- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available {CVE-2026-64561} - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807} - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035} - thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146} - drm/gud: Fix UBSAN warning {CVE-2022-50628} - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740} - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests {CVE-2023-54108} - fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044} - tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280} - isofs: Fix out of bound access for corrupted isofs image {CVE-2021-47478} - pppoe: drop PFC frames {CVE-2026-53003} - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free {CVE-2026-46304} - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466} - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997} - irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions {CVE-2022-49716} - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006} - can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625} - cxl/mem: Fix shutdown order {CVE-2023-52849} - pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030} - usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758} - RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242} - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350} - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088} - HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047} - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058} - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle {CVE-2023-53250} - usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288} - wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092} - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697} - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650} - HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520} - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522} - scsi: qla2xxx: Avoid fcport pointer dereference {CVE-2023-53603} - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178} - scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473} - HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111} - tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320} - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180} - usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432} - PCI: Fix reset_method_store() memory leak {CVE-2024-56745} - rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079} - net: stmmac: fix integer underflow in chain mode {CVE-2026-31649} - be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264} - thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147} - Input: uinput - fix circular locking dependency with ff-core {CVE-2026-31667} - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency {CVE-2023-52855} - nbd: defer config put in recv_work {CVE-2025-68372} - net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064} - serial: imx: fix tx statemachine deadlock {CVE-2023-52456} - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() {CVE-2024-47734} - dm-thin: fix metadata refcount underflow {CVE-2026-46107} - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454} - usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916} - md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070} - wifi: rtw89: fix potential race condition between napi_init and napi_enable {CVE-2023-53452} - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl {CVE-2021-47634} - ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388} - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469} - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275} - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used {CVE-2025-38113} - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() {CVE-2025-40211} - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() {CVE-2026-45982} - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304} - ACPI: pfr_update: Fix the driver update version check {CVE-2025-39701} - spi: imx: fix use-after-free on unbind {CVE-2026-45996} - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253} - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access {CVE-2026-46094} - xdp: produce a warning when calculated tailroom is negative {CVE-2026-23343} - vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check {CVE-2023-53543} - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406} - topology: Keep the cpumask unchanged when printing cpumap {CVE-2024-57917} - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers {CVE-2026-43059} - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early {CVE-2025-39861} - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' {CVE-2025-38593} - mm/damon/sysfs: fix use-after-free in state_show() {CVE-2025-39877} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation {CVE-2026-43133} - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334} - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239} - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file {CVE-2024-42138} - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233} - bpf: Fix stack-out-of-bounds write in devmap {CVE-2026-23359} - mm/debug_vm_pgtable: clear page table entries at destroy_args() {CVE-2025-39776} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry {CVE-2026-43114} - gve: Account for stopped queues when reading NIC stats {CVE-2024-42162} - gve: Fix stats report corruption on queue count change {CVE-2026-23262} - amba: use generic driver_override infrastructure - Drivers: hv: vmbus: use generic driver_override infrastructure - vdpa: use generic driver_override infrastructure {CVE-2026-53118} - PCI: use generic driver_override infrastructure {CVE-2026-53120} - spi: use generic driver_override infrastructure {CVE-2026-31487} - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527} - driver core: generalize driver_override in struct device {CVE-2026-31688} - arm64: topology: fix possible overflow in amu_fie_setup() {CVE-2022-48657} - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing {CVE-2025-68185} - NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324} - rxrpc: Fix key reference count leak from call->key {CVE-2026-31639} - rxrpc: Only put the call ref if one was acquired {CVE-2026-31638} - bpf: Set run context for rawtp test_run callback {CVE-2024-40908} - ethtool: Fix uninitialized number of lanes {CVE-2023-53798} - xsk: fix refcount underflow in error path {CVE-2023-53698} - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs {CVE-2026-23340} - net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504} - net: avoid race between device unregistration and ethnl ops {CVE-2025-21701} - net: sched: Disallow replacing of child qdisc from one parent to another {CVE-2025-21700} - libceph: Fix potential out-of-bounds access in osdmap_decode() {CVE-2026-52958} - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() {CVE-2026-46024} - libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954} - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined {CVE-2025-71224} - wifi: mac80211: prohibit deactivating all links {CVE-2024-58061} - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() {CVE-2025-21937} - Bluetooth: SMP: derive legacy responder STK authentication from MITM state {CVE-2026-31773} - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() {CVE-2025-21936} - Bluetooth: fix memory leak in error path of hci_alloc_dev() {CVE-2026-53252} - netfilter: nf_tables: unconditionally flush pending work before notifier {CVE-2024-42109} - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm {CVE-2025-39894} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case {CVE-2026-23456} - iavf: Fix out-of-bounds when setting channels on remove {CVE-2023-53659} - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339} - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112}