- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} - scsi: mpt3sas: Fix kernel panic during drive powercycle test {CVE-2021-47565} - net/sched: act_skbmod: Skip non-Ethernet packets {CVE-2021-47293} - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219} - net: validate lwtstate->data before returning from skb_tunnel_info() {CVE-2021-47309} - regmap: Fix possible double-free in regcache_rbtree_exit() {CVE-2021-47483} - Squashfs: check metadata block offset is within range {CVE-2026-23388} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193} - isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-3896} - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191} - media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288} - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() {CVE-2021-47541} - scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576} - igbvf: fix double free in `igbvf_probe` {CVE-2021-47589} - dm btree remove: fix use after free in rebalance_children() {CVE-2021-47600} - RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206} - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} - smb: client: reject userspace cifs.spnego descriptions - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}