- nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers - RDMA/mlx5: Fix unsafe xarray access in implicit ODP handling - wifi: rtlwifi: pci: wait for firmware loading before releasing memory - wifi: rtlwifi: fix memory leaks and invalid access at probe error path {CVE-2024-58063} - tracing: Fix bad hist from corrupting named_triggers list {CVE-2025-21899} - PM / devfreq: Fix leak in devfreq_dev_release() {CVE-2023-53518} - net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization {CVE-2025-38725} - net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-37992} - nfsd: decrease sc_count directly if fail to queue dl_recall {CVE-2025-22025} - net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725} - nfsd: put dl_stid if fail to queue dl_recall {CVE-2025-22025} - rtnetlink: add missing netlink_ns_capable() check for peer netns {CVE-2026-31692} - mm: add smp_rmb() in pfn_swap_entry_to_page() to pair with THP split {CVE-2026-31466} - net_sched: Flush gso_skb list too during ->change() {CVE-2025-37992} - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() {CVE-2025-38106} - Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884} - mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434} - be2net: fix potential memory leak in be_xmit() {CVE-2024-50167} - net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data {CVE-2024-53058} - Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet {CVE-2024-55916} - idpf: detach and close netdevs while handling a reset {CVE-2026-22981} - ice: fix devlink reload call trace {CVE-2026-23104} - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112} - bpf: Prevent tailcall infinite loop caused by freplace {CVE-2024-47794} - crypto: pcrypt - restore callback for non-parallel fallback - crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY {CVE-2024-56690} - tracing/histograms: Allow variables to have some modifiers {CVE-2023-53093} - intel_th: fix device leak on output open() {CVE-2026-23091} - RDMA/mlx5: Fix implicit ODP hang on parent deregistration - RDMA/mlx5: Fix implicit ODP use after free {CVE-2025-21714} - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping {CVE-2025-38126} - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104} - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627} - scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232} - nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629} - gfs2: No more self recovery {CVE-2025-38659} - hugetlbfs: fix null-ptr-deref in hugetlbfs_parse_param() {CVE-2022-50334} - tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763} - CDC-NCM: avoid overflow in sanity checking {CVE-2022-48938} - cxl: Fix race of nvdimm_bus object when creating nvdimm objects {CVE-2026-23348} - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock {CVE-2026-31592} - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371} - md/raid1,raid10: don't ignore IO flags {CVE-2025-22125} - mm: slub: avoid wake up kswapd in set_track_prepare {CVE-2025-39843} - iommu/vt-d: Disallow dirty tracking if incoherent page walk {CVE-2025-40058} - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() {CVE-2025-23144} - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 {CVE-2025-21831} - drm/amd/display: Add null pointer check for get_first_active_display() {CVE-2025-38362} - pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map {CVE-2022-49832} - spi: fsl-qspi: Simplify probe error handling using managed API - spi: fsl-qspi: Fix double cleanup in probe error path - spi: fsl-qspi: use devm function instead of driver remove {CVE-2025-37842} - bnxt_en: Fix coredump logic to free allocated buffer - drm/amd/pm: Prevent division by zero {CVE-2025-37767} - tracing/histograms: Return an error if we fail to add histogram to hist_vars list - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations {CVE-2026-22985} - md/raid1: fix data lost for writemostly rdev {CVE-2025-22125} - drm/hisilicon/hibmc: fix the hibmc loaded failed bug {CVE-2025-39772} - Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() {CVE-2025-38473} - cxl: Move devm_cxl_add_nvdimm_bridge() to cxl_pmem.ko {CVE-2026-23348} - vsock: Fix transport_{g2h,h2g} TOCTOU {CVE-2025-38462} - can: j1939: j1939_session_new(): fix skb reference counting {CVE-2024-56645} - intel_th: Fix error handling in intel_th_output_open - i3c: Add NULL pointer check in i3c_master_queue_ibi() {CVE-2025-23147} - tracing: Do not let histogram values have some modifiers {CVE-2023-53093} - xsk: introduce helper to determine rxq->frag_size {CVE-2026-23377} - netlink: avoid infinite retry looping in netlink_unicast() {CVE-2025-38465} - netlink: make sure we allow at least one dump skb {CVE-2025-38465} - netlink: Fix rmem check in netlink_broadcast_deliver(). {CVE-2025-38465} - USB: core: Limit the length of unkillable synchronous timeouts {CVE-2026-43428} - net/mlx5e: Fix crash on profile change rollback failure {CVE-2026-23000} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211} - fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio {CVE-2024-26764} - FIX: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} - mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit(). - net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out() - ipv4: start using dst_dev_rcu() - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188} - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075} - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170} - ipv6: use RCU in ip6_output() {CVE-2025-40158} - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} - ipv6: start using dst_dev_rcu() - net: dst: introduce dst->dev_rcu - neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158} - net: Add locking to protect skb->dev access in ip_output - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers - ipv6: adopt dst_dev() helper - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] - net: dst: add four helpers to annotate data-races around dst->dev - tcp: convert to dev_net_rcu() - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} - ndisc: ndisc_send_redirect() cleanup - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu() - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() - ipv6: icmp: convert to dev_net_rcu() - ipv4: icmp: convert to dev_net_rcu() - FIX: ipv4: use rcu protection in __ip_rt_update_pmtu() {CVE-2025-21766} - arp: use RCU protection in arp_xmit() {CVE-2025-21762} - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761} - ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760} - ipv4: use RCU protection in rt_is_expired() - ipv4: use RCU protection in inet_select_addr() - ipv4: add RCU protection to ip4_dst_hoplimit() - flow_dissector: use RCU protection to fetch dev_net() - ubi: Fix possible null-ptr-deref in ubi_free_volume() {CVE-2024-25740} - wifi: rtlwifi: destroy workqueue at rtl_deinit_core - md/raid1,raid10: strip REQ_NOWAIT from member bios - md/raid1,raid10: don't handle IO error for REQ_RAHEAD and REQ_NOWAIT {CVE-2025-22125} - scsi: core: raid_class: Remove raid_component_add() - scsi: core: Fix possible memory leak if device_add() fails {CVE-2023-53174} - ceph: fix memory leaks in ceph_mdsc_build_path() - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - drm/amdgpu: ensure no_hw_access is visible before MMIO {CVE-2026-23213} - drm/amd/pm: Disable MMIO access during SMU Mode 1 reset {CVE-2026-23213} - USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429} - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} - netfilter: socket: Lookup orig tuple for IPv6 SNAT {CVE-2025-22021} - netlink: Fix wraparounds of sk->sk_rmem_alloc. {CVE-2025-38465} - net/mlx5e: Harden uplink netdev access against device unbind {CVE-2025-39947} - wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links {CVE-2024-57989} - rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642} - wifi: ath10k: shutdown driver when hardware is unreliable {CVE-2025-39746} - HID: core: clamp report_size in s32ton() to avoid undefined shift {CVE-2026-31624} - HID: asus: avoid memory leak in asus_report_fixup() {CVE-2026-31524} - genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie {CVE-2025-38062} - rdma/cxgb4: Prevent potential integer overflow on 32bit {CVE-2024-57973} - io_uring/sqpoll: fix sqpoll error handling races - macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF {CVE-2026-53013}