- net: skbuff: propagate shared-frag marker in skb_zerocopy() - kprobes: Protect kprobe_blacklist with RCU {CVE-2026-89988} - bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041} - smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs {CVE-2026-98171} - smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175} - RDMA/core: Fix potential use after free in ib_free_cq() {CVE-2026-92508} - RDMA/core: Fix potential use after free in counter_release() {CVE-2026-92509} - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392} - iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448} - iommu/amd: Fix clone_alias() to use the original device's devid {CVE-2026-53053} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181} - exfat: fix out-of-bounds access of directory entries {CVE-2024-53147} - btrfs: abort transaction on failure to update inode for hole punching and reflinking {CVE-2026-98269} - btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300} - hwrng: core - fix rng list on registration error {CVE-2026-93163} - usb: fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-93117}