* CVE-2026-31607 - usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607} * CVE-2026-31527 - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} * CVE-2026-43493 - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493} * CVE-2026-43038 - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038} * CVE-2026-43037 - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} * CVE-2026-23083 - fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083} * CVE-2024-57982 - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} * CVE-2024-50115 - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115} * CVE-2026-53166 - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166} * CVE-2026-43499 - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499} * CVE-2023-6546 - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546} * CVE-2023-53510 - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} * CVE-2023-53286 - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286} * CVE-2023-53259 - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259} * CVE-2026-31500 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} * CVE-2023-52916 - media: aspeed: Fix memory overwrite if timing is 1600x900 {CVE-2023-52916} * CVE-2022-50021 - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} * CVE-2022-49799 - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799} * CVE-2022-49234 - net: dsa: Avoid cross-chip syncing of VLAN filtering {CVE-2022-49234} * CVE-2022-48744 - net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744} * CVE-2026-23164 - rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164} * CVE-2026-23150 - nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). {CVE-2026-23150} * CVE-2026-23133 - wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133} * CVE-2026-23121 - mISDN: annotate data-race around dev->work {CVE-2026-23121} * CVE-2026-23108 - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108} * CVE-2026-23103 - ipvlan: Make the addrs_lock be per port {CVE-2026-23103} * CVE-2026-23101 - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101} * CVE-2026-23095 - gue: Fix skb memleak with inner IP protocol 0. {CVE-2026-23095} * CVE-2026-23084 - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084} * CVE-2026-23080 - can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23080} * CVE-2026-23071 - regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071} * CVE-2026-23058 - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058} * CVE-2026-23038 - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038} * CVE-2026-23011 - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011} * CVE-2026-23003 - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003} * CVE-2025-71194 - btrfs: fix deadlock in wait_current_trans() due to ignored transaction type {CVE-2025-71194} * CVE-2026-31417 - net/x25: Fix overflow when accumulating packets {CVE-2026-31417} * CVE-2026-31396 - net: macb: fix use-after-free access to PTP clock {CVE-2026-31396} * CVE-2025-68769 - f2fs: fix return value of f2fs_recover_fsync_data() {CVE-2025-68769} * CVE-2025-68289 - usb: gadget: f_eem: Fix memory leak in eem_unwrap {CVE-2025-68289} * Miscellaneous upstream changes - xen/privcmd: fix double free via VMA splitting - net: do not delay dst_entries_add() in dst_release() - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer - drm/amd/pm: Fix negative array index read - drm/amd/display: Check link_index before accessing dc->links[] - xfs: don't walk off the end of a directory data block - wifi: cfg80211: check A-MSDU format more carefully - smb: client: fix potential UAF in cifs_stats_proc_write() - f2fs: fix to tag gcing flag on page during block migration - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() - drivers core: Use sysfs_emit for shared_cpu_map_show and shared_cpu_list_show * Bump ABI 5.4.0-235