- ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210} - tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138} - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681} - cpuset: fix warning when disabling remote partition {CVE-2025-71142} - virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064} - netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126} - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460} - idpf: fix error handling in the init_task on load {CVE-2026-23017} - rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066} - block: zero non-PI portion of auto integrity buffer {CVE-2026-23007} - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665} - virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169} - net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154} - gfs2: Validate i_depth for exhash directories {CVE-2025-38710} - KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198} - ipvlan: Make the addrs_lock be per port {CVE-2026-23103} - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} - can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088} - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096} - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161} - scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236} - net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656} - iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087} - net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379} - can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925} - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531} - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003} - drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540} - mac802154: check local interfaces before deleting sdata list {CVE-2024-57948} - lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002} - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808} - net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979} - irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290} - io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113} - net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815} - net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546} - ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813} - openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681} - net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742} - module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521} - udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946} - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947} - scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110} - nbd: don't allow reconnect after disconnect {CVE-2025-21731} - nfsd: check that server is running in unlock_filesystem {CVE-2026-22989} - af_key: validate families in pfkey_send_migrate() {CVE-2026-31515} - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} - scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235} - smc91x: fix broken irq-context in PREEMPT_RT {CVE-2025-71132} - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548} - net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095} - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779} - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096} - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498} - ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097} - idpf: fix null-ptr-deref in idpf_features_check {CVE-2025-38053} - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381} - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989} - crypto: null - Use spin lock instead of mutex {CVE-2025-37808} - x86/efistub: Call mixed mode boot services on the firmware's stack {CVE-2024-35803} - ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172} - ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167} - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al {CVE-2025-38653} - block: mark GFP_NOIO around sysfs ->store() {CVE-2025-21817} - dlm: fix possible lkb_resource null dereference {CVE-2024-47809} - xfs: factor out xfs_attr3_leaf_init - crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721} - skbuff: Account for tail adjustment during pull operations {CVE-2022-50365} - libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232} - bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994} - tpm: Cap the number of PCR banks {CVE-2025-71077} - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} - wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure {CVE-2026-23444} - fuse: Fix missing FOLL_PIN for direct-io {CVE-2024-53219} - tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007} - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273} - can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357} - ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389} - ASoC: SOF: ipc4-topology: Harden loops for looking up ALH copiers {CVE-2025-21870} - idpf: fix memory leak in idpf_vport_rel() {CVE-2026-23023} - Octeontx2-af: Add proper checks for fwdata {CVE-2026-23070} - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() {CVE-2022-48972} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} - NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803} - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058} - net/sched: cls_api: fix error handling causing NULL dereference {CVE-2025-21857} - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194} - wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} - Bluetooth: bcsp: receive data only if registered {CVE-2025-40308} - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724} - rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634} - drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083} - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382} - wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367} - can: j1939: make j1939_session_activate() fail if device is no longer registered {CVE-2025-71182} - sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331} - HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625} - RDMA/cm: Fix leaking the multicast GID table reference {CVE-2025-71084} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} - rtc: check if __rtc_read_time was successful in rtc_timer_do_work() {CVE-2024-56739} - can: j1939: j1939_session_destroy(): fix memory leak of skbs {CVE-2024-56645} - Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497} - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521} - x86/CPU: Fix FPDSS on Zen1 {CVE-2026-31628} - io_uring: fix filename leak in __io_openat_prep() {CVE-2025-68814} - wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227} - cpufreq: Avoid a bad reference count on CPU node {CVE-2024-50012} - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} - wifi: rt2x00usb: fix devres lifetime {CVE-2026-31672} - ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820} - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() {CVE-2026-31512} - xfrm_user: fix info leak in build_report() {CVE-2026-31671} - xfrm: clear trailing padding in build_polexpire() {CVE-2026-31664} - ipv6: add NULL checks for idev in SRv6 paths {CVE-2026-23442} - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" {CVE-2025-71137} - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038} - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105} - ALSA: usb-audio: Kill timer properly at removal {CVE-2025-38105} - kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() {CVE-2025-22090} - mm: (un)track_pfn_copy() fix + doc improvements {CVE-2025-22090} - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090} - io_uring: fix overflow resched cqe reordering {CVE-2024-50060} - io_uring: check if we need to reschedule during overflow flush {CVE-2024-50060} - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN {CVE-2025-38048} - nvme-tcp: sanitize request list handling {CVE-2025-38264} - KVM: arm64: Reassign nested_mmus array behind mmu_lock {CVE-2026-46316} - drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488} - drm/xe: Fix an out-of-bounds shift when invalidating TLB {CVE-2025-37761} - fuse: reject oversized dirents in page cache {CVE-2026-31694} - bpf, sockmap: Avoid using sk_socket after free when sending {CVE-2025-38154} - thermal: core: Fix thermal zone device registration error path {CVE-2026-43332} - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). {CVE-2025-40186} - smb: client: fix OOB reads parsing symlink error response {CVE-2026-31613} - drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() {CVE-2025-71099} - scsi: sg: Do not sleep in atomic context {CVE-2025-40259} - net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect {CVE-2025-38385} - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED {CVE-2025-71122} - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback {CVE-2026-23013}