* CVE-2026-31602 - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} * CVE-2026-43241 - ntb: ntb_hw_switchtec: Fix array-index-out-of-bounds access {CVE-2026-43241} * CVE-2026-23281 - wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281} * CVE-2025-71116 - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} * CVE-2022-49892 - ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892} * CVE-2022-3625 - devlink: Fix use-after-free after a failed reload {CVE-2022-3625} * CVE-2022-50552 - blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552} * CVE-2026-31581 - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} * CVE-2025-68366 - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} * CVE-2026-43203 - atm: fore200e: fix use-after-free in tasklets during device removal {CVE-2026-43203} * CVE-2026-23361 - PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry {CVE-2026-23361} * CVE-2025-71082 - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} * CVE-2025-71199 - iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver {CVE-2025-71199} * CVE-2026-31626 - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626} * CVE-2026-43427 - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} * CVE-2025-71136 - media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() {CVE-2025-71136} * CVE-2026-31780 - wifi: wilc1000: fix u8 overflow in SSID scan buffer size calculation {CVE-2026-31780} * CVE-2026-43052 - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} * CVE-2026-43386 - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386} * CVE-2026-43370 - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} * CVE-2026-43011 - net/x25: Fix potential double free of skb {CVE-2026-43011} * CVE-2026-43027 - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} * CVE-2026-43020 - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} * CVE-2026-31748 - comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748} * CVE-2026-31747 - comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747} * CVE-2026-31696 - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696} * CVE-2026-31452 - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} * CVE-2026-31399 - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} * CVE-2026-43450 - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} * CVE-2024-26988 - init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988} * Miscellaneous upstream changes - ubuntu20: de-symlink debian/changelog to a real copy * Bump ABI 5.4.0-232