- ipv4: validate checksum_start before completing checksum {CVE-2026-99999} - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366} - nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196} - tracing: Set the trace clock before registering the histogram trigger {CVE-2026-97935} - tracing: Fix use-after-free with same-name named triggers {CVE-2026-89746} - svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530} - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - ceph: fix UAF in check_new_map() on session freed during unlock {CVE-2026-89654} - dm array: validate array block headers on read {CVE-2026-89574} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117} - wifi: ath9k_htc: don't store usb_device_id {CVE-2026-97541} - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} - fbcon: Set fb_display[i]->mode to NULL when the mode is released {CVE-2025-40323} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835} - tipc: fix use-after-free of the discoverer in tipc_disc_rcv() {CVE-2026-64543}