- wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex {CVE-2023-53715} - wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver {CVE-2026-98406} - wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE {CVE-2026-98827} - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} - RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path {CVE-2026-74377} - gfs2: fix use-after-free in gfs2_qd_dealloc {CVE-2026-63804} - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() {CVE-2026-97563} - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} - ACPI: platform: Use acpi_bus_get_primary_device() {CVE-2026-100072} - ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428} - crypto: qat - fix DMA transfer direction {CVE-2022-50774} - scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386} - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU {CVE-2026-98479} - net: iptunnel: fix stale transport header during tunnel decapsulation {CVE-2026-98401} - drop_monitor: fix out-of-bounds write in reset_per_cpu_data() {CVE-2026-98419} - wifi: mac80211: don't warn when an IBSS has no channel to scan {CVE-2026-98425} - net/sched: codel: bound the dropping loop per dequeue call {CVE-2026-98427} - net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393} - Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461} - Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460} - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491} - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602} - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown {CVE-2026-98734} - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} - USB: serial: fix port tear down use-after-free {CVE-2026-98772} - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} - thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - security/keys: fix missed RCU read section on lookup {CVE-2026-64015} - KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned() {CVE-2026-63806} - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480} - HID: appleir: fix UAF on pending key_up_timer in remove() {CVE-2026-64363} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list {CVE-2026-53230} - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf {CVE-2026-63887} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() {CVE-2026-63888} - wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task {CVE-2026-46180} - fuse: re-lock request before replacing page cache folio {CVE-2026-53388} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - nfsd: release layout stid on setlease failure {CVE-2026-53399} - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800} - mrp: introduce active flags to prevent UAF when applicant uninit {CVE-2022-50697} - svcrdma: Reject Read lists that exceed the page budget {CVE-2026-89528} - svcrdma: Reject inline replies that overflow the pull-up buffer {CVE-2026-89530} - svcrdma: Fix double svc_rdma_send_ctxt_put() in an error path {CVE-2026-89530} - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} - libceph: replace BUG_ON with bounds check for map->max_osd {CVE-2025-68283} - net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994} - netpoll: fix a use-after-free on shutdown path {CVE-2026-64424} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109} - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). {CVE-2026-63917} - net/sched: sch_codel: Do not call qdisc_tree_reduce_backlog during peek before restoring qlen {CVE-2026-74267} - ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289} - net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841} - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} - ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940} - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} - sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START {CVE-2026-98130} - xfrm: Check for underflow in xfrm_state_mtu {CVE-2026-64009} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} - Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510} - ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500} - ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207} - block: mtip32xx: synchronize ioctls with device removal {CVE-2026-90180} - lockd, nfsd: RCU-protect nlmsvc_ops dispatch {CVE-2026-89709} - md: do overflow check for sb->bblog_shift in super_1_load() {CVE-2026-89557} - ipvs: fix the checksum validations {CVE-2026-80901} - selinux: require every boolean value to be defined {CVE-2026-80913} - params: fix charp corruption on allocation failure {CVE-2026-89552} - scsi: qla2xxx: Fix premature hw access after PCI error {CVE-2022-49157} - crypto: api - Use work queue in crypto_destroy_instance {CVE-2023-53799} - posix-timers: Ensure timer ID search-loop limit is valid {CVE-2023-53728} - dccp: fix data-race around dp->dccps_mss_cache {CVE-2023-53839} - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829} - nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE {CVE-2026-89665} - nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown {CVE-2026-89708} - ceph: fix UAF in check_new_map() on session freed during unlock {CVE-2026-89654} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 {CVE-2026-89537} - af_packet: Don't send zero-byte data in tpacket_snd(). {CVE-2026-80742} - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} - ipvs: fix more places with wrong ipv6 transport offsets {CVE-2026-68477} - scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084} - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types {CVE-2026-72436} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - btrfs: do not allow relocation of partially dropped subvolumes {CVE-2025-39738} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - media: pwc: Return queued buffers on start_streaming() failure {CVE-2026-68216}