* Bump kernel ABI to 53: ship the ELS kernel as 5.10.0-53-*, distinct from the prior 5.10.0-52. * CVE-2022-49218 - drm/dp: Fix OOB read when handling Post Cursor2 register {CVE-2022-49218} * CVE-2022-49961 - bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961} * CVE-2022-50050 - ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050} * CVE-2023-53282 - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282} * CVE-2023-53432 - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} * CVE-2023-53673 - Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673} * CVE-2024-26589 - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589} * CVE-2024-41014 - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014} * CVE-2024-56604 - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604} * CVE-2024-56614 - xsk: fix OOB map writes when deleting elements {CVE-2024-56614} * CVE-2024-57876 - drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876} * CVE-2025-21927 - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927} * CVE-2025-22083 - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083} * CVE-2025-37786 - net: dsa: free routing table on probe failure {CVE-2025-37786} * CVE-2025-38159 - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159} * CVE-2025-39686 - comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686} * CVE-2025-39759 - btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759} * CVE-2026-23392 - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} * CVE-2026-43049 - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} * CVE-2026-52991 - sched/psi: fix race between file release and pressure write {CVE-2026-52991} * CVE-2026-53036 - bpf, arm64: Fix off-by-one in check_imm signed range check {CVE-2026-53036} * CVE-2026-53129 - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} * CVE-2026-53253 - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling {CVE-2026-53253} - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} * CVE-2026-64320 - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} * CVE-2026-68093 - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} * CVE-2026-68289 - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} * CVE-2026-68398 - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} * CVE-2026-74341 - wifi: wcn36xx: fix heap overflow from oversized firmware HAL response {CVE-2026-74341} * CVE-2026-74359 - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} * CVE-2026-74700 - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} * CVE-2026-74744 - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} * CVE-2026-89448 - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} * CVE-2026-89481 - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} * CVE-2026-89553 - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} * CVE-2026-89574 - dm array: validate array block headers on read {CVE-2026-89574} * CVE-2026-89762 - apparmor: fix cred UAF caused by begin_current_label_crit_section() {CVE-2026-89762} * CVE-2026-89932 - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} * CVE-2026-89972 - nvme: add missing SRCU grace period in error path {CVE-2026-89972} * CVE-2026-89988 - kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988} * CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} * CVE-2026-93100 - fs/resctrl: Prevent use-after-free in rdtgroup_kn_put() {CVE-2026-93100} * CVE-2026-93163 - hwrng: core - fix rng list on registration error {CVE-2026-93163} * CVE-2026-93826 - hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826} - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} * CVE-2026-97539 - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} * CVE-2026-97564 - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} * CVE-2026-97908 - Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev {CVE-2026-97908} * CVE-2026-97926 - ufs: fix ufs_read_cylinder() failure handling {CVE-2026-97926} * CVE-2026-98017 - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} * CVE-2026-98041 - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} * CVE-2026-98260 - exec: Cleanup POSIX timers right after de_thread() {CVE-2026-98260} * CVE-2026-98266 - ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266} * CVE-2026-98269 - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} * CVE-2026-98375 - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} * CVE-2026-98568 - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} * CVE-2026-98662 - iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662} * CVE-2026-98687 - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} * CVE-2026-98741 - ALSA: ua101: reject mismatched capture/playback packet sizes {CVE-2026-98741} * CVE-2026-98794 - ipvs: filter some flags received in the backup server {CVE-2026-98794} * CVE-2026-98805 - tipc: prevent GCM nonce reuse on peer key changes {CVE-2026-98805} * CVE-2026-98827 - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE {CVE-2026-98827} * CVE-2026-98836 - ALSA: line6: reject oversized playback packets {CVE-2026-98836} * CVE-2026-98837 - ALSA: caiaq: unregister the input device when probe fails {CVE-2026-98837} * CVE-2026-98846 - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} * CVE-2026-98857 - ipvs: fix missing counter decrement in lblc {CVE-2026-98857} - ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857} * CVE-2026-98863 - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails {CVE-2026-98863}