- fbcon: Fix OOB access in font allocation {CVE-2025-39967} - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path {CVE-2026-23273} - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209} - net_sched: sch_sfq: move the limit validation {CVE-2025-37752} - bpf: Fix oob access in cgroup local storage {CVE-2025-38502} - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588} - driver core: enforce device_lock for driver_match_device() {CVE-2026-31688} - scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT {CVE-2026-43475} - unshare: fix unshare_fs() handling {CVE-2026-43472} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451} - nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448} - e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445} - cgroup: fix race between task migration and iteration {CVE-2026-43439} - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436} - usb: image: mdc800: kill download URB on timeout {CVE-2026-43425} - tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411} - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381} - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424} - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423} - net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422} - net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421} - netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418} - netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416} - sunrpc: fix cache_request leak in cache_release {CVE-2026-31400} - PM: runtime: Fix a race condition related to device removal {CVE-2026-23452} - net: usb: kaweth: validate USB endpoints {CVE-2026-23312} - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399} - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448} - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450} - RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607} - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454} - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441} - nvmet: fix memory leak of bio integrity {CVE-2025-38405} - nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. {CVE-2025-38400} - dmaengine: idxd: fix memory leak in error handling path of idxd_alloc {CVE-2025-38015} - bonding: check xdp prog when set bond mode {CVE-2025-22105} - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427} - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428} - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427} - ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415} - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() {CVE-2026-31411} - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243} - perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344} - x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363} - dm: remove fake timeout to avoid leak request {CVE-2026-43314} - drm: Account property blob allocations to memcg {CVE-2026-43287} - HID: magicmouse: Do not crash on missing msc->input {CVE-2026-43140} - drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify {CVE-2026-43318} - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding {CVE-2026-43315} - ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() {CVE-2026-43313} - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() {CVE-2025-71297} - xfrm: always flush state and policy upon NETDEV_UNREGISTER event {CVE-2026-43167} - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163} - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() {CVE-2026-43136} - net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156} - HID: hid-pl: handle probe errors {CVE-2026-43152} - fbcon: check return value of con2fb_acquire_newinfo() {CVE-2026-43123} - Bluetooth: hci_sync: annotate data-races around hdev->req_status {CVE-2026-43119} - HID: prodikeys: Check presence of pm->input_ep82 {CVE-2026-43251} - net: Drop the lock in skb_may_tx_timestamp() {CVE-2026-43216} - drm/ioc32: stop speculation on the drm_compat_ioctl path {CVE-2026-31781} - vxlan: validate ND option lengths in vxlan_na_create {CVE-2026-31738} - drm/amdgpu: prevent immediate PASID reuse case {CVE-2026-31462} - EFI/CPER: don't go past the ARM processor CPER record buffer {CVE-2026-43266} - gfs2: fiemap page fault fix {CVE-2026-43262} - dm-verity: correctly handle dm_bufio_client_create() failure {CVE-2026-43132} - pstore: ram_core: fix incorrect success return when vmap() fails {CVE-2026-43124} - crypto: af-alg - fix NULL pointer dereference in scatterwalk {CVE-2026-43043} - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE {CVE-2024-45025} - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP {CVE-2025-68179} - sr9700: sanity check for packet length {CVE-2022-26966} - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() {CVE-2026-23004} - integrity: Fix memory leakage in keyring allocation error path {CVE-2022-50395} - kprobes: don't call disarm_kprobe() for disabled kprobes {CVE-2022-50008} - esp: fix skb leak with espintcp and async crypto {CVE-2026-31518} - net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684} - netfilter: xt_multiport: validate range encoding in checkentry {CVE-2026-31681} - net: use skb_header_pointer() for TCPv4 GSO frag_off check {CVE-2026-43036} - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak {CVE-2026-43035} - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new {CVE-2023-52887} - media: uvcvideo: Fix crash during unbind if gpio unit is in use {CVE-2024-58079} - net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076} - net: fec: remove .ndo_poll_controller to avoid deadlocks {CVE-2024-38553} - net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670} - bridge: br_nd_send: validate ND option lengths {CVE-2026-31752} - APEI/GHES: ensure that won't go past CPER allocated record {CVE-2026-43277} - ceph: supply snapshot context in ceph_zero_partial_object() {CVE-2026-43273} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent {CVE-2026-43026} - usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE {CVE-2026-23401} - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532} - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' {CVE-2022-50553} - ALSA: usb-audio: Use the right limit for PCM OOB check - ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208} - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050} - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052} - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020} - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040} - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027} - mm/kasan: fix double free for kasan pXds {CVE-2026-31686} - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452} - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696} - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455} - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581} - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238} - iommufd: Fix race during abort for file descriptors {CVE-2025-39966} - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}