- scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() - i40e: increase max descriptors for XL710 - e1000e: fix heap overflow in e1000_set_eeprom - vsock: avoid to close connected socket after the timeout - ext4: fix use-after-free in ext4_orphan_cleanup - ext4: lost matching-pair of trace in ext4_truncate - ext4: allow ext4_truncate() to return an error - net: sched: sch_teql: fix null-pointer dereference - drm/virtio: move drm_connector_update_edid_property() call - cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() - cifs: serialise setting of cifsInodeInfo::oplock - cifs: serialise DIO and buffered IO - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug {CVE-2025-38024} - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() - iavf: Fix reset error handling - RDMA/rxe: Fix incomplete state save in rxe_requester - scsi: qla2xxx: Fix bsg_done() causing double free - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402} - net: check iov bounds in memcpy_from_msg() {CVE-2018-16885} - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163} - RDMA/rxe: Fix lines missed in backport of Fix incomplete state save in rxe_requester - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037} - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110} - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158} - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree {CVE-2026-43125} - RDMA/rxe: Fix double free in rxe_srq_from_init {CVE-2026-45852} - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} - net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116} - ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090} - rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-53166} - RDMA/rxe: Zero out index member of struct rxe_queue