- wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133} - wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133} - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957} - KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344} - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133} - crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231} - tls: handle data disappearing from under the TLS ULP {CVE-2025-38616} - Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140} - Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering) - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579} - net: add exit_batch_rtnl() method - rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118} - virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769} - ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233} - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} - scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371} - net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670} - intel_th: fix device leak on output open() {CVE-2026-23091} - batman-adv: reject oversized global TT response buffers {CVE-2026-31659} - rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642} - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627} - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498} - mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434} - x86/efi: defer freeing of boot services memory {CVE-2026-23352} - KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198} - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112} - usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108} - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104} - drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083} - amba: bus: fix refcount leak {CVE-2023-54230} - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194} - octeontx2-af: Add validation for lmac type {CVE-2023-54129} - rcu: dump vmalloc memory info safely {CVE-2023-54113} - wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071} - bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033} - ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866} - netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863} - md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848} - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824} - net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663} - bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650} - blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227} - usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501} - scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110} - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563} - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395} - Bluetooth: L2CAP: Fix responding with wrong PDU type - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}