- FIX: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} - mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit(). - net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out() - ipv4: start using dst_dev_rcu() - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075} - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170} - udp6: Fix race condition in udp6_sendmsg & connect - ipv6: use RCU in ip6_output() {CVE-2025-40158} - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} - ipv6: start using dst_dev_rcu() - net: dst: introduce dst->dev_rcu - neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158} - net: Add locking to protect skb->dev access in ip_output - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers - ipv6: adopt dst_dev() helper - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] - net: dst: add four helpers to annotate data-races around dst->dev - tcp: convert to dev_net_rcu() - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} - ndisc: ndisc_send_redirect() cleanup - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() - ipv6: icmp: convert to dev_net_rcu() - ipv4: icmp: convert to dev_net_rcu() - ipv4: use RCU protection in __ip_rt_update_pmtu() {CVE-2025-21766} - ipv6: use RCU protection in ip6_default_advmss() {CVE-2025-21765} - fix: ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764} - neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763} - arp: use RCU protection in arp_xmit() {CVE-2025-21762} - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761} - ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760} - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759} - ipv6: mcast: add RCU protection to mld_newpack() {CVE-2025-21758} - ipv4: use RCU protection in rt_is_expired() - ipv4: use RCU protection in inet_select_addr() - ipv4: add RCU protection to ip4_dst_hoplimit() - flow_dissector: use RCU protection to fetch dev_net() - net: add dev_net_rcu() helper - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() - Revert "net: add dst_dev_rcu() helper for safe dst->dev access" - Revert "net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}" - Revert "ipv6: use RCU for dst->dev access in ip6_xmit, ip6_output, ip6_finish_output2 {CVE-2025-40135} {CVE-2025-40158}" - nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers {CVE-2026-23112} - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125} - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} - drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287} - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}