- mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE {CVE-2026-98827} - ext4: clear error before retrying inode xattr space fallback {CVE-2025-22121} - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} - ext4: introduce ITAIL helper {CVE-2025-22121} - ocfs2: validate orphan slot during inode read {CVE-2026-90205} - ocfs2: validate DIO orphan slot during inode read {CVE-2026-90204} - HID: logitech-hidpp: Fix FF device cleanup on init failure {CVE-2026-90330} - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} - bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720} - bpf: Simplify sanitize_err() signature {CVE-2026-74720} - libceph: reject buckets with mismatched CRUSH ids {CVE-2026-89656} - libceph: Fix potential out-of-bounds access in crush_decode() {CVE-2026-52955} - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} - net: add skb_header_pointer_careful() helper {CVE-2026-23204} - ipvs: bound LBLCR and LBLC cache growth {CVE-2026-98857} - ipvs: fix missing counter decrement in lblc {CVE-2026-98857} - tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334} - tty: skip cdev_del() when no cdev is registered {CVE-2026-90335} - HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826} - hid: hid-logitech-hidpp: avoid unnecessary assignments in hidpp_connect_event {CVE-2026-93826} - drm/nouveau: fix double-free in nvif_vmm_dtor {CVE-2026-98515} - HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} - ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892} - net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700} - devlink: Fix use-after-free after a failed reload {CVE-2022-3625} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609} - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799} - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} - ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682} - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} - power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916} - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} - tipc: hold a reference to nodes found by link name {CVE-2026-99053} - bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS {CVE-2024-26589} - md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307} - bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589} - HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature {CVE-2026-89729} - net/9p: fix race condition on rdma->state in trans_rdma.c {CVE-2026-72491} - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} - net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264} - mac802154: llsec: add skb_cow_data() before in-place crypto {CVE-2026-63831} - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739} - ALSA: line6: reject oversized playback packets {CVE-2026-98836} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363} - wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - ipc: limit next_id allocation to the valid ID range {CVE-2026-52923} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock {CVE-2026-89655} - scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation {CVE-2026-89856} - nvme-tcp: check the data direction of a C2HData PDU {CVE-2026-89973} - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} - scsi: qla2xxx: Avoid double completion in async IOCB timeout {CVE-2026-89847} - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} - RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435} - ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160} - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - wifi: mwifiex: validate scan response extents {CVE-2026-98185} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - drbd: reject data replies with an out-of-range payload size {CVE-2026-72014} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() {CVE-2026-53239} - sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587} - netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007} - staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667} - Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255} - ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111} - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} - net: thunderbolt: Fix frags[] overflow by bounding frame_count {CVE-2026-72157} - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} - svcrdma: Reject connection when transport allocation fails {CVE-2026-89531} - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} - libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - net: sungem: fix probe error cleanup {CVE-2026-72406} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - sctp: drop a chunk if its transport was removed {CVE-2026-89478} - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} - scsi: target: iscsi: Reserve a terminator byte for the login payload {CVE-2026-90011} - bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548} - net: gue: reject invalid REMCSUM offsets {CVE-2026-98621} - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} - ALSA: usb-audio: Fix DMA buffer out-of-bounds write when fill_max is set {CVE-2026-74498} - ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499} - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task {CVE-2022-48792} - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419} - ipvs: reject invalid states in connection template sync records {CVE-2026-97596} - bpf: Fix UAF in sock clone early bailouts {CVE-2026-68399} - net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size {CVE-2026-98027} - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} - wifi: at76c50x-usb: avoid length underflow in at76_guess_freq() {CVE-2026-68373} - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} - fou: Fix use-after-free in fou_create() {CVE-2026-74496} - scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - wifi: libipw: reject too-short association responses {CVE-2026-98348} - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} - smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565} - nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU {CVE-2026-89969} - media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214} - sctp: clear control chunk transport if it is being removed {CVE-2026-74688} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376} - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669} - libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558} - scsi: qla2xxx: Fix cs84xx use-after-free on host teardown {CVE-2026-89854} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} - libceph: Reject monmaps advertising zero monitors {CVE-2026-68155} - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - uio: Fix stale info pointer in failed registration path {CVE-2026-93054} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - media: em28xx: defer audio-only extension registration {CVE-2026-89892} - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} - phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144} - net: phonet: free phonet_device after RCU grace period {CVE-2026-53157} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - KVM: x86: Re-pend GET_NESTED_STATE_PAGES if getting said pages fails {CVE-2026-98863} - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} - wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382} - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872} - libceph: remove debugfs files before client teardown {CVE-2026-68153} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - crypto: xts - Handle EBUSY correctly {CVE-2023-53494} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159} - sound: ua101: fix division by zero at probe {CVE-2026-46184} - Squashfs: check block offset is not negative {CVE-2026-90203} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - power: supply: lp8727: fix use-after-free in lp8727_release_irq() {CVE-2026-89469} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} - RDMA/srpt: fix integer overflow in immediate data length check {CVE-2026-74394} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() {CVE-2026-64002} - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - gue: validate REMCSUM private option length {CVE-2026-72351} - drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262} - forcedeth: fix UAF of txrx_stats in nv_remove {CVE-2026-74548} - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} - thunderbolt: Clamp XDomain response data copy to allocation size {CVE-2026-53148} - wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163} - batman-adv: tt: prevent TVLV OOB check overflow {CVE-2026-72226} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() {CVE-2026-63924} - udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705} - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - batman-adv: access unicast_ttvn skb->data only after skb realloc {CVE-2026-72234} - Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049} - ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path {CVE-2026-46189} - batman-adv: gw: acquire ethernet header only after skb realloc {CVE-2026-80601} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432}