- net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331} - net: add xmit recursion limit to tunnel xmit functions {CVE-2026-23276} - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 {CVE-2026-23005} - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321} - net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY {CVE-2025-37945} - xfs: delete attr leaf freemap entries when empty {CVE-2026-43158} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183} - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx - scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list {CVE-2023-53627} - bonding: annotate data-races around slave->last_rx {CVE-2026-23212} - rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118} - net: phy: register phy led_triggers during probe to avoid AB-BA deadlock {CVE-2026-23368} - tracing: Do not register unsupported perf events {CVE-2025-71125} - ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118} - icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398} - nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372} - bridge: cfm: Fix race condition in peer_mep deletion {CVE-2026-23393} - batman-adv: reject oversized global TT response buffers {CVE-2026-31659} - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622} - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938} - virtiofs: use pages instead of pointer for kernel direct IO {CVE-2024-53219} - acct: perform last write from workqueue {CVE-2025-21846} - NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232} - atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546} - efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}