- smb: client: reject userspace cifs.spnego descriptions - usb: ulpi: fix memory leak on ulpi_register() error paths - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759} - mptcp: consolidate suboption status {CVE-2025-21707} - blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374} - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097} - net: usb: asix: validate PHY address before use {CVE-2025-71094} - driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715} - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997} - crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931} - bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171} - Input: gpio-keys - fix a sleep while atomic with PREEMPT_RT {CVE-2025-38335} - spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485} - mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754} - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850} - mm/userfaultfd: fix hugetlb fault mutex hash calculation {CVE-2026-31575} - RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492} - calipso: Don't call calipso functions for AF_INET sk. {CVE-2025-38147} - mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040} - espintcp: fix skb leaks {CVE-2025-38057} - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667} - memcg: fix soft lockup in the OOM process {CVE-2024-57977} - futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555} - trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005} - dm-verity: disable recursive forward error correction {CVE-2025-71161} - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395} - vfs: Don't evict inode under the inode lru traversing context {CVE-2024-45003} - ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961} - sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062} - net: phy: leds: fix memory leak {CVE-2025-37989} - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} - netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764} - sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638} - kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480} - io_uring: check if iowq is killed before queuing {CVE-2024-56709} - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200} - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481} - udf: Do not update file length for failed writes to inline files {CVE-2023-53295} - bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748} - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} - misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279} - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344} - tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368} - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141} - io_uring/tctx: work around xa_store() allocation error issue {CVE-2024-56584} - objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423} - net: bcmgenet: Add a check for oversized packets {CVE-2023-53535} - ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450} - PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411} - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318} - watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - libceph: reset sparse-read state in osd_fault() {CVE-2026-23136} - ppp: fix race conditions in ppp_fill_forward_path {CVE-2025-39673} - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks {CVE-2025-38412} - perf: Revert to requiring CAP_SYS_ADMIN for uprobes {CVE-2025-38466} - can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830} - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653} - HID: ignore non-functional sensor in HP 5MP Camera {CVE-2025-21992} - smb: client: Avoid race in open_cached_dir with lease breaks {CVE-2025-37954} - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled {CVE-2025-38039} - smb: Log an error when close_all_cached_dirs fails {CVE-2025-38321} - rxrpc: Fix bug due to prealloc collision {CVE-2025-38544} - ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. {CVE-2025-38438} - net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155} - perf/core: Fix WARN_ON(!ctx) in __free_event() for partial init {CVE-2025-37878} - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. {CVE-2025-37884} - tracing: Free error logs of tracing instances {CVE-2023-53375} - loop: Avoid updating block size under exclusive owner {CVE-2025-38709} - netfilter: ctnetlink: use netlink policy range checks {CVE-2026-31495} - ceph: fix deadlock or deadcode of misusing dget() {CVE-2023-52583} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks {CVE-2026-23270} - ip6_gre: make ip6gre_header() robust {CVE-2025-71098} - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111} - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt {CVE-2025-71131} - rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164} - bonding: provide a net pointer to __skb_flow_dissect() {CVE-2026-23119} - l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120} - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108} - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101} - regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071} - cifs: Fix memory and information leak in smb3_reconfigure() {CVE-2025-71151} - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011} - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN {CVE-2025-38393} - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756} - spi: imx: Don't skip cleanup in remove's error path {CVE-2023-53225} - ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601} - i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock {CVE-2024-43098} - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open {CVE-2024-46791} - ftrace: Fix regression with module command in stack_trace_filter {CVE-2024-56569} - leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587} - bpf, sockmap: Several fixes to bpf_msg_pop_data {CVE-2024-56720} - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640} - sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639} - ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered {CVE-2025-39763} - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path {CVE-2025-37788} - net: clear the dst when changing skb protocol {CVE-2025-38192} - bpf: Fix kmemleak warning for percpu hashmap {CVE-2025-37807} - drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853} - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error {CVE-2025-21732} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type {CVE-2025-23161} - PCI: Fix reference leak in pci_register_host_bridge() {CVE-2025-37836} - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}