- net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492} - ocfs2: validate dx_root extent list fields during block read {CVE-2026-89492} - nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480} - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} - sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477} - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} - netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565} - packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550} - tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404} - net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390} - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390} - Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676} - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} - sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476} - sctp: distinguish sequence zero from wildcard in reconf lookup {CVE-2026-89476} - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} - net: Introduce skb tc depth field to track packet loops {CVE-2026-63983} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255} - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246} - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} - scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} - RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354} - sctp: validate embedded address parameter length {CVE-2026-74287} - nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674} - IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} - nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135} - ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090} - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} - gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} - mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328} - mt76: fix per-driver wcid range checks after wcid array size bump {CVE-2022-49328} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075} - sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971} - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} - ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942} - iommu/vt-d: Clear Present bit before tearing down PASID entry {CVE-2026-45894} - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051} - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} - padata: fix UAF in padata_reorder {CVE-2025-21727} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() {CVE-2026-64446} - staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth() {CVE-2026-64445} - staging: rtl8723bs: fix out-of-bounds read in rtw_get_ie() parser {CVE-2025-68256} - staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop {CVE-2026-64443} - staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl() {CVE-2026-64442} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438} - crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438} - crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438} - usb: free iso schedules on failed submit {CVE-2026-64348} - USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344} - USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - crypto: qat - protect service table iterations with service_lock {CVE-2026-64305} - crypto: qat - validate RSA CRT component lengths {CVE-2026-64304} - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - mfd: cros_ec: Delay dev_set_drvdata() until probe success {CVE-2026-64420} - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} - usb: typec: tcpm: Validate SVID index in svdm_consume_modes() {CVE-2026-64330} - smb: client: Fix next buffer leak in receive_encrypted_standard() {CVE-2026-64381} - smb: client: mask server-provided mode to 07777 in modefromsid {CVE-2026-64379} - writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378} - writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378} - proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375} - ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001} - perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637} - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744} - openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488} - net: pktgen: fix proc entry use-after-free {CVE-2026-74479} - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388} - tipc: require net admin for TIPCv2 netlink mutators {CVE-2026-74283} - wifi: cfg80211: use wiphy work for socket owner autodisconnect {CVE-2026-68404} - HID: sony: clean up device list on probe failure {CVE-2026-90041} - KVM: nVMX: Always flush vpid02 on first use {CVE-2026-89932} - RDMA/core: Fix potential use after free in counter_release() {CVE-2026-92509} - ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398} - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320} - sctp: prevent peer transport count overflow {CVE-2026-74469}