* CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113} * CVE-2024-39467 - f2fs: fix to do sanity check on i_xattr_nid in sanity_check_inode() {CVE-2024-39467} * CVE-2023-52796 - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796} * CVE-2025-37879 - 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879} * CVE-2022-49934 - wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934} * CVE-2025-38117 - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117} * CVE-2025-39686 - comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686} * CVE-2022-50169 - wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() {CVE-2022-50169} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2026-23001 - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001} * CVE-2026-31527 - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} * CVE-2026-46300 - net: skbuff: preserve shared-frag marker during coalescing {CVE-2026-46300} - net: skbuff: propagate shared-frag marker through frag-transfer helpers {CVE-2026-46300} * CVE-2026-23281 - wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281} * CVE-2022-50279 - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279} * CVE-2025-39901 - i40e: remove read access to debugfs files {CVE-2025-39901} * CVE-2024-41013 - xfs: don't walk off the end of a directory data block {CVE-2024-41013} * CVE-2024-58072 - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} * CVE-2025-38377 - rose: fix dangling neighbour pointers in rose_rt_device_down() {CVE-2025-38377} * CVE-2025-71091 - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} * CVE-2023-53254 - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254} * CVE-2025-21811 - nilfs2: protect access to buffers with no active references {CVE-2025-21811} * CVE-2025-39955 - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955} * CVE-2025-38702 - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} * CVE-2026-31500 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} * CVE-2025-39911 - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} * CVE-2025-38102 - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} * CVE-2025-38565 - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} * CVE-2023-53153 - wifi: cfg80211: Fix use after free for wext {CVE-2023-53153} * CVE-2025-39866 - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866} * CVE-2025-38724 - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724} * CVE-2026-31581 - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} * CVE-2025-71082 - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} * CVE-2023-53510 - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} * CVE-2026-31627 - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627} * CVE-2026-31452 - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} * CVE-2026-23397 - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397} * CVE-2025-71093 - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} * Bump ABI 4.4.0-284