- Bluetooth: HIDP: fix missing length checks in hidp_input_report() {CVE-2026-63947} - smb: client: reject SetEA requests that do not fit the request buffer {CVE-2026-99109} - USB: serial: digi_acceleport: fix memory corruption with small endpoints {CVE-2026-63901} - USB: serial: mct_u232: fix memory corruption with small endpoint {CVE-2026-63898} - ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638} - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} - nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672} - ipv6: validate extension header length before copying to cmsg {CVE-2026-63920} - sctp: validate STALE_COOKIE cause length before reading staleness {CVE-2026-64551} - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203} - USB: serial: cypress_m8: fix memory corruption with small endpoint {CVE-2026-63956} - coredump: hold RCU while releasing parked threads {CVE-2026-99218} - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} - USB: serial: cypress_m8: validate interrupt packet headers {CVE-2026-63902} - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} - net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure {CVE-2026-99212} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check {CVE-2026-63913} - keys: Protect the type name while describing a key {CVE-2026-99224} - USB: serial: belkin_sa: validate interrupt status length {CVE-2026-63903} - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} - ipv6: fix Route Information option length validation {CVE-2026-74598} - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} - forcedeth: fix off-by-one when saving/restoring non-PCI config space {CVE-2026-89596} - ecryptfs: reject too-small tag 70 packets {CVE-2026-89606} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959} - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() {CVE-2026-43139} - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001} - cipso,calipso: resolve a number of problems with the DOI refcounts {CVE-2021-33033} - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} - netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624} - netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read {CVE-2026-98485} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() {CVE-2026-98485} - net: iptunnel: fix stale transport header during tunnel decapsulation {CVE-2026-98401} - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799}