- ipv4: free inet_opt and ireq_opt after an RCU grace period {CVE-2026-98432} - net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573} - KVM: x86: Use active memslots for the per-vCPU MMIO cache {CVE-2026-99082} - gfs2: fix use-after-free in gfs2_qd_dealloc {CVE-2026-63804} - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330} - drm/amdkfd: hold event_mutex while checkpointing CRIU events {CVE-2026-74446} - net: openvswitch: fix potential UAF on meter attach failure {CVE-2026-74465} - mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481} - veth: fix NAPI leak in XDP enable error path {CVE-2026-80613} - nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482} - svcrdma: Fix offset arithmetic in read_chunk_range {CVE-2026-89533} - ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode {CVE-2026-89653} - libceph: validate banner payload length {CVE-2026-90067} - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} - wifi: nl80211: reject beacons with bad HE operation {CVE-2026-97517} - drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606} - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602} - bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc {CVE-2026-98588} - thunderbolt: Reject oversized XDomain properties responses {CVE-2026-98687} - Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}