- irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610} - IB/hfi1: Fix a memleak in init_credit_return {CVE-2024-26839} - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335} - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} - wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() {CVE-2025-71100} - RDMA/core: always drop device refcount in ib_del_sub_device_and_put() {CVE-2025-71157} - drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table {CVE-2024-58052} - ionic: Fix netdev notifier unregister on failure {CVE-2024-56715} - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739} - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} - usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391} - crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init {CVE-2023-52616} - eventpoll: defer struct eventpoll free to RCU grace period {CVE-2026-43074} - wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661} - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120} - netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496} - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370} - crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681} - nvme-pci: ensure we're polling a polled queue {CVE-2026-31523} - mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651} - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936} - ipmi: ipmb: Add check devm_kasprintf() returned value {CVE-2024-58051} - net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021} - ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190} - udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974} - team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234} - tcp: secure_seq: add back ports to TS offset {CVE-2026-23247} - udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162} - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524} - netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399} - crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677} - xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107} - KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop {CVE-2025-21839} - perf: Fix sample vs do_exit() {CVE-2025-38424} - netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211} - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470} - net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255} - ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777} - rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067} - RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089} - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv {CVE-2026-22996} - Input: synaptics - fix crash when enabling pass-through port {CVE-2025-21746} - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579} - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305} - driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800} - dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134} - net: let net.core.dev_weight always be non-zero {CVE-2025-21806} - exec: don't WARN for racy path_noexec check {CVE-2024-50010} - tracing: Fix potential deadlock in cpu hotplug with osnoise {CVE-2026-31480} - wifi: mac80211: Discard Beacon frames to non-broadcast address {CVE-2025-71127} - xfs: factor out xfs_attr3_node_entry_remove - ACPI: battery: Fix possible crash when unregistering a battery hook {CVE-2024-49955} - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN {CVE-2026-23472} - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion {CVE-2026-23468} - i2c: designware: use casting of u64 in clock multiplication to avoid overflow {CVE-2022-49749} - afs: Fix lock recursion {CVE-2024-53090} - HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629} - vsock/virtio: cap TX credit to local buffer size {CVE-2026-23086} - vsock/virtio: fix potential underflow in virtio_transport_get_credit() {CVE-2026-23069} - bpf: Reject narrower access to pointer ctx fields {CVE-2025-38591} - sched/task_stack: fix object_is_on_stack() for KASAN tagged pointers {CVE-2024-53128} - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() {CVE-2025-38458} - tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167} - bpf: Do not include stack ptr register in precision backtracking bookkeeping {CVE-2025-38279} - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() {CVE-2026-23304} - net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302} - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop {CVE-2026-23300} - net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23293} - net: usb: pegasus: validate USB endpoints {CVE-2026-23290} - rxrpc: Fix missing locking causing hanging calls {CVE-2024-50294} - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328} - mm/page_alloc: clear page->private in free_pages_prepare() {CVE-2026-43303} - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message {CVE-2026-23307} - drm/amd/display: Increase block_sequence array size {CVE-2025-38080} - smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303} - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066} - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs {CVE-2026-23286} - smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709} - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry {CVE-2026-46316} - block: Remove queue freezing from several sysfs store callbacks {CVE-2025-71117} - mptcp: fallback earlier on simult connection {CVE-2025-71088} - mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() {CVE-2025-39916} - neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763} - kernel: be more careful about dup_mmap() failures and uprobe registering {CVE-2025-21709} - bridge: mcast: Fix use-after-free during router port configuration {CVE-2025-38248} - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669} - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption {CVE-2026-31663} - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator {CVE-2026-43085} - l2tp: Drop large packets with UDP encap {CVE-2026-43080} - perf/x86/intel/uncore: Skip discovery table for offline dies {CVE-2026-43079} - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION {CVE-2026-31590}