- libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984} - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068} - drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833} - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} - scsi: sg: Do not sleep in atomic context {CVE-2025-40259} - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664} - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827} - drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410} - ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051} - tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696} - wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022} - drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662} - drm/i915: Release i915_gem_context from a worker {CVE-2022-48662} - KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} - media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405} - net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356} - skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354} - nfsd: call op_release, even when op_func returns an error {CVE-2023-53241} - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343} - RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393} - scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350} - Make filldir[64]() verify the directory entry filename is valid {CVE-2019-10220} - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170} - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} - proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566} - cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138} - bpf: Fix ringbuf helper function compatibility {CVE-2021-34866} - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238} - ice: Fix memory corruption in VF driver {CVE-2022-49722} - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} - tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600} - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} - KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221} - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685} - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532} - can: af_can: export can_sock_destruct()