- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276} - media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284} - usb: usbtmc: check URB actual_length for interrupt-IN notifications {CVE-2026-63904} - usb: usbfs: fix use-after-free of usb_device in usbdev_release() {CVE-2026-80824} - HID: alps: fix use-after-free on input2 registration failure {CVE-2026-98501} - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() {CVE-2023-53754} - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494} - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488} - net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489} - net: ena: fix MMIO read buffer leak on probe failure {CVE-2026-98486} - HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916} - net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put {CVE-2026-98015} - RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515} - net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() {CVE-2026-64351} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} - NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392} - btrfs: fix race when deleting free space root from the dirty cow roots list {CVE-2023-54067} - libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559} - nvdimm/btt: reject an arena whose nfree is below the lane count {CVE-2026-89965} - NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103} - vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). {CVE-2026-63921} - net/sched: act_tunnel_key: Defer dst_release to RCU callback {CVE-2026-68377} - RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307} - ALSA: usbusx2y: validate URB actual_length in interrupt callback {CVE-2026-97929} - ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf {CVE-2026-97930} - udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140} - PCI/proc: Use file_ns_capable() when checking config space read access {CVE-2026-93206} - wifi: iwlwifi: mvm: validate TX_CMD response layout {CVE-2026-93793} - smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid {CVE-2026-97561} - wifi: brcmfmac: fix P2P action frame handling without device vif {CVE-2026-90345} - IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293} - IB/isert: delay the final Login Response until the session is registered {CVE-2026-90294} - NFSv4: remove callback IDR entry on client allocation failure {CVE-2026-90151} - sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235} - RDMA/core: Reject unregistering netdevs in ib_get_eth_speed {CVE-2026-98359} - ipv6: mcast: use rcu_assign_pointer() for __rcu list updates {CVE-2026-98099} - wifi: cfg80211: reject duplicate wiphy cipher suite entries {CVE-2026-97518} - IB/iser: reject a remote invalidation of an unregistered direction {CVE-2026-98358} - ext4: validate readdir offset before accessing dirent {CVE-2026-92499} - mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - ACPI: bus: Introduce acpi_bus_get_primary_device() {CVE-2026-93251} - scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() {CVE-2026-89861} - smb: client: reject a tree connect response whose byte count is too small {CVE-2026-89631} - tcp: clamp route advmss to TCP_MIN_MSS {CVE-2026-80847} - fsnotify: Fix stale object mask after concurrent mark updates {CVE-2026-89595} - smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions {CVE-2026-89638} - sunrpc: init gssp_lock before publishing proc entry {CVE-2026-89540} - selinux: reject an unclaimed class value in security_get_classes() {CVE-2026-80912} - net: skbuff: don't touch shared zerocopy state in skb_tx_error() {CVE-2026-80977} - xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full {CVE-2026-89783} - PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io() {CVE-2026-89722} - svcrdma: Use svc_xprt_put to free listener on create failure {CVE-2026-89527} - ALSA: usb-audio: Complete cleanup after system-resume errors {CVE-2026-80828} - media: av7110: fix a spectre vulnerability {CVE-2024-50289} - net: read sk->sk_family once in sk_mc_loop() {CVE-2023-53831} - vt: prevent kernel-infoleak in con_font_get() {CVE-2024-50076} - hwrng: amd - Fix PCI device refcount leak {CVE-2022-50868} - configfs: fix possible memory leak in configfs_create_dir() {CVE-2022-50751} - pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP {CVE-2022-50849} - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops {CVE-2026-89666} - wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function {CVE-2023-53802} - wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() {CVE-2022-50709} - Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept {CVE-2026-80819} - ipvs: use parsed transport offset in TCP state lookup {CVE-2026-80875} - USB: serial: option: fix slab OOB read in interrupt URB callback {CVE-2026-80827} - lockd: pin next file across nlm_inspect_file lock-drop {CVE-2026-89485} - scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() {CVE-2026-89515} - SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 {CVE-2026-89784} - nfsd: gate nfs2 setacl by argp->mask {CVE-2026-89672} - SUNRPC: harden gss_unwrap_resp_priv length checks {CVE-2026-89541} - HID: picolcd: clamp eeprom debugfs read to bytes actually received {CVE-2026-89628} - ALSA: 6fire: bound the MIDI event length from the device {CVE-2026-80973} - NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659} - net: macb: drop in-flight Tx SKBs on close {CVE-2026-72017} - KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIs {CVE-2026-72284} - power: supply: core: fix supplied_from allocations {CVE-2026-74271} - tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions {CVE-2026-80689} - binfmt_misc: reject a flag character as the field delimiter {CVE-2026-74485} - fbdev: serialize mode sysfs access with lock_fb_info() {CVE-2026-80785} - drm/radeon: fix integer overflow in radeon_align_pitch() {CVE-2026-74417} - bonding: refuse to enslave CAN devices {CVE-2026-63990} - selinux: check connect-related permissions on TCP Fast Open {CVE-2026-72243} - configfs: fix lockless traversals of ->s_children {CVE-2026-74330} - ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump {CVE-2026-72392} - net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds {CVE-2026-74544} - netfilter: nf_nat_sip: reload possible stale data pointer {CVE-2026-72251} - ipvs: ensure inner headers in ICMP errors are in headroom {CVE-2026-72319} - ipvs: use parsed transport offset in SCTP state lookup {CVE-2026-72021} - ipvs: pass parsed transport offset to state handlers {CVE-2026-72021} - HID: hyperv: validate initial device info bounds {CVE-2026-80765} - HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() {CVE-2026-80783} - ALSA: seq: oss: Serialize readq reset state with q->lock {CVE-2026-80628} - ipv4: fib: Don't ignore error route in local/main tables. {CVE-2026-72421} - netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag {CVE-2026-72250} - netfilter: xt_nat: reject unsupported target families {CVE-2026-80664} - netfilter: xt_u32: reject invalid shift counts {CVE-2026-72350} - can: softing: fw_parse(): validate firmware record spans {CVE-2026-80706} - mmc: vub300: defer reset until cmd_mutex is unlocked {CVE-2026-80659} - usb: xhci: Fix sleep in atomic context in xhci_free_streams() {CVE-2026-64465} - x86/boot: Validate console=uart8250 baud rate to fix early boot hang {CVE-2026-72238} - net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390} - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388} - ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer() {CVE-2026-72321} - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} - drm/amdkfd: Avoid integer underflow in EOP ring size calculation. {CVE-2026-98177} - dm thin metadata: fix metadata snapshot consistency on commit failure {CVE-2026-72108} - tcp: challenge ACK for non-exact RST in SYN-RECEIVED {CVE-2026-68118} - sctp: avoid auth_enable sysctl UAF during netns teardown {CVE-2026-68162} - drm/amd/display: use kvzalloc to allocate struct dc {CVE-2026-68436} - KVM: x86/mmu: Fix use-after-free on vendor module reload {CVE-2026-68428} - ftrace: Add global mutex to serialize trace_parser access {CVE-2026-68146} - wifi: mwifiex: bound uAP association event IEs to the event buffer {CVE-2026-68326} - IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock {CVE-2026-68405} - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713} - wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length {CVE-2026-98186} - Update to kernel 3.10.0-1160.167.2.el7 (its only change, CVE-2026-99999, is already carried)