- net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} - static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954} - static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002} - smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350} - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978} - scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296} - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336} - smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295} - sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583} - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261} - usbnet: Prevents free active kevent {CVE-2025-68312} - libceph: bound get_version reply decode to front len {CVE-2026-68433} - neigh: let neigh_xmit take skb ownership {CVE-2026-52981} - gve: prevent ethtool ops after shutdown {CVE-2025-38735} - vfs: Don't leak disconnected dentries on umount {CVE-2025-40105} - NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803} - thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093} - quota: fix warning in dqgrab() {CVE-2023-54177} - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066} - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938} - net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054} - xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093} - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497} - bpf: Fix OOB in pcpu_init_value {CVE-2026-53076} - ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402} - binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239} - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929} - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102} - xen: Add support for XenServer 6.1 platform device {CVE-2025-38046} - i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029} - bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086} - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291} - net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268} - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219} - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394} - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096} - scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723} - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192} - net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838} - clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767} - net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245} - drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704} - crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721} - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698} - smb: client: split cached_fid bitfields to avoid shared-byte RMW races {CVE-2026-23230} - net/smc: initialize close_work early to avoid warning {CVE-2024-56641} - netfilter: nft_ct: add seqadj extension for natted connections {CVE-2025-68206} - net/sched: sch_netem: fix out-of-bounds access in packet corruption {CVE-2026-31675} - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() {CVE-2026-31426} - bpf: Reject sleepable kprobe_multi programs at attach time {CVE-2026-43010} - ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459} - mm: hugetlb: avoid soft lockup when mprotect to large memory area {CVE-2025-40153} - mptcp: pm: ADD_ADDR rtx: fix potential data-race {CVE-2026-46137} - Input: uinput - take event lock when submitting FF request "event" - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result {CVE-2024-35998} - drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269} - netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243} - net/mlx5e: xsk: Fix unlocked writing to ICOSQ {CVE-2026-64210} - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243} - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen {CVE-2026-23253} - drm/tegra: nvdec: Fix dma_alloc_coherent error check {CVE-2025-38543} - tls: Purge async_hold in tls_decrypt_async_wait() {CVE-2026-23414} - tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322} - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c {CVE-2024-56725} - cpufreq: CPPC: Add u64 casts to avoid overflowing {CVE-2022-49750} - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions {CVE-2022-49715} - ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909} - spi: fix use-after-free on controller registration failure {CVE-2026-31389} - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw() {CVE-2025-22005} - bpf: Fix stackmap overflow check in __bpf_get_stackid() {CVE-2025-68378} - bpf: Fix RCU stall in bpf_fd_array_map_clear() {CVE-2026-53083} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329} - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure {CVE-2026-23142} - Squashfs: reject negative file sizes in squashfs_read_inode() {CVE-2025-40200} - i40e: Fix preempt count leak in napi poll tracepoint {CVE-2026-23313} - i2c: core: fix adapter deregistration race {CVE-2026-64279} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268} - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564} - Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}