- NFSD: check truncate permission under inode lock {CVE-2026-89713} - smb: client: reject SetEA requests that do not fit the request buffer {CVE-2026-99109} - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715} - ceph: bound num_export_targets array for mds info v2/v3 {CVE-2026-89650} - ceph: bound copied dentry name length in NFS export get_name {CVE-2026-89652} - NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036} - openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487} - xfrm: route MIGRATE notifications to caller's netns {CVE-2026-63914} - coredump: hold RCU while releasing parked threads {CVE-2026-99218} - smb: client: bound dirent name against end of SMB response in cifs_filldir {CVE-2026-93787} - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() {CVE-2026-89697} - ipv6: validate extension header length before copying to cmsg {CVE-2026-63920} - IB/IPoIB: Avoid restoring OPER_UP after multicast flush {CVE-2026-98347} - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} - wifi: mac80211: unlist vifs when their netdev is unregistered {CVE-2026-98331} - sctp: validate STALE_COOKIE cause length before reading staleness {CVE-2026-64551} - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} - vsock: treat TCP_CLOSING as once-established {CVE-2026-99213} - USB: serial: mct_u232: fix memory corruption with small endpoint {CVE-2026-63898} - USB: serial: digi_acceleport: fix memory corruption with small endpoints {CVE-2026-63901} - USB: serial: cypress_m8: validate interrupt packet headers {CVE-2026-63902} - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check {CVE-2026-63913} - pipe: preserve existing fasync readers on writer setup failure {CVE-2026-99203} - USB: serial: omninet: fix memory corruption with small endpoint {CVE-2026-63928} - scsi: st: Fix use-after-free race between st_remove() and st_open() {CVE-2026-99156} - audit: fix potential use-after-free in audit_del_rule() {CVE-2026-74512} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} - Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block() {CVE-2026-98204} - qede: fix off-by-one in BD ring consumption on build_skb failure {CVE-2026-72339} - RDMA/core: fix refcount bug in iwpm_get_nlmsg_request() {CVE-2026-98252} - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) {CVE-2026-72502} - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417} - USB: serial: belkin_sa: validate interrupt status length {CVE-2026-63903} - scsi: libiscsi: Validate the task named by a management response {CVE-2026-99152} - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} - Input: evdev - zero absinfo before partial copy in EVIOCSABS {CVE-2026-98205} - sctp: clear new_transport when removing a peer {CVE-2026-74586} - ipv6: fix Route Information option length validation {CVE-2026-74598} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} - scsi: libiscsi: Validate the ITT reflected in a Reject PDU {CVE-2026-99153} - scsi: libiscsi: Reject a negative task index from parse_pdu_itt {CVE-2026-99154} - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} - wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping {CVE-2026-98423} - media: pwc: Drain fill_buf on start_streaming() failure {CVE-2026-68217} - HID: alps: unregister DualPoint Stick input device on remove {CVE-2026-98502} - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959} - xfrm6: fix uninitialized saddr in xfrm6_get_saddr() {CVE-2026-43139} - drm/nouveau: Fix gem reference leak in validate_init() {CVE-2026-98514} - ALSA: bcd2000: Fix race between rawmidi and disconnect {CVE-2026-98316} - ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971} - openvswitch: vport: fix self-deadlock on release of tunnel ports {CVE-2026-46165} - openvswitch: defer tunnel netdev_put to RCU release {CVE-2026-31678} - Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO {CVE-2026-98455} - signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() {CVE-2026-53352} - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370} - btrfs: fix xattr replace when multiple xattrs are packed in the same item {CVE-2026-98959} - cipso: adjust cached option offsets when removing CIPSO {CVE-2026-99064}