- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444} - ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} - ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448} - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548} - SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542} - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} - nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481} - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569} - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751} - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022} - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596} - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238} - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - xfrm: ah6: validate routing header segments_left {CVE-2026-80844} - drm/amd/display: set new_stream to NULL after release {CVE-2026-68236} - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075} - nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129} - ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964} - crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} - tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289} - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - rhashtable: clear stale iter->p on table restart {CVE-2026-64563} - mpls: reload header after pskb_may_pull() {CVE-2026-89555} - net: tun: bound receive headroom {CVE-2026-81000} - netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664} - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} - firewire: net: remove unused variable 'guid' {CVE-2023-53432} - gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760} - gfs2: fix kernel BUG in gfs2_quota_cleanup {CVE-2023-52760} - gfs2: Fix asynchronous thread destruction {CVE-2023-52760} - gfs2: Stop using gfs2_make_fs_ro for withdraw {CVE-2023-52760} - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612} - crypto: scompress - initialize per-CPU variables on each CPU {CVE-2023-52612} - crypto: scompress - Use per-CPU struct instead multiple variables {CVE-2023-52612} - crypto: scompress - return proper error code for allocation failure {CVE-2023-52612} - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536} - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687} - virtio_net: avoid using netif_tx_disable() for serializing tx routine {CVE-2022-49687} - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991} - mm/khugepaged: unify collapse pmd clear, flush and free {CVE-2022-48991} - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724} - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} - net: tunnels: annotate lockless accesses to dev->needed_headroom {CVE-2023-53109} - net/sched: act_ct: fix sk_buff leak when the header checks reject a packet {CVE-2026-74621} - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108} - net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583} - vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580} - NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730} - NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730} - enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725} - drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}