- can: esd_usb: kill anchored URBs before freeing netdevs {CVE-2026-64585} - ext4: fix kernel BUG in ext4_write_inline_data_end {CVE-2026-74308} - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop {CVE-2026-72348} - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() {CVE-2026-64580} - platform/x86: dell-laptop: fix missing cleanups in init error path {CVE-2026-72144} - ALSA: seq: Clear variable event pointer on read {CVE-2026-74339} - netfilter: xt_cluster: reject template conntracks in hash match {CVE-2026-72256} - net/sched: cls_flow: Dont expose folded kernel pointers {CVE-2026-74290} - mfd: sm501: Fix reference leak on failed device registration {CVE-2026-72240} - net: atm: reject out-of-range traffic classes in QoS validation {CVE-2026-72297} - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser {CVE-2026-64487} - scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker {CVE-2026-63890} - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331} - RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415} - isofs: release zisofs block pointer buffer head {CVE-2026-90434} - HID: roccat: bound device-supplied profile index {CVE-2026-93188} - fat: release buffer head after rebuilding parent {CVE-2026-90318} - wifi: mac80211: ibss: wait for in-flight TX on disconnect {CVE-2026-93804} - wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403} - serial: core: clear freed pointers on uart_register_driver() failure {CVE-2026-90336} - locking/lockdep: Fix NULL pointer dereference in __lock_set_class() {CVE-2026-93261} - smb: client: reject short READ responses in CIFSSMBRead() {CVE-2026-97565} - UDF symlink pathComponent header OOB read {CVE-2026-93055} - ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521} - RDMA/ipoib: Drain RCU callbacks during module teardown {CVE-2026-93108} - cifs: call pagecache_isize_extended() in cifs_setsize() when extending {CVE-2026-89642} - nfsd: release path refs on follow_down() error {CVE-2026-89707} - HID: roccat: free buffered reports when destroying device {CVE-2026-89627} - NTB: ntb_transport: Reject oversized TX buffers {CVE-2026-80987} - wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() {CVE-2026-80949} - svcrdma: Reject connection when transport allocation fails {CVE-2026-89531} - xfrm: fix xfrm_state_construct() auth-trunc leak {CVE-2026-80843} - sctp: reject stale cookies with mismatched verification tags {CVE-2026-80890} - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails {CVE-2022-50821} - ipv6/sit: use DEV_STATS_INC() to avoid data-races {CVE-2022-50764} - mtd: Fix device name leak when register device failed in add_mtd_device() {CVE-2022-50566} - virtio_console: eliminate anonymous module_init & module_exit {CVE-2022-49100} - mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) {CVE-2022-49077} - lockd: fix NULL dereference on lockowner allocation failure {CVE-2026-89484} - mfd: sm501: Fix potential memory leaks during remove {CVE-2026-80974} - wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start() {CVE-2026-80948} - acct: fix potential integer overflow in encode_comp_t() {CVE-2022-50749} - media: dvb-frontends: fix leak of memory fw {CVE-2022-50664} - usb: core: Add lock to usb_wakeup_notification() {CVE-2026-80830} - rndis_host: add overflow check in rndis_rx_fixup() {CVE-2026-80814} - udf: reject VAT indexes equal to the entry count {CVE-2026-89525} - lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() {CVE-2026-89726} - ceph: bound xattr value length in __build_xattrs() {CVE-2026-89649} - bnx2x: fix double free in bnx2x_init_firmware() error path {CVE-2026-89582} - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551} - sctp: stop processing a packet once its association is deleted {CVE-2026-89479} - ALSA: aloop: Check card index validity at probe {CVE-2026-80972} - ALSA: mpu401: Check card index validity at probe {CVE-2026-80969} - ALSA: virmidi: Check card index validity at probe {CVE-2026-80964} - ALSA: dummy: Check card index validity at probe {CVE-2026-80812} - dm array: reject an array block whose value size is not the caller's {CVE-2026-89573} - drm/vmwgfx: bound DMA command body size against suffix pointer {CVE-2026-74443} - fbcon: fix NULL pointer dereference for a console without vc_data {CVE-2026-74424} - fbdev: clear fb_info->mode before deleting a videomode {CVE-2026-80579} - fbdev: bound mode sysfs output to the sysfs buffer {CVE-2026-80580} - ALSA: usb-audio: Clamp frame size in implicit-feedback mode {CVE-2026-74497} - can: peak_usb: add bounds check for USB channel index {CVE-2026-74457} - can: kvaser_usb_leaf: kvaser_usb_leaf_wait_cmd(): validate received command extents {CVE-2026-74458} - vxlan: use pskb_network_may_pull() for transmit path header pulls {CVE-2026-74474} - vxlan: use neigh_ha_snapshot() in route_shortcircuit() {CVE-2026-74475} - vxlan: use pskb_network_may_pull() in route_shortcircuit() {CVE-2026-74473} - HID: magicmouse: do not keep a stale msc->input if no input is claimed {CVE-2026-80782} - selinux: reject a class permission count below its inherited common {CVE-2026-80757} - selinux: reject a permission value exceeding the class permission count {CVE-2026-80755} - USB: serial: safe_serial: fix memory corruption with small endpoint {CVE-2026-63957} - ipv4: reject undersized MTUs in ip_do_fragment() {CVE-2026-80793} - HID: core: fix OOB read of field->usage in hid_set_field() {CVE-2026-80781} - scsi: libiscsi: Fix stale-data leak into the SCSI sense buffer {CVE-2026-74557} - igbvf: Fix leak in TX DMA error cleanup {CVE-2026-74495} - sctp: validate Adaptation Indication parameter length {CVE-2026-80717} - ipvs: do not propagate one-packet flag to synced conns {CVE-2026-80714} - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read {CVE-2026-80603} - hwmon: (asus_atk0110) Check package count before accessing element {CVE-2026-80593} - hwmon: (adt7470) Fix busy-loop and I2C flooding in update thread {CVE-2026-74547} - Bluetooth: HIDP: validate numbered report payloads {CVE-2026-74507} - drm/radeon: fix memory leak in radeon_ring_restore() on lock failure {CVE-2026-74416} - dm-verity: make error counter atomic {CVE-2026-72096} - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432} - tracing: Check return value of __register_event() in trace_module_add_events() {CVE-2026-74471} - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - Bluetooth: RFCOMM: serialize security confirmation handling {CVE-2026-89569} - sctp: drop a chunk if its transport was removed {CVE-2026-89478} - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}