* CVE-2026-46113 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113} * CVE-2022-50300 - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300} * CVE-2022-50082 - ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082} * CVE-2026-43052 - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} * CVE-2026-43386 - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386} * CVE-2026-23281 - wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281} * CVE-2026-43141 - ntb: ntb_hw_switchtec: Fix shift-out-of-bounds for 0 mw lut {CVE-2026-43141} * CVE-2026-23209 - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209} * CVE-2026-23001 - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001} * CVE-2026-31532 - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532} * CVE-2026-31688 - driver core: enforce device_lock for driver_match_device() {CVE-2026-31688} * CVE-2023-53680 - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680} * CVE-2025-38718 - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} * CVE-2025-38102 - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} * CVE-2024-42120 - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120} * CVE-2022-50093 - iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093} * CVE-2022-50410 - NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-50410} * CVE-2026-23234 - f2fs: fix to avoid UAF in f2fs_write_end_io() {CVE-2026-23234} * CVE-2026-43203 - atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203} * CVE-2026-43373 - net: ncsi: fix skb leak in error paths {CVE-2026-43373} * CVE-2026-43450 - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} * CVE-2026-31399 - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} * CVE-2026-43449 - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449} * CVE-2026-43427 - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} * CVE-2026-31452 - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} * CVE-2026-23397 - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397} * CVE-2025-71082 - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} * CVE-2025-39955 - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955} * CVE-2022-49770 - ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770} * CVE-2026-43283 - net: ethernet: ec_bhf: Fix dma_free_coherent() dma handle {CVE-2026-43283} * Bump ABI 4.15.0-261