* Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28. * CVE-2021-46984 - kyber: fix out of bounds access when preempted {CVE-2021-46984} * CVE-2021-47049 - Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049} * CVE-2021-47101 - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101} * CVE-2021-47191 - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191} * CVE-2021-47352 - virtio-net: Add validation for used length {CVE-2021-47352} * CVE-2021-47379 - blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379} * CVE-2021-47391 - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391} * CVE-2021-47479 - staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479} * CVE-2022-21546 - scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546} * CVE-2022-39189 - KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189} * CVE-2022-43945 - SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945} - NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945} * CVE-2022-48744 - net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744} * CVE-2022-49026 - e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026} * CVE-2022-49720 - block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720} * CVE-2022-49975 - bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975} - bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975} * CVE-2022-50066 - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066} * CVE-2022-50103 - sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103} * CVE-2022-50129 - RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129} - RDMA/srpt: Fix a use-after-free {CVE-2022-50129} * CVE-2022-50300 - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300} * CVE-2022-50406 - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406} * CVE-2022-50422 - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422} * CVE-2022-50552 - blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552} * CVE-2023-51779 - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779} * CVE-2023-52434 - smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434} * CVE-2023-52515 - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} * CVE-2023-52531 - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531} * CVE-2023-52741 - cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741} * CVE-2023-53000 - netlink: prevent potential spectre v1 gadgets {CVE-2023-53000} * CVE-2023-53039 - workqueue: Add resource managed version of delayed work init {CVE-2023-53039} - devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039} - devm-helpers: Add resource managed version of work init {CVE-2023-53039} - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039} - HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039} * CVE-2023-53111 - loop: Fix use-after-free issues {CVE-2023-53111} * CVE-2023-53254 - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254} * CVE-2023-53259 - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259} * CVE-2023-53282 - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282} * CVE-2023-53321 - wifi: mac80211_hwsim: drop short frames {CVE-2023-53321} * CVE-2023-53333 - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-53333} - netfilter: conntrack: dccp: try not to drop skb in conntrack {CVE-2023-53333} * CVE-2023-53432 - firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432} * CVE-2023-53510 - scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510} * CVE-2023-53577 - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} * CVE-2023-53680 - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680} * CVE-2024-26689 - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689} * CVE-2024-26828 - cifs: fix underflow in parse_server_interfaces() {CVE-2024-26828} * CVE-2024-26996 - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error {CVE-2024-26996} * CVE-2024-35791 - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791} * CVE-2024-35864 - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864} * CVE-2024-35932 - drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932} * CVE-2024-38545 - RDMA/hns: Fix UAF for cq async event {CVE-2024-38545} * CVE-2024-38588 - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588} * CVE-2024-40929 - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929} * CVE-2024-41013 - xfs: don't walk off the end of a directory data block {CVE-2024-41013} * CVE-2024-42120 - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120} * CVE-2024-46731 - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731} * CVE-2024-46813 - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813} * CVE-2024-46818 - drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818} * CVE-2024-46826 - ELF: fix kernel.randomize_va_space double read {CVE-2024-46826} * CVE-2024-46859 - platform/x86: panasonic-laptop: Fix sticky key init bug {CVE-2024-46859} - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859} * CVE-2024-49991 - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991} * CVE-2024-50036 - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036} * CVE-2024-50067 - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067} * CVE-2024-50073 - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073} * CVE-2024-50256 - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() {CVE-2024-50256} * CVE-2024-53090 - afs: Fix lock recursion {CVE-2024-53090} * CVE-2024-53124 - net: fix data-races around sk->sk_forward_alloc {CVE-2024-53124} * CVE-2024-56593 - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() {CVE-2024-56593} * CVE-2024-56602 - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602} * CVE-2024-56603 - net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603} * CVE-2024-56606 - af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606} * CVE-2024-56631 - scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631} * CVE-2024-56640 - net/smc: fix LGR and link use-after-free issue {CVE-2024-56640} * CVE-2024-56650 - netfilter: x_tables: fix LED ID check in led_tg_check() {CVE-2024-56650} * CVE-2024-56658 - net: defer final 'struct net' free in netns dismantle {CVE-2024-56658} * CVE-2024-56748 - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() {CVE-2024-56748} * CVE-2024-56756 - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756} * CVE-2024-57901 - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK {CVE-2024-57901} * CVE-2024-58072 - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072} * CVE-2025-21749 - net: rose: add missing dev_put() on error in rose_bind {CVE-2025-21749} * CVE-2025-21858 - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858} * CVE-2025-22022 - usb: xhci: move link chain bit quirk checks into one helper function. {CVE-2025-22022} - usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022} - usb: xhci: Don't unchain link TRBs on quirky HCs {CVE-2025-22022} * CVE-2025-22083 - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083} * CVE-2025-22121 - ext4: introduce ITAIL helper {CVE-2025-22121} - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121} * CVE-2025-23156 - media: venus: hfi_parser: refactor hfi packet parsing logic {CVE-2025-23156} * CVE-2025-23157 - media: venus: hfi_parser: add check to avoid out of bound access {CVE-2025-23157} * CVE-2025-23158 - media: venus: hfi: add check to handle incorrect queue size {CVE-2025-23158} * CVE-2025-37796 - wifi: at76c50x: fix use after free access in at76_disconnect {CVE-2025-37796} * CVE-2025-37798 - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-37798} * CVE-2025-37839 - jbd2: remove wrong sb->s_sequence check {CVE-2025-37839} * CVE-2025-37879 - 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879} * CVE-2025-37882 - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882} * CVE-2025-37923 - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923} - tracing: Fix compilation warning on arm32 {CVE-2025-37923} * CVE-2025-37927 - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927} * CVE-2025-37932 - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-37932} * CVE-2025-37953 - sch_htb: make htb_deactivate() idempotent {CVE-2025-37953} * CVE-2025-38000 - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000} * CVE-2025-38024 - RDMA/rxe: Zero out index member of struct rxe_queue {CVE-2025-38024} - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024} * CVE-2025-38068 - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068} * CVE-2025-38079 - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079} * CVE-2025-38102 - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} * CVE-2025-38103 - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103} - HID: usbhid: paper over wrong bNumDescriptor field {CVE-2025-38103} * CVE-2025-38157 - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157} * CVE-2025-38211 - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211} * CVE-2025-38212 - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212} * CVE-2025-38348 - wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback() {CVE-2025-38348} * CVE-2025-38350 - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38350} - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38350} - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350} * CVE-2025-38375 - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375} * CVE-2025-38403 - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403} * CVE-2025-38445 - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445} * CVE-2025-38494 - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494} * CVE-2025-38497 - usb: gadget: configfs: Fix OOB read on empty string write {CVE-2025-38497} * CVE-2025-38563 - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563} * CVE-2025-38565 - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} * CVE-2025-38572 - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572} * CVE-2025-38618 - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618} * CVE-2025-38652 - f2fs: fix to avoid out-of-boundary access in devs.path {CVE-2025-38652} * CVE-2025-38679 - media: venus: Fix OOB read due to missing payload bound check {CVE-2025-38679} * CVE-2025-38708 - drbd: add missing kref_get in handle_write_conflicts {CVE-2025-38708} * CVE-2025-38718 - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718} * CVE-2025-38728 - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} * CVE-2025-38729 - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729} * CVE-2025-39684 - comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() {CVE-2025-39684} * CVE-2025-39686 - comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686} * CVE-2025-39689 - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689} * CVE-2025-39702 - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702} * CVE-2025-39730 - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730} * CVE-2025-39760 - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - usb: core: config: reverse the size check of the SSP isoc endpoint descriptor {CVE-2025-39760} * CVE-2025-39817 - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817} * CVE-2025-39823 - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823} - KVM: X86: Fix array_index_nospec protection in __pv_send_ipi {CVE-2025-39823} * CVE-2025-39824 - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824} * CVE-2025-39839 - batman-adv: fix OOB read/write in network-coding decode {CVE-2025-39839} * CVE-2025-39853 - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853} * CVE-2025-39863 - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863} * CVE-2025-39891 - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891} * CVE-2025-39901 - i40e: remove read access to debugfs files {CVE-2025-39901} * CVE-2025-39911 - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} * CVE-2025-39955 - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-39955} * CVE-2025-40186 - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). {CVE-2025-40186} * CVE-2025-68305 - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305} * CVE-2025-71075 - scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075} * CVE-2025-71082 - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} * CVE-2025-71091 - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091} * CVE-2025-71093 - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} * CVE-2025-71116 - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116} * CVE-2026-22980 - nfsd: provide locking for v4_end_grace {CVE-2026-22980} * CVE-2026-23001 - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001} * CVE-2026-23073 - wifi: rsi: Fix memory corruption due to not set vif driver data size {CVE-2026-23073} * CVE-2026-23076 - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076} * CVE-2026-23083 - fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083} * CVE-2026-23089 - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089} * CVE-2026-23099 - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} * CVE-2026-23191 - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191} * CVE-2026-23193 - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193} * CVE-2026-23204 - net: add skb_header_pointer_careful() helper {CVE-2026-23204} - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} * CVE-2026-23216 - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} * CVE-2026-23231 - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() {CVE-2026-23231} * CVE-2026-23235 - f2fs: fix out-of-bounds access in sysfs attribute read/write {CVE-2026-23235} * CVE-2026-23243 - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} * CVE-2026-23273 - macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273} * CVE-2026-23281 - wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281} * CVE-2026-23372 - nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372} * CVE-2026-23378 - net/sched: act_ife: Fix metalist update behavior {CVE-2026-23378} * CVE-2026-23388 - Squashfs: check metadata block offset is within range {CVE-2026-23388} * CVE-2026-23406 - apparmor: fix side-effect bug in match_char() macro usage {CVE-2026-23406} * CVE-2026-23447 - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447} * CVE-2026-23448 - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} * CVE-2026-31396 - net: macb: fix use-after-free access to PTP clock {CVE-2026-31396} * CVE-2026-31399 - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} * CVE-2026-31452 - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} * CVE-2026-31494 - net: macb: use the current queue number for stats {CVE-2026-31494} * CVE-2026-31500 - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} * CVE-2026-31532 - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532} * CVE-2026-31576 - media: hackrf: fix to not free memory after the device is registered in hackrf_probe() {CVE-2026-31576} * CVE-2026-31581 - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} * CVE-2026-31597 - ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597} * CVE-2026-31602 - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602} * CVE-2026-31622 - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622} * CVE-2026-31626 - staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626} * CVE-2026-31627 - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627} * CVE-2026-31629 - nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629} * CVE-2026-31659 - batman-adv: reject oversized global TT response buffers {CVE-2026-31659} * CVE-2026-31696 - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696} * CVE-2026-31747 - comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747} * CVE-2026-31748 - comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748} * CVE-2026-31778 - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778} * CVE-2026-31787 - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787} * CVE-2026-43020 - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} * CVE-2026-43027 - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} * CVE-2026-43040 - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} * CVE-2026-43052 - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} * CVE-2026-43075 - ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075} * CVE-2026-43076 - ocfs2: validate inline data i_size during inode read {CVE-2026-43076} * CVE-2026-43198 - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} * CVE-2026-43206 - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206} * CVE-2026-43279 - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} * CVE-2026-43281 - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281} * CVE-2026-43370 - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} * CVE-2026-43386 - staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie {CVE-2026-43386} * CVE-2026-43427 - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} * CVE-2026-43450 - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} * CVE-2026-43494 - net/rds: reset op_nents when zerocopy page pin fails {CVE-2026-43494} * CVE-2026-45893 - apparmor: Fix & Optimize table creation from possibly unaligned memory {CVE-2026-45893} * CVE-2026-46006 - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} * CVE-2026-46022 - misc: ibmasm: fix OOB MMIO read in ibmasm_handle_mouse_interrupt() {CVE-2026-46022} * CVE-2026-46033 - crypto: authencesn - reject short ahash digests during instance creation {CVE-2026-46033} * CVE-2026-46069 - wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup() {CVE-2026-46069} * CVE-2026-46116 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} * CVE-2026-46150 - fanotify: fix false positive on permission events {CVE-2026-46150} * CVE-2026-46191 - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} * CVE-2026-46208 - batman-adv: stop tp_meter sessions during mesh teardown {CVE-2026-46208} * CVE-2026-46209 - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209} * CVE-2026-46218 - drm/amdgpu: Add bounds checking to ib_{get,set}_value {CVE-2026-46218} * CVE-2026-46254 - AppArmor: Allow apparmor to handle unaligned dfa tables {CVE-2026-46254} * CVE-2026-46259 - procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259} * CVE-2026-46333 - ptrace: slightly saner 'get_dumpable()' logic {CVE-2026-46333} * CVE-2026-52934 - batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934} * CVE-2026-53009 - ice: fix double-free of tx_buf skb {CVE-2026-53009} * CVE-2026-53036 - bpf, arm64: Fix off-by-one in check_imm signed range check {CVE-2026-53036} * CVE-2026-53040 - ocfs2: validate bg_bits during freefrag scan {CVE-2026-53040} * CVE-2026-53075 - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls {CVE-2026-53075} * CVE-2026-53091 - net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091} * CVE-2026-53130 - fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START {CVE-2026-53130} * CVE-2026-53136 - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} * CVE-2026-53138 - drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138} * CVE-2026-53186 - RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186} * CVE-2026-53189 - mm/huge_memory: update file PMD counter before folio_put() {CVE-2026-53189} * CVE-2026-53224 - sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224} * CVE-2026-53228 - ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228} * CVE-2026-53246 - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246} * CVE-2026-53264 - net/sched: act_api: use RCU with deferred freeing for action lifecycle {CVE-2026-53264} * CVE-2026-53270 - ipvs: clear the svc scheduler ptr early on edit {CVE-2026-53270} * CVE-2026-53303 - f2fs: protect extension_list reading with sb_lock in f2fs_sbi_show() {CVE-2026-53303} * CVE-2026-64567 - btrfs: reject free space cache with more entries than pages {CVE-2026-64567} * CVE-2026-64571 - wifi: p54: validate RX frame length in p54_rx_eeprom_readback() {CVE-2026-64571} * CVE-2026-64580 - xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() {CVE-2026-64580} * CVE-2026-64581 - xfrm: fix sk_dst_cache double-free in xfrm_user_policy() {CVE-2026-64581} * CVE-2026-64582 - RDMA/rxe: Fix a use-after-free problem in rxe_mmap {CVE-2026-64582} * CVE-2026-64584 - usb: gadget: f_midi: cancel pending IN work before freeing the midi object {CVE-2026-64584} * CVE-2026-64585 - can: esd_usb: kill anchored URBs before freeing netdevs {CVE-2026-64585} * CVE-2026-64587 - net: ethernet: arc: emac: quiesce interrupts before requesting IRQ {CVE-2026-64587} * CVE-2026-64593 - btrfs: do not trim a device which is not writeable {CVE-2026-64593}