- atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208} - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328} - cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328} - rcu: Fix rcu_read_unlock() deadloop due to softirq - rcu: Fix racy re-initialization of irq_work causing hangs - RDMA/efa: Fix possible deadlock {CVE-2026-31493} - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493} - RDMA/efa: Improve admin completion context state machine {CVE-2026-31493} - RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493} - RDMA/efa: Extend admin timeout error print - RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493} - rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075} - kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402} - wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096} - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210} - exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940} - af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197} - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089} - udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946} - efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357} - kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190} - smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230} - sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935} - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208} - drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093} - firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238} - ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738} - net: hinic: fix memory leak when reading function table {CVE-2022-50438} - device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752} - libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232} - usbnet: fix memory leak in error case {CVE-2022-49657} - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111} - seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661} - net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121} - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756} - leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587} - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986} - RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890} - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125} - tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800} - kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266} - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870} - i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788} - can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357} - regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558} - wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937} - netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952} - can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830} - bpf: Fix memory leaks in __check_func_call {CVE-2022-49837} - configfs: fix a race in configfs_{,un}register_subsystem() {CVE-2022-48931} - RDMA/mad: Improve handling of timed out WRs of mad agent {CVE-2024-50095} - cifs: Fix connections leak when tlink setup failed {CVE-2022-49822} - usb: atm: cxacru: fix endpoint checking in cxacru_bind() {CVE-2024-41097} - tcp: add sanity checks to rx zerocopy {CVE-2024-26640} - NFSD: Prevent a potential integer overflow {CVE-2024-53146} - bpf, cpumap: Handle skb as well when clean up ptr_ring {CVE-2023-53660} - team: fix null-ptr-deref when team device type is changed {CVE-2023-52574} - fbdev: efifb: Register sysfs groups through driver core {CVE-2024-49925} - bpf: devmap: provide rxq after redirect {CVE-2024-50162} - net: phy: micrel: Allow probing without .driver_data {CVE-2022-49472} - inotify: Avoid reporting event with invalid wd {CVE-2023-54119} - USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776} - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096} - RDMA/irdma: Fix data race on CQP request done {CVE-2023-54292} - fscache: Fix oops due to race with cookie_lru and use_cookie {CVE-2022-48989} - perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() {CVE-2023-52450} - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c {CVE-2024-56727} - wifi: iwlwifi: fix debug actions order {CVE-2025-38045} - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' {CVE-2022-50553} - net: ipv4: fix one memleak in __inet_del_ifa() {CVE-2023-53995} - exfat: fix memory leak in exfat_load_bitmap() {CVE-2024-50013} - vp_vdpa: fix id_table array not null terminated error {CVE-2024-53110} - intel_th: Fix a resource leak in an error handling path {CVE-2022-50143} - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101} - usb: gadget: core: Check for unset descriptor {CVE-2024-44960} - drm/amdkfd: Fix lock dependency warning with srcu {CVE-2023-52632} - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() {CVE-2025-38458} - PM / devfreq: Check governor before using governor->name {CVE-2025-38609} - tls: fix missing memory barrier in tls_init {CVE-2024-36489} - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() {CVE-2025-37830} - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery {CVE-2024-40977} - nvdimm: Fix firmware activation deadlock scenarios {CVE-2022-49446} - wifi: mac80211: sdata can be NULL during AMPDU start {CVE-2022-48875} - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods {CVE-2022-49024} - wifi: ath10k: Fix memory leak in management tx {CVE-2024-50236} - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] {CVE-2025-21666} - netdevsim: fix memory leak in nsim_bus_dev_new() {CVE-2022-50772} - fs: relax assertions on failure to encode file handles {CVE-2024-57924} - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c {CVE-2024-56707} - ceph: fix deadlock or deadcode of misusing dget() {CVE-2023-52583} - bpf, verifier: Fix memory leak in array reallocation for stack state {CVE-2022-49878} - ip6_gre: make ip6gre_header() robust {CVE-2025-71098} - ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118} - net/mlx5e: kTLS, Fix incorrect page refcounting {CVE-2024-53138} - gve: Clear napi->skb before dev_kfree_skb_any() {CVE-2024-40937} - atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546} - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt {CVE-2025-71131} - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration {CVE-2024-45006} - irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610} - CDC-NCM: avoid overflow in sanity checking {CVE-2022-48938} - Bluetooth: Fix crash when replugging CSR fake controllers {CVE-2022-48982} - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521} - ptp: Ensure info->enable callback is always set {CVE-2025-21814} - perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() {CVE-2022-50820} - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() {CVE-2022-50556} - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU {CVE-2023-54036} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959} - drm/amdgpu: Fix smatch static checker warning {CVE-2024-46835} - svcrdma: Address an integer overflow {CVE-2024-53151} - dma-debug: fix a possible deadlock on radix_lock {CVE-2024-47143} - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check {CVE-2024-41072} - regulator: core: fix use_count leakage when handling boot-on {CVE-2022-50250} - tpm: use try_get_ops() in tpm-space.c {CVE-2022-49286} - ata: libata-transport: fix error handling in ata_tdev_add() {CVE-2022-49823} - padata: Always leave BHs disabled when running ->parallel() {CVE-2022-50382} - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108} - serial: core: check uartclk for zero to avoid divide by zero {CVE-2024-43893} - cifs: fix potential memory leaks in session setup {CVE-2023-53008} - tty: fix out-of-bounds access in tty_driver_lookup_tty() {CVE-2023-54198} - nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() {CVE-2023-53697} - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() {CVE-2026-43136} - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120} - drm/ioc32: stop speculation on the drm_compat_ioctl path {CVE-2026-31781} - ext4: fix i_disksize exceeding i_size problem in paritally written case {CVE-2023-53270} - wifi: nl80211: fix NULL-ptr deref in offchan check {CVE-2023-53113} - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() {CVE-2023-53717} - ASoC: SOF: Add some bounds checking to firmware data {CVE-2024-26927} - regulator: core: Prevent integer underflow {CVE-2022-50582} - power: supply: fix null pointer dereferencing in power_supply_get_battery_info {CVE-2022-50276} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724} - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}