session() error {CVE-2026-98172} - wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown {CVE-2026-98192} - watchdog: rtd119x: Avoid division by zero {CVE-2026-98409} - watchdog: rtd119x: Use devm_clk_get_enabled() helper - smb: client: fix file type corruption in cifs_reparse_point_to_fattr() - hwmon: (gpio-fan) Fix use-after-free in alarm work {CVE-2026-97582} - devm-helpers: Add resource managed version of work init - ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters() - net/sched: act_api: release all action references on NEWACTION failure {CVE-2026-97616} - ipmr: account multicast table and route memory {CVE-2026-97939} - drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value - drm/msm/dsi: rename dual DSI to bonded DSI - drm/msm/dsi: do not enable PHYs when called for the slave DSI interface - f2fs: limit recovery filename logging to stored length {CVE-2026-89838} - f2fs: return writeback error from collapse range - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386} - scsi: qla2xxx: Quiesce response IRQ before freeing request queue {CVE-2026-89848} - scsi: qla2xxx: Fix 64G link speed reporting in get_data_rate - scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path {CVE-2026-97532} - media: zoran: Avoid freeing a registered video_device twice {CVE-2026-89870} - media: saa7164: fix cleanup on resource allocation failure {CVE-2026-89877} - KVM: s390: Fix length check __import_wp_info() {CVE-2026-89926} - KVM: nVMX: Service local TLB flushes on failed nested VM-Enter {CVE-2026-89930} - ALSA: harmony: initialize locks before requesting IRQ {CVE-2026-89980} - ALSA: parisc: Fix assignment in if condition - arm64: mm: Fix the lockless page-table walk in show_pte() {CVE-2026-93239} - ftrace: Synchronize the initialization of ftrace_ops - staging: sm750fb: fix mono image source stride mismatch in lynxfb_ops_imageblit() - staging: sm750fb: sm750_accel: Provide description for 'accel' and fix function naming - spi: bcm63xx: disable clock on resume failure - usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023} - i3c: master: Fix use-after-free of master->this {CVE-2026-93200} - i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199} - ALSA: pcxhr: initialize mutexes before requesting threaded IRQ {CVE-2026-80967} - ALSA: pcxhr: use __func__ to get funcion's name in an output message - hwrng: stm32 - Fix runtime PM cleanup on registration failure - net/smc: fix socket refcount leak in smc_switch_conns() {CVE-2026-80983} - power: supply: ucs1002: fix use-after-free on remove {CVE-2026-89463} - power: supply: bq24257: fix use-after-free on remove {CVE-2026-89475} - workqueue: Add resource managed version of delayed work init - mmc: via-sdmmc: cancel card-detect work on remove {CVE-2026-89441} - power: supply: max17040: drop incorrect I2C functionality check - power: supply: max17040: Convert to i2c's .probe_new() - i2c: core: Introduce i2c_client_get_device_id helper function - power: supply: rt9455: quiesce delayed work before teardown {CVE-2026-89465} - power: supply: rt9455: Convert to i2c's .probe_new() - lockd: fix swapped arguments in nlmsvc_match_ip() {CVE-2026-93231} - i2c: mxs: fix DMA channel leak on probe error - dmaengine: Add devm_dma_request_chan() - params: fix charp corruption on allocation failure {CVE-2026-89552} - params: Fix multi-line comment style - params: Sort headers - params: Use size_add() for kmalloc() - params: Do not go over the limit when getting the string length - kernel/params.c: Use kstrtobool() instead of strtobool() - coresight: etm3x: Fix cntr_val_show() to match cntr_val_store() behavior - cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 {CVE-2026-89640} - nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - Revert "nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}" - nfsd: check nfsd4_acl_to_attr() return value in nfsd4_create() {CVE-2026-89693} - nfsd: release path refs on follow_down() error {CVE-2026-89707} - zram: fix out-of-bounds access in read_block_state() {CVE-2026-89719} - zram: fixup read_block_state() - KEYS: trusted: Fix TPM teardown ordering {CVE-2026-89763} - Revert "KEYS: trusted: Fix TPM teardown ordering {CVE-2026-89763}" - gtp: serialize PDP context updates {CVE-2026-80851} - usb: xhci: bail out of setup if the controller is inaccessible {CVE-2026-80861} - fuse: fix invalidate lock leak on setattr writeback failure {CVE-2026-80856} - fuse: fix invalidate lock leak on open O_TRUNC DAX failure {CVE-2026-80855} - vlan: require the MAC header to be present in __vlan_insert_inner_tag() {CVE-2026-98377} - smb: client: fix OOB struct field reads in move_smb2_ea_to_cifs() {CVE-2026-98170} - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} - Revert "smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171}" - smb: client: fix potential OOB read in smb3_enum_snapshots() {CVE-2026-98169} - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} - smb: client: avoid leaking refcount in cifs_queue_oplock_break() {CVE-2026-97557} - Revert "smb: client: avoid leaking refcount in cifs_queue_oplock_break()" - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - Revert "smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}" - io_uring/rw: end write accounting from ->ki_complete {CVE-2026-97619} - genetlink: pin family module during policy dump {CVE-2026-97901} - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908} - Bluetooth: btqcomsmd: Convert to platform remove callback returning void - tick/broadcast: Plug clockevents replacement race {CVE-2026-97925} - f2fs: embed f2fs_gc_kthread in f2fs_sb_info {CVE-2026-93285} - scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[] {CVE-2026-97529} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking {CVE-2026-97537} - scsi: qla2xxx: Zero dport diagnostics buffer to avoid info leak {CVE-2026-89859} - KVM: s390: Zero initialize data structures for inject_pfault_token {CVE-2026-89921} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988} - Revert "kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988}" - ftrace: Take trace_array reference before accessing its ftrace_ops {CVE-2026-90002} - staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016} - staging: rtl8723bs: fix spacing around operators - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} - ocfs2: validate dx_root extent list fields during block read - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - ceph: bound num_export_targets array for mds info v2/v3 {CVE-2026-89650} - Revert "ceph: bound num_export_targets array for mds info v2/v3" - ceph: bound copied dentry name length in NFS export get_name {CVE-2026-89652} - Revert "ceph: bound copied dentry name length in NFS export get_name" - nfsd: fix nfsd_file leak on inter-server COPY setup failure {CVE-2026-89680} - Revert "nfsd: fix nfsd_file leak on inter-server COPY setup failure {CVE-2026-89680}" - device property: fix infinite loop in fwnode_for_each_child_node() {CVE-2026-89744} - device property: Add cleanup.h based fwnode_handle_put() scope based cleanup. - apparmor: fix out-of-bounds write when null terminating a label vec {CVE-2026-89761} - tls: device: fix out-of-bounds write in tls_append_frag() {CVE-2026-80852} - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} - do_cifs_create(): don't set ->i_mode of something we had not created {CVE-2026-98451} - smb: client: report file creation from legacy SMB1 OpenX {CVE-2026-98451} - smb: client: record CreateAction FILE_CREATED from SMB2 opens {CVE-2026-98451} - btrfs: fix xattr replace when multiple xattrs are packed in the same item {CVE-2026-98959} - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} - smb3: make query_on_disk_id open context consistent and move to common code {CVE-2026-98454} - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165} - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - mpls: add seqcount to protect the platform_label{,s} pair {CVE-2026-43042} - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} - net: gso: limit recursive IP-in-IP segmentation {CVE-2026-98853} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - tty: fix saved termios reset race {CVE-2026-98750} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - bpf: mark a NULL call argument precise {CVE-2026-98019} - bpf: Fix potential UAF when reading bpf link info {CVE-2026-90392} - Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() {CVE-2026-98972} - ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942} - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798} - nfsd: fix nfsd_file leak on inter-server COPY setup failure {CVE-2026-89680} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404} - btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759} - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390} - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390} - smb: client: reject short Next offsets in parse_server_interfaces() {CVE-2025-38728} - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} - nvme-tcp: fix crash triggered with a dataless request submission {CVE-2026-89482} - nvme-tcp: fix wrong setting of request iov_iter {CVE-2026-89482} - ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857} - ipvs: fix missing counter decrement in lblc {CVE-2026-98857} - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961} - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} - KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow page {CVE-2026-80726} - tipc: hold a reference to nodes found by link name {CVE-2026-99053} - iommu/vt-d: Clear Present bit before tearing down PASID entry {CVE-2026-45894} - dm array: validate array block headers on read {CVE-2026-89574} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - KEYS: trusted: Fix TPM teardown ordering {CVE-2026-89763} - tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014} - writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378} - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails {CVE-2026-98863} - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}