- do_cifs_create(): don't set ->i_mode of something we had not created {CVE-2026-98451} - smb: client: record CreateAction FILE_CREATED from SMB2 opens {CVE-2026-98451} - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491} - tcp: prevent collapsing skbs across boundary in rtx queue {CVE-2026-98549} - tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data() {CVE-2026-98549} - tcp: add a helper for setting EOR on tail skb {CVE-2026-98549} - btrfs: fix xattr replace when multiple xattrs are packed in the same item {CVE-2026-98959} - tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() {CVE-2026-98374} - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} - smb: client: use finish_no_open() for non-regular inodes {CVE-2026-98451} - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - drm/virtio: use the DMA API for resource backing on Xen {CVE-2026-98156} - thunderbolt: Fix KASAN reported use-after-free when request is canceled {CVE-2026-98694} - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129} - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} - 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879} - gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570} - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794} - fanotify: fix false positive on permission events {CVE-2026-46150} - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863} - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864} - xprtrdma: Repost Receive buffers for malformed replies {CVE-2026-72464} - Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965} - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - ALSA: bcd2000: Fix race between rawmidi and disconnect {CVE-2026-98316} - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} - Bluetooth: hci_core: Fix calling mgmt_device_connected {CVE-2024-49950} - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950} - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066} - PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614} - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} - smb: client: reject SetEA requests that do not fit the request buffer {CVE-2026-99109} - ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - net: gso: limit recursive IP-in-IP segmentation {CVE-2026-98853} - tty: fix saved termios reset race {CVE-2026-98750} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827} - wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709} - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - ALSA: mixer: oss: Add card disconnect checkpoints {CVE-2026-43126} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} - ice: fix double-free of tx_buf skb {CVE-2026-53009} - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720} - tls: separate no-async decryption request handling from async {CVE-2024-58240} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386} - Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp {CVE-2026-74540} - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604} - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} - watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger {CVE-2024-38630} - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} - isofs: fix out-of-bounds page array access on empty zisofs block {CVE-2026-89778} - drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546} - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813} - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} - net/sched: Retire tcindex classifier {CVE-2023-1829} - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} - init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} - drm/amd/pm: Fix negative array index read {CVE-2024-46821} - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} - netfilter: use get_random_u32 instead of prandom {CVE-2022-49698} - KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716} - net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527} - netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942} - ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786} - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} - btrfs: fix use-after-free when COWing tree bock and tracing is enabled {CVE-2024-56759} - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} - cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode() {CVE-2026-98972} - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} - mm/huge_memory: update file PMD counter before folio_put() {CVE-2026-53189} - ALSA: seq: Serialize compat port-info ioctls {CVE-2026-98742} - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - slip: fix use-after-free in sl_sync() {CVE-2026-81001} - fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541} - fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083} - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191} - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219} - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596} - wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281} - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133} - e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026} - btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067} - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531} - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120} - usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904} - USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957} - xfrm: route MIGRATE notifications to caller's netns {CVE-2026-63914} - USB: serial: cypress_m8: validate interrupt packet headers {CVE-2026-63902} - USB: serial: mct_u232: fix memory corruption with small endpoint {CVE-2026-63898} - USB: serial: digi_acceleport: fix memory corruption with small endpoints {CVE-2026-63901} - scsi: libiscsi: Reject a negative task index from parse_pdu_itt {CVE-2026-99154} - USB: serial: belkin_sa: validate interrupt status length {CVE-2026-63903} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check {CVE-2026-63913} - USB: serial: cypress_m8: fix memory corruption with small endpoint {CVE-2026-63956} - USB: serial: omninet: fix memory corruption with small endpoint {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint {CVE-2026-63899} - ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} - perf/aux: Fix AUX buffer serialization {CVE-2024-46713} - netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912} - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - net/sched: teql: Fix double-free in teql_master_xmit {CVE-2026-23449} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576} - btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount {CVE-2024-57896} - tracing: Take trace_array reference when opening options file {CVE-2026-90013} - btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759} - wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708} - ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} - tcp: clear sock_ops cb flags before force-closing a child socket {CVE-2026-74268} - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() {CVE-2026-63806} - drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063} - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116} - netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131} - smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - net/sched: flower: Fix chain template offload {CVE-2024-26669} - nfsd: provide locking for v4_end_grace {CVE-2026-22980} - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} - Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex {CVE-2026-99009} - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} - ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656} - ocfs2/dlm: Protect the recovery list during debugfs reads {CVE-2026-99204} - ipv6: validate extension header length before copying to cmsg {CVE-2026-63920} - keys: Pin request_key_auth payload in instantiate paths {CVE-2026-63823} - scsi: libiscsi: Validate the ITT reflected in a Reject PDU {CVE-2026-99153} - ALSA: ua101: reject mismatched capture/playback packet sizes {CVE-2026-98741} - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} - vsock: treat TCP_CLOSING as once-established {CVE-2026-99213} - scsi: st: Fix use-after-free race between st_remove() and st_open() {CVE-2026-99156} - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602} - ocfs2: validate lengths in dlm_mig_lockres_handler {CVE-2026-89494} - net/sched: fix use-after-free in __tcf_action_put() {CVE-2026-99167} - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203}