- wifi: cfg80211: get the wiphy out of a dying network namespace {CVE-2026-98330} - net: thunderbolt: Mark the connection down when bringing it up fails {CVE-2026-80989} - smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() {CVE-2026-97563} - bpf: mark a NULL call argument precise {CVE-2026-98019} - KEYS: encrypted: fix integer overflow of datablob_len {CVE-2026-98222} - Bluetooth: hci_core: Serialize ACL scheduling with channel deletion {CVE-2026-98735} - sctp: diag: reject stale associations in dump_one path {CVE-2026-52917} - sctp: Hold sock lock while iterating over address list {CVE-2026-52917} - ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505} - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279} - Input: alps - fix use-after-free bugs caused by dev3_register_work {CVE-2025-68822} - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329} - wifi: brcmfmac: drain bus_reset work on device removal {CVE-2026-64586} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} - rbd: Reset positive result codes to zero in object map update path {CVE-2026-68131} - ipvs: ensure inner headers in ICMP errors are in headroom {CVE-2026-72319} - vsock/virtio: validate packet source for connected sockets {CVE-2026-99123} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state {CVE-2026-93288} - openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123} - wifi: cfg80211: stop PMSR before P2P and NAN teardown {CVE-2026-90343} - inet: frags: publish queues before arming timer {CVE-2026-74662} - net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() {CVE-2026-98070} - selinux: check connect-related permissions on TCP Fast Open {CVE-2026-72243} - ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207} - inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110} - net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977} - mmc: core: Cancel SDIO IRQ work before freeing host {CVE-2026-98213} - tipc: serialize udp bearer replicast list updates {CVE-2026-68323} - ipvs: use parsed transport offset in SCTP state lookup {CVE-2026-72021} - ipvs: pass parsed transport offset to state handlers {CVE-2026-72021} - wifi: mac80211: unlist vifs when their netdev is unregistered {CVE-2026-98331} - netfilter: nf_nat_sip: reload possible stale data pointer {CVE-2026-72251} - ieee802154: admin-gate legacy LLSEC dump operations {CVE-2026-72049} - xdp: fix zero-copy frame layout {CVE-2026-81002} - tcp: do not let tcp_rmem be set below 4096 {CVE-2026-98299} - selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() {CVE-2026-72242} - ALSA: pcm: set timer->private_data before registering the PCM timer {CVE-2026-98314} - ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY {CVE-2026-98262} - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} - sctp: validate STALE_COOKIE cause length before reading staleness {CVE-2026-64551} - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it {CVE-2026-72253} - netfilter: nf_conntrack_sip: remove net variable shadowing {CVE-2026-72253} - net/packet: avoid fanout hook re-registration after unregister {CVE-2026-68338} - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE {CVE-2026-68159} - libceph: fix two unsafe bare decodes in decode_lockers() {CVE-2026-68082} - dm-crypt: fix a tiny race condition in crypt_dec_pending {CVE-2026-99136} - sctp: validate stream count in sctp_process_strreset_inreq() {CVE-2026-68315} - ipv6: xfrm: use full sockets in local error paths {CVE-2026-98241} - ipv6: fix Route Information option length validation {CVE-2026-74598} - ipvs: reload ip header after head reallocation {CVE-2026-68476} - openvswitch: avoid reallocating confirmed conntrack labels {CVE-2026-98251} - SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow {CVE-2026-89551} - net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() {CVE-2026-90049} - wifi: cfg80211: don't filter by BSS type when removing stale entries {CVE-2026-98339} - libceph: reject zero bucket types in crush_decode {CVE-2026-68154} - net/sched: reject IDR error pointers when deleting actions {CVE-2026-98380} - keys: Protect the type name while describing a key {CVE-2026-99224} - ALSA: caiaq: fix out-of-bounds read in the Traktor Kontrol S4 input parser {CVE-2026-64487} - hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove {CVE-2026-98197} - sctp: clear new_transport when removing a peer {CVE-2026-74586} - sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300} - netfilter: ip6t_rpfilter: reject routes without inet6_dev {CVE-2026-98379} - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} - tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF) {CVE-2026-72502} - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new {CVE-2026-72020} - NFSD: check truncate permission under inode lock {CVE-2026-89713} - ovl: check access to copy_file_range source with src mounter creds {CVE-2026-68448} - fs: export rw_verify_area() {CVE-2026-68448} - nfsd: use test_and_clear_bit for somebody_reclaimed to prevent lost update {CVE-2026-93221} - nfsd: convert nfsd_net boolean flags to unsigned long flags word {CVE-2026-93221} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638} - KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715} - NFSD: Prevent client use-after-free during blocked-lock reaping {CVE-2026-90036} - ceph: bound copied dentry name length in NFS export get_name {CVE-2026-89652} - smb: client: bound dirent name against end of SMB response in cifs_filldir {CVE-2026-93787} - KVM: Move kvm_io_bus_get_dev() locking responsibilities to callers {CVE-2026-72282} - nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672} - pNFS: Fix a deadlock when returning a delegation during open() {CVE-2026-23050} - nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() {CVE-2026-89697} - btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF {CVE-2026-97415} - tracing/histograms: Verify event_call identity when updating synth_event refcount {CVE-2026-99233} - coredump: hold RCU while releasing parked threads {CVE-2026-99218} - crypto: algif_skcipher - force synchronous processing on trees without ctx->state {CVE-2026-74578} - cpu: hotplug: Bound hotplug states sysfs output {CVE-2026-72066} - smb: client: validate DFS referral PathConsumed {CVE-2026-68343} - NFSv4.1: zero referring call lists before decoding {CVE-2026-90104} - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186} - tracing: Reject incomplete event filter expressions {CVE-2026-99236} - audit: fix potential use-after-free in audit_del_rule() {CVE-2026-74512} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR {CVE-2026-64562} - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs {CVE-2026-72284} - NFSD: Prevent lock owner use-after-free during client teardown {CVE-2026-89662} - cifs: validate DFS referral string offsets {CVE-2026-72318} - ceph: bound num_export_targets array for mds info v2/v3 {CVE-2026-89650} - tpm: Make the TPM character devices non-seekable {CVE-2026-72135} - vxlan: do not arm the ageing timer on a device that is down {CVE-2026-74615} - macvlan: inherit needed_headroom and needed_tailroom from lowerdev {CVE-2026-74743} - wifi: brcmfmac: make release_scratchbuffers idempotent {CVE-2026-68192} - qede: fix off-by-one in BD ring consumption on build_skb failure {CVE-2026-72339} - tracing: Save the event file instead of the compatible histogram {CVE-2026-99235} - audit: avoid dropping live tree ref on fsnotify rule autoremove {CVE-2026-89643} - forcedeth: fix off-by-one when saving/restoring non-PCI config space {CVE-2026-89596} - wifi: mwifiex: use the subframe length when parsing A-MSDU TDLS frames {CVE-2026-74488} - ecryptfs: reject too-small tag 70 packets {CVE-2026-89606} - tipc: protect node reset trace dump with node lock {CVE-2026-99246} - tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow {CVE-2026-98550} - smb: client: clear ce->tgthint in free_tgts() {CVE-2026-89636} - smb: client: harden DFS cache against invalid target hints {CVE-2026-93210} - HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501} - ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321} - ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021} - ocfs2: o2hb: quiesce negotiate handlers and timeout work {CVE-2026-90301} - nfsd: fix UAF in async copy cancel and shutdown {CVE-2026-89675} - ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302} - NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037} - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868} - HID: uclogic: Add NULL check in uclogic_input_configured() {CVE-2025-38007} - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256} - ocfs2: validate fast symlink target during inode read {CVE-2026-74350} - ocfs2: validate inline data i_size during inode read {CVE-2026-43076} - ocfs2: add inline inode consistency check to ocfs2_validate_inode_block() {CVE-2026-43076} - ocfs2: bound namelen in dlm_migrate_request_handler {CVE-2026-89495} - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067} - net: dsa: Avoid cross-chip syncing of VLAN filtering {CVE-2022-49234} - libceph: Fix slab-out-of-bounds access in auth message processing {CVE-2026-46119} - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810} - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} - ata: ata_generic: Don't store pci_device_id {CVE-2026-90421} - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854} - dm cache policy smq: check allocation under invalidate lock {CVE-2026-53265} - dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062} - ipv6: use RCU in ip6_output() {CVE-2025-40158} - sctp: fix addr_wq_timer race in sctp_free_addr_wq() {CVE-2026-72383} - Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown {CVE-2026-98734} - xfrm: Duplicate SPI Handling {CVE-2025-39797} - ipv6: use RCU in ip6_xmit() {CVE-2025-40135} - net: Add locking to protect skb->dev access in ip_output {CVE-2025-40135} - net: dst: add four helpers to annotate data-races around dst->dev {CVE-2025-40135} - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling {CVE-2026-53253} - skbuff: introduce skb_pull_data {CVE-2026-53253} - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641} - thunderbolt: Prevent XDomain delayed work use-after-free on disconnect {CVE-2026-74575} - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500} - thunderbolt: Bound root directory content to block size {CVE-2026-53149} - thunderbolt: property: Reject dir_len < 4 to prevent size_t underflow {CVE-2026-63892} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998} - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}