- sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413} - ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455} - ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() {CVE-2026-97445} - Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408} - wifi: libipw: fix key index receive bound checks {CVE-2026-93803} - netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077} - configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949} - reboot: fix cad_pid use-after-free race {CVE-2026-97938} - ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931} - net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540} - usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539} - scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536} - xfrm: hold net_device reference under RCU in bundle creation {CVE-2026-98364} - wifi: libipw: reject too-short beacon and probe responses {CVE-2026-98349} - wifi: libipw: reject too-short association responses {CVE-2026-98348} - net: lock the socket in sock_gettstamp() {CVE-2026-98276} - ALSA: core: Fix potential UAF after asynchronous card release {CVE-2026-98266} - wifi: libertas_tf: fix UAF in lbtf_free_adapter() {CVE-2026-98194} - wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() {CVE-2026-72070} - netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266} - ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data {CVE-2026-74388} - PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421} - sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549} - nfsd: validate symlink target length in NFSv4 CREATE {CVE-2026-89699} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633} - KVM: SVM: Bump asid_generation on CPU online to avoid ASID collision after hotplug {CVE-2026-68093} - inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590} - misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383} - slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() {CVE-2026-90057} - slip: fix use-after-free in sl_sync() {CVE-2026-81001} - xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536} - nfsd: gate nfs3 setacl by argp->mask {CVE-2026-89671} - SUNRPC: svcauth_gss: enforce krb5 token minimum length {CVE-2026-89550} - ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116} - char: tlclk: fix use-after-free in tlclk_cleanup() {CVE-2026-80622} - net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689} - sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588} - ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556} - sctp: add INIT verification after cookie unpacking {CVE-2026-72398} - sctp: validate embedded address parameter length {CVE-2026-74287} - configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359} - ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387} - ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322} - ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630} - USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365} - sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320} - net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983} - fbdev: fix use-after-free in store_modes() {CVE-2026-63826} - ipv6: exthdrs: refresh nh after handling HAO option {CVE-2026-63922} - Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471} - Squashfs: check block offset is not negative {CVE-2026-90203} - ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() {CVE-2026-90033} - media: cx23885: cancel NetUP CI work before teardown {CVE-2026-89893} - ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet {CVE-2026-89607} - dm raid1: reserve space for NUL-terminator in build_constructor_string() {CVE-2026-89575} - ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202} - sctp: drop a chunk if its transport was removed {CVE-2026-89478} - udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322} - xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375} - wifi: libipw: reject TKIP frames without a full MIC {CVE-2026-98193} - bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389} - net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422} - USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340} - Bluetooth: serialize accept_q access {CVE-2026-52918} - fix signedness mess in rw_verify_area() on 64bit architectures {CVE-2019-18675} - smb: client: reject userspace cifs.spnego descriptions {CVE-2026-46243} - KEYS: Add a key type op to permit the key description to be vetted {CVE-2026-46243} - ALSA: usb-audio: Fix a DMA to stack memory bug {CVE-2024-53197} - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices {CVE-2024-53197} - HID: core: zero-initialize the report buffer {CVE-2024-50302}