* Bump kernel ABI to 33: ship the ELS kernel as 4.19.0-33-*, distinct from the prior 4.19.0-32. * CVE-2021-47063 - drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063} * CVE-2021-47211 - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc {CVE-2021-47211} * CVE-2021-47219 - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs() {CVE-2021-47219} * CVE-2021-47281 - ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281} * CVE-2021-47362 - drm/amd/pm: Update intermediate power state for SI {CVE-2021-47362} * CVE-2022-48792 - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task {CVE-2022-48792} * CVE-2022-49519 - ath10k: skip ath10k_halt during suspend for driver state RESTARTING {CVE-2022-49519} * CVE-2022-49698 - netfilter: use get_random_u32 instead of prandom {CVE-2022-49698} * CVE-2022-49740 - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740} * CVE-2023-52530 - wifi: mac80211: fix potential key use-after-free {CVE-2023-52530} * CVE-2023-52935 - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935} * CVE-2024-23307 - md/raid5: fix atomicity violation in raid5_cache_count {CVE-2024-23307} * CVE-2024-26886 - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886} * CVE-2024-26961 - mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961} * CVE-2024-26982 - Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982} * CVE-2024-35868 - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868} * CVE-2024-41073 - nvme: avoid double free special payload {CVE-2024-41073} * CVE-2024-46713 - perf/aux: Fix AUX buffer serialization {CVE-2024-46713} * CVE-2024-47745 - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745} * CVE-2024-49936 - net/xen-netback: prevent UAF in xenvif_flush_hash() {CVE-2024-49936} * CVE-2024-50115 - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115} * CVE-2024-50154 - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154} * CVE-2024-56570 - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570} * CVE-2024-56601 - net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601} * CVE-2024-56614 - xsk: fix OOB map writes when deleting elements {CVE-2024-56614} * CVE-2024-56615 - bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615} * CVE-2024-56616 - drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616} * CVE-2024-56619 - nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() {CVE-2024-56619} * CVE-2024-56629 - HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629} * CVE-2024-57887 - drm: adv7511: Fix use-after-free in adv7533_attach_dsi() {CVE-2024-57887} * CVE-2024-57892 - ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv {CVE-2024-57892} * CVE-2024-57900 - ila: serialize calls to nf_register_net_hooks() {CVE-2024-57900} * CVE-2024-57908 - iio: imu: kmx61: fix information leak in triggered buffer {CVE-2024-57908} * CVE-2024-57980 - media: uvcvideo: Fix double free in error path {CVE-2024-57980} * CVE-2024-57982 - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} * CVE-2025-21702 - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702} * CVE-2025-21753 - btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753} * CVE-2025-21761 - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761} * CVE-2025-21762 - arp: use RCU protection in arp_xmit() {CVE-2025-21762} * CVE-2025-21764 - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764} * CVE-2025-21772 - partitions: mac: fix handling of bogus partition table {CVE-2025-21772} * CVE-2025-21782 - orangefs: fix a oob in orangefs_debug_write {CVE-2025-21782} * CVE-2025-21785 - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785} * CVE-2025-21791 - vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791} * CVE-2025-21811 - nilfs2: protect access to buffers with no active references {CVE-2025-21811} * CVE-2025-21920 - vlan: enforce underlying device type {CVE-2025-21920} * CVE-2025-21928 - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928} * CVE-2025-21993 - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993} * CVE-2025-22004 - net: atm: fix use after free in lec_send() {CVE-2025-22004} * CVE-2025-37785 - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785} * CVE-2026-23209 - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209} * CVE-2026-23407 - apparmor: fix missing bounds check on DEFAULT table in verify_dfa() {CVE-2026-23407} * CVE-2026-23455 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455} * CVE-2026-31408 - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408} * CVE-2026-31586 - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586} * CVE-2026-31607 - usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607} * CVE-2026-31786 - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786} * CVE-2026-43037 - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} * CVE-2026-43038 - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038} * CVE-2026-43110 - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} * CVE-2026-43190 - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190} * CVE-2026-43226 - net/rds: No shortcut out of RDS_CONN_ERROR {CVE-2026-43226} * CVE-2026-43233 - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233} * CVE-2026-43334 - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} * CVE-2026-43339 - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339} * CVE-2026-45970 - bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970} * CVE-2026-46052 - ceph: only d_add() negative dentries when they are unhashed {CVE-2026-46052} * CVE-2026-46056 - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers {CVE-2026-46056} * CVE-2026-46090 - ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090} * CVE-2026-46120 - ip6_gre: Use cached t->net in ip6erspan_changelink(). {CVE-2026-46120} * CVE-2026-46212 - batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212} * CVE-2026-46227 - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227} * CVE-2026-46243 - smb: client: reject userspace cifs.spnego descriptions {CVE-2026-46243} * CVE-2026-46266 - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266} * CVE-2026-52912 - netfilter: nf_queue: hold bridge skb->dev while queued {CVE-2026-52912} * CVE-2026-52919 - batman-adv: fix tp_meter counter underflow during shutdown {CVE-2026-52919} * CVE-2026-52920 - netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} * CVE-2026-52931 - batman-adv: tp_meter: avoid use of uninit sender vars {CVE-2026-52931} * CVE-2026-52943 - net: skbuff: fix missing zerocopy reference in pskb_carve helpers {CVE-2026-52943} * CVE-2026-52957 - libceph: Fix potential null-ptr-deref in decode_choose_args() {CVE-2026-52957} * CVE-2026-52993 - tipc: fix double-free in tipc_buf_append() {CVE-2026-52993} * CVE-2026-52998 - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} * CVE-2026-53006 - ipv6: fix possible UAF in icmpv6_rcv() {CVE-2026-53006} * CVE-2026-53016 - crypto: ccp - copy IV using skcipher ivsize {CVE-2026-53016} * CVE-2026-53072 - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER {CVE-2026-53072} * CVE-2026-53089 - bpf: Fix use-after-free in offloaded map/prog info fill {CVE-2026-53089} * CVE-2026-53112 - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112} * CVE-2026-53212 - netfilter: nft_tunnel: fix use-after-free on object destroy {CVE-2026-53212} * CVE-2026-53223 - net: guard timestamp cmsgs to real error queue skbs {CVE-2026-53223} * CVE-2026-53256 - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} * CVE-2026-53268 - netfilter: conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268} * CVE-2026-53275 - ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275} * CVE-2026-53329 - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329} * CVE-2026-72070 - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} * CVE-2026-90057 - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} * CVE-2026-90414 - IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414} * CVE-2026-93163 - hwrng: core - fix rng list on registration error {CVE-2026-93163} * CVE-2026-93175 - drm/amd/display: Fix dangling pointer in CRTC reset function {CVE-2026-93175} * CVE-2026-93239 - arm64: mm: Fix the lockless page-table walk in show_pte() {CVE-2026-93239} * CVE-2026-93288 - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state {CVE-2026-93288} * CVE-2026-93791 - wifi: iwlwifi: mvm: add a check on the tid coming from the firmware {CVE-2026-93791} * CVE-2026-93817 - perf: Fix addr_filter_ranges lifetime {CVE-2026-93817} * CVE-2026-93830 - net: stmmac: xgmac2: disable RBUE in default RX interrupt mask {CVE-2026-93830} * CVE-2026-97540 - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} * CVE-2026-97608 - netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608} * CVE-2026-97612 - net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612} * CVE-2026-97931 - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} * CVE-2026-97938 - reboot: fix cad_pid use-after-free race {CVE-2026-97938} * CVE-2026-97949 - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} * CVE-2026-98017 - net/sched: defer qdisc freeing after failed creation {CVE-2026-98017} * CVE-2026-98196 - wifi: brcmsmac: fix UAF in brcms_free_timer() {CVE-2026-98196} * CVE-2026-98269 - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} * CVE-2026-98312 - ALSA: 6fire: fix OOB write from device-reported iso length {CVE-2026-98312} * CVE-2026-98320 - netfilter: flowtable: hold reference on ct until flow is released {CVE-2026-98320} * CVE-2026-98349 - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} * CVE-2026-98454 - smb: client: fix create context out-of-bounds reads {CVE-2026-98454} * CVE-2026-98490 - net: openvswitch: conntrack: fix helper UAF due to extensions realloc {CVE-2026-98490} * CVE-2026-98491 - net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry {CVE-2026-98491} * CVE-2026-98532 - ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532} * CVE-2026-98548 - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} * CVE-2026-98959 - btrfs: fix xattr replace when multiple xattrs are packed in the same item {CVE-2026-98959}