- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} - dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600} - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} - net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293} - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219} - drm: Fix use-after-free read in drm_getunique() {CVE-2021-47280} - net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309} - regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483} - netfilter: nftables: avoid overflows in nft_hash_buckets() {CVE-2021-46992} - ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281} - netfilter: synproxy: Fix out of bounds when parsing TCP options {CVE-2021-47245} - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191} - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288} - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576} - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541} - Squashfs: check metadata block offset is within range {CVE-2026-23388} - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} - ext4: fix null-ptr-deref in ext4_write_info {CVE-2022-50344} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} - smb: client: reject userspace cifs.spnego descriptions - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}