- smb: client: reject userspace cifs.spnego descriptions - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854} - cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372} - scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038} - drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042} - tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669} - clk: Fix clk_core_get NULL dereference {CVE-2024-27038} - drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907} - bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585} - driver core: fix resource leak in device_add() {CVE-2023-53594} - wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641} - wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297} - drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535} - ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277} - tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908} - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431} - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676} - can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457} - serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527} - cpufreq: exit() callback is optional {CVE-2024-38615} - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276} - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905} - wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410} - tcp: do not accept ACK of bytes we never sent {CVE-2023-52881} - crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813} - net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960} - usb: ulpi: fix memory leak on ulpi_register() error paths - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759} - wifi: ath11k: fix htt pktlog locking {CVE-2023-52800} - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653} - calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698} - wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929} - ext4: update orig_path in ext4_find_extent() {CVE-2024-49881} - drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863} - RDMA/restrack: Fix potential invalid address access {CVE-2024-42080} - net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076} - nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796} - rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273} - net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803} - coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491} - scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615} - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476} - scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451} - usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168} - drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390} - USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359} - PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202} - drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288} - drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409} - USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197} - media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437} - arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726} - bnxt: Do not read past the end of test names {CVE-2023-53010} - dax: make sure inodes are flushed before destroy cache {CVE-2022-49220} - cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006} - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE {CVE-2024-42321} - PCI: Fix use-after-free of slot->bus on hot remove {CVE-2024-53194} - net/ipv6: release expired exception dst cached in socket {CVE-2024-56644} - net: sched: fix ordering of qlen adjustment {CVE-2024-53164} - watch_queue: Fix NULL dereference in error cleanup {CVE-2022-49257} - lz4: fix LZ4_decompress_safe_partial read out of bound {CVE-2022-49078} - vmxnet3: disable rx data ring on dma allocation failure {CVE-2024-40923} - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() {CVE-2024-36955} - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure {CVE-2022-50374} - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag {CVE-2024-35817} - dm snapshot: fix lockup in dm_exception_table_exit {CVE-2024-35805} - nouveau: fix instmem race condition around ptr stores {CVE-2024-26984} - wireguard: netlink: access device through ctx instead of peer {CVE-2024-26950} - drm/i915/gt: Reset queue_priority_hint on parking {CVE-2024-26937} - netfilter: nft_set_pipapo: do not free live element {CVE-2024-26924} - dmaengine: fix NULL pointer in channel unregistration function {CVE-2023-52492} - PCI/PM: Drain runtime-idle callbacks before driver removal {CVE-2024-35809} - nvme-fc: do not wait in vain when unloading module {CVE-2024-26846} - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427} - phylib: fix potential use-after-free {CVE-2022-48754} - mm/filemap: skip to create PMD-sized page cache if needed {CVE-2024-41031} - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() {CVE-2024-35944} - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage {CVE-2024-36006} - wifi: ath11k: decrease MHI channel buffer length to 8KB {CVE-2024-35938} - dyndbg: fix old BUG_ON in >control parser {CVE-2024-35947} - ALSA: core: Fix NULL module pointer assignment at card init {CVE-2024-38605} - wifi: iwlwifi: mvm: rfi: fix potential response leaks {CVE-2024-35912} - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD {CVE-2024-35801} - ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415} - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() {CVE-2023-52832} - i2c: core: Run atomic i2c xfer when !preemptible {CVE-2023-52791} - mmc: sdio: fix possible resource leaks in some error paths {CVE-2023-52730} - protect the fetch of ->fd[fd] in do_dup2() from mispredictions {CVE-2024-42265} - wifi: mac80211: fix potential sta-link leak {CVE-2024-35838} - octeontx2-af: avoid off-by-one read from userspace {CVE-2024-36957} - xen-netfront: Add missing skb_mark_for_recycle {CVE-2024-27393} - net: hns3: do not allow call hns3_nic_net_open repeatedly {CVE-2021-47400} - HID: sony: Fix a potential memory leak in sony_probe() {CVE-2023-52529} - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428} - mm/gup: fix gup_pud_range() for dax {CVE-2022-48986} - drm/virtio: Fix GEM handle creation UAF {CVE-2022-48899} - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011} - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() {CVE-2024-26894} - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049} - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks {CVE-2026-23270} - net/sched: act_ct: fix skb leak and crash on ooo frags {CVE-2023-52610} - Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386} - mm/mempolicy: fix memory leak in set_mempolicy_home_node system call {CVE-2022-50391} - mm/kasan: fix double free for kasan pXds {CVE-2026-31686} - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - dax: Fix dax_mapping_release() use after free {CVE-2023-53613}