* CVE-2022-49267 - mmc: core: use sysfs_emit() instead of sprintf() {CVE-2022-49267} - mmc: sdio: Export SDIO revision and info strings to userspace {CVE-2022-49267} * CVE-2026-43040 - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} * CVE-2026-43027 - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} * CVE-2025-71091 - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} * CVE-2025-71075 - scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075} * CVE-2025-38565 - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} * CVE-2025-38401 - mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401} * CVE-2023-53218 - rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218} * CVE-2025-38230 - jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230} * CVE-2023-52867 - drm/radeon: possible buffer overflow {CVE-2023-52867} * CVE-2023-53432 - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} * CVE-2025-39891 - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891} * CVE-2025-38666 - net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666} * CVE-2025-39828 - atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() {CVE-2025-39828} * CVE-2026-43020 - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} * CVE-2026-43011 - net/x25: Fix potential double free of skb {CVE-2026-43011} * CVE-2026-31778 - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778} * CVE-2026-31748 - comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748} * CVE-2026-31747 - comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747} * CVE-2026-31720 - usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720} * CVE-2026-31696 - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696} * CVE-2026-31659 - batman-adv: reject oversized global TT response buffers {CVE-2026-31659} * CVE-2026-31629 - nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629} * CVE-2026-31626 - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626} * CVE-2026-31622 - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622} * CVE-2026-31602 - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} * CVE-2026-31583 - media: em28xx: fix use-after-free in em28xx_v4l2_open() {CVE-2026-31583} * CVE-2026-31581 - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} * CVE-2026-31576 - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() {CVE-2026-31576} * CVE-2026-31504 - net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504} * CVE-2026-23388 - Squashfs: check metadata block offset is within range {CVE-2026-23388} * CVE-2026-23372 - nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372} * Bump ABI 4.15.0-259