- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - net: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-72055} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917} - bpf: Mask pseudo pointer values in verifier logs {CVE-2026-72402} - drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286} - wifi: ath11k: fix NULL pointer dereference in ath11k_hal_srng_access_begin {CVE-2026-68362} - gve: fix Rx queue stall on alloc failure {CVE-2026-68129} - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} - net: qrtr: restrict socket creation to the initial network namespace {CVE-2026-68294} - nbd: restrict sockets to TCP and UDP {CVE-2025-40080} - audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096} - scsi: smartpqi: Fix device resources accessed after device removal {CVE-2025-68371} - cifs: fix oops during encryption {CVE-2022-50341} - net: qrtr: ns: Limit the maximum server registration per node {CVE-2026-43491} - mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - xfs: don't swallow dquot recovery verification errors {CVE-2026-80529} - xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529} - xfs: clean up dqblk extraction {CVE-2026-80529} - Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188} - bpf: Fix accesses to uninit stack slots {CVE-2023-52452} - bpf: Allow reads from uninit stack {CVE-2023-52452} - fbdev: Fix incorrect page mapping clearance at fb_deferred_io_release() {CVE-2023-52731} - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324} - nfsd: make sure exp active before svc_export_show {CVE-2024-56558} - Input: elan_i2c - validate firmware size before use {CVE-2026-64237} - net/sched: ets: use old 'nbands' while purging unused classes {CVE-2025-38684} - net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107} - fbcon: Fix OOB access in font allocation {CVE-2025-39967} - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967} - kyber: fix out of bounds access when preempted {CVE-2021-46984} - padata: Reset next CPU when reorder sequence wraps around {CVE-2025-38584} - padata: Fix pd UAF once and for all {CVE-2025-38584} - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854} - xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788} - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788} - Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151} - Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981} - xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463} - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663} - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333} - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840} - ALSA: firewire-motu: add bounds check in put_user loop for DSP events {CVE-2025-68753} - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events {CVE-2025-68347} - HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020} - HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454} - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161} - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286} - cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427} - cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260} - cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006} - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093} - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446} - ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size {CVE-2023-53265} - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265} - usbnet: Prevents free active kevent {CVE-2025-68312} - usbnet: Fix linkwatch use-after-free on disconnect {CVE-2022-50220} - lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() {CVE-2023-53484} - lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484} - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - tipc: fix UAF in tipc_l2_send_msg() {CVE-2026-74255} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} - ACPICA: Apply pack(1) to union aml_resource {CVE-2026-97445} - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} - dmaengine: wait for RCU readers before releasing dma_device {CVE-2026-98342} - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} - IB/mlx4: Fix use-after-free on pkey sysfs registration failure {CVE-2026-98217} - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} - wifi: ath9k: fix OOB access from firmware tx status queue ID {CVE-2026-74408} - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} - tipc: prevent snt_unacked underflow on CONN_ACK {CVE-2026-74282} - dmaengine: Fix possible use after free {CVE-2026-72476} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check {CVE-2026-89818} - drm/amdgpu/vcn3: Avoid overflow on msg bound check {CVE-2026-46237} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg {CVE-2026-46230} - drm/amdgpu/vcn4: Avoid overflow on msg bound check {CVE-2026-46217} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg {CVE-2026-46199} - smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - proc/fd: In proc_fd_link use fget_task {CVE-2026-64375} - proc: convert the return type of proc_fd_access_allowed() to be boolean {CVE-2026-64375} - usb: free iso schedules on failed submit {CVE-2026-64348} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - udf: validate VAT header length against the VAT inode size {CVE-2026-64323} - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375} - virtio-net: build xdp_buff with multi buffers {CVE-2025-38375} - virtio-net: disable the hole mechanism for xdp {CVE-2025-38375}