- fbdev: fix use-after-free in store_modes() {CVE-2026-63826} - svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530} - drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size {CVE-2026-80702} - svcrdma: Fix pcl_for_each_segment for empty chunks {CVE-2026-89532} - vfio/pci: clear vdev->msi_perm after freeing it on init failure {CVE-2026-89777} - drm/amdkfd: Check bounds on allocate_doorbell {CVE-2026-97495} - Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup {CVE-2026-98290} - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} - net/sched: cls_flower: validate mask pointer after nla_next() {CVE-2026-99112} - tipc: protect node reset trace dump with node lock {CVE-2026-99246} - fbcon: Retry rotated font allocation after failure {CVE-2026-46191} - keys: Protect the type name while describing a key {CVE-2026-99224} - tracing: Save the event file instead of the compatible histogram {CVE-2026-99235} - tracing: Reject incomplete event filter expressions {CVE-2026-99236} - Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108} - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345} - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB {CVE-2026-46204} - bpf: mark a NULL call argument precise {CVE-2026-98019} - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} - svcrdma: Reject Write/Reply chunks with segcount 0 {CVE-2026-93228} - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} - drm/amd/pm: fix pptable use-after-free {CVE-2026-74450} - nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer {CVE-2026-64034} - netfilter: nf_tables: use list_del_rcu for netlink hooks {CVE-2026-46324} - nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135} - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} - ASoC: Intel: avs: Do not share the name pointer between components {CVE-2025-40338} - ice: fix double-free of tx_buf skb {CVE-2026-53009} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept {CVE-2026-98367} - ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - nfsd: fix UAF when access ex_uuid or ex_stats {CVE-2024-53216} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388} - ACPI: platform: Use acpi_bus_get_primary_device() {CVE-2026-100072} - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543} - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} - net/sched: act_ct: Only release RCU read lock after ct_ft {CVE-2026-46319} - RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852} - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} - vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} - perf sched: Fix register_pid() overflow, strcpy, and BUG_ON {CVE-2026-80671} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455} - ipv6: validate extension header length before copying to cmsg {CVE-2026-63920} - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen {CVE-2026-74267} - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} - RDMA/siw: Fix use-after-free in siw_accept() {CVE-2026-90292} - nvme: add missing SRCU grace period in error path {CVE-2026-89972} - media: em28xx: defer audio-only extension registration {CVE-2026-89892} - nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685} - HID: sony: fix UAF of ghl_poke_timer / ghl_urb at driver unbind {CVE-2026-89625} - dm array: validate array block headers on read {CVE-2026-89574} - ip: orphan prefetched skbs before multicast forwarding {CVE-2026-89564} - nouveau/gem: reserve the bo in the info ioctl around the vma lookup {CVE-2026-89553} - wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop {CVE-2026-80947} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} - USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342} - NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392} - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} - mm/huge_memory: update file PMD counter before folio_put() {CVE-2026-53189} - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} - libceph: Fix potential out-of-bounds access in __ceph_x_decrypt() {CVE-2026-52956} - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} - crypto: essiv - Handle EBUSY correctly {CVE-2023-54046} - sctp: stream: fully roll back denied add-stream state {CVE-2026-52929} - scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE {CVE-2026-72083} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active {CVE-2026-74516} - RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} - mac802154: llsec: add skb_cow_data() before in-place crypto {CVE-2026-63831} - Bluetooth: btusb: Fix UAF of btusb_data by rx_work {CVE-2026-97977} - ALSA: line6: reject oversized playback packets {CVE-2026-98836} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - drm/nouveau: fix double-free in nvif_vmm_dtor {CVE-2026-98515} - HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501} - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} - vxlan: use one headroom snapshot for neighbour replies {CVE-2026-98568} - vxlan: re-fetch eth header after route_shortcircuit() {CVE-2026-80681} - RDMA/rxe: Use validated num_sge in local buffer {CVE-2026-74378} - RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe {CVE-2026-74378} - tipc: restrict socket queue dumps in enqueue tracepoints {CVE-2026-72299} - smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379} - fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129} - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} - i40e: fix idx validation in config queues msg {CVE-2025-39971} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - net: openvswitch: fix use-after-free of the flow table mask array {CVE-2026-97611} - ALSA: core: Fix use-after-free in snd_card_do_free() {CVE-2026-90198} - sctp: check RCV_SHUTDOWN after the sendmsg connect wait {CVE-2026-98846} - RDMA/rvt: Return NULL after port allocation failure {CVE-2026-93104} - smb: client: harden POSIX SID length parsing {CVE-2026-64380} - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419} - wifi: rtw89: fix HE extended capability length check {CVE-2026-93281} - drm/amdkfd: fix list_del corruption in kfd_criu_resume_svm {CVE-2026-72449} - sctp: prevent peer transport count overflow {CVE-2026-74469} - scsi: libiscsi: Reject a negative task index from parse_pdu_itt {CVE-2026-99154} - bpf: Fix bpf_sock context code generation {CVE-2026-98590} - drm/amdgpu: fix buffer overflow during vBIOS update {CVE-2026-97425} - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} - tcp: prevent collapsing skbs across boundary in rtx queue {CVE-2026-98549} - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491} - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} - sctp: drop a chunk if its transport was removed {CVE-2026-89478} - sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142} - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374} - xfrm: route MIGRATE notifications to caller's netns {CVE-2026-63914} - USB: serial: cypress_m8: validate interrupt packet headers {CVE-2026-63902} - xfrm: esp: restore combined single-frag length gate {CVE-2026-63912} - scsi: libiscsi: Validate the ITT reflected in a Reject PDU {CVE-2026-99153} - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} - vsock: treat TCP_CLOSING as once-established {CVE-2026-99213} - net: bridge: mcast: fix use-after-free of a master VLAN's multicast context {CVE-2026-80842} - net: bridge: mcast: don't truncate the port group walk on teardown {CVE-2026-99117} - tracing/timerlat: Only clear timer if a kthread exists {CVE-2024-46845} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() {CVE-2026-63947} - net/sched: fix use-after-free in __tcf_action_put() {CVE-2026-99167} - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203} - net: xfrm: reject unrepresentable espintcp transport headers {CVE-2026-98417} - KVM: SEV: Ignore Port I/O requests of length '0' {CVE-2026-63940}