- sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564} - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138} - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187} - sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300} - ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221} - cifs: some missing initializations on replay {CVE-2026-31693} - drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286} - net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383} - ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740} - accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206} - ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487} - ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909} - NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764} - bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336} - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291} - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978} - net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054} - spi: fix use-after-free on controller registration failure {CVE-2026-31389} - nvme: fix admin request_queue lifetime {CVE-2025-68265} - RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901} - smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350} - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834} - sctp: Fix MAC comparison to be constant-time {CVE-2025-40204} - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830} - nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297} - thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925} - usbnet: Prevents free active kevent {CVE-2025-68312} - smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282} - fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295} - cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137} - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251} - wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325} - io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321} - io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154} - xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005} - firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444} - i2c: core: fix adapter deregistration race {CVE-2026-64279} - wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439} - firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166} - wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309} - pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121} - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205} - PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880} - nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218} - dm: fix unlocked test for dm_suspended_md {CVE-2026-46327} - net: slip: serialize receive against buffer reallocation {CVE-2026-68143} - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() {CVE-2026-68324} - net/iucv: take a reference on the socket found in afiucv_hs_rcv() {CVE-2026-68397} - i40e: Fix preempt count leak in napi poll tracepoint {CVE-2026-23313} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - libceph: remove debugfs files before client teardown {CVE-2026-68153} - cxl/port: Fix use after free of parent_port in cxl_detach_ep() {CVE-2026-31530} - octeontx2-af: CGX: add bounds check to cgx_speed_mbps index {CVE-2026-64225} - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274} - net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245} - Squashfs: reject negative file sizes in squashfs_read_inode() {CVE-2025-40200} - igc: don't fail igc_probe() on LED setup error {CVE-2025-39956} - neigh: let neigh_xmit take skb ownership {CVE-2026-52981} - libceph: bound get_version reply decode to front len {CVE-2026-68433} - drm/amd/display: Validate GPIO pin LUT table size before iterating {CVE-2026-64097} - media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex {CVE-2026-31473} - smb: client: split cached_fid bitfields to avoid shared-byte RMW races {CVE-2026-23230} - i40e: fix validation of VF state in get resources {CVE-2025-39969} - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158} - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298} - smb: client: fix krb5 mount with username option {CVE-2026-31392} - xfrm: fix stale skb->prev after async crypto steals a GSO segment {CVE-2026-68426} - bpf: Reject sleepable kprobe_multi programs at attach time {CVE-2026-43010} - mptcp: pm: ADD_ADDR rtx: fix potential data-race {CVE-2026-46137} - wifi: ath12k: fix memory leak in ath12k_pci_remove() {CVE-2025-37744} - block: add pgmap check to biovec_phys_mergeable {CVE-2026-46115} - io_uring/kbuf: reallocate buf lists on upgrade {CVE-2025-21836} - ASoC: amd: acp: Fix incorrect retrival of acp_chip_info {CVE-2025-39959} - wifi: cfg80211: bound element ID read when checking non-inheritance {CVE-2026-68402} - ALSA: hda/conexant: Fix missing error check for jack detection {CVE-2026-53291} - l2tp: prevent possible tunnel refcount underflow {CVE-2024-49940} - mm/thp: fix deferred split unqueue naming and locking {CVE-2024-53079} - drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() {CVE-2026-68250} - drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251} - drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() {CVE-2026-68110} - drm/amdgpu/gfx8: drop unecessary BUG_ON() {CVE-2026-68430} - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} - Input: elan_i2c - validate firmware size before use {CVE-2026-64237}