- s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block {CVE-2026-98399} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() {CVE-2026-53195} - hwrng: geode - Fix PCI device refcount leak {CVE-2022-50659} - ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() {CVE-2026-80829} - ubi: Fix use-after-free when volume resizing failed {CVE-2023-53800} - btrfs: inode: Verify inode mode to avoid NULL pointer dereference {CVE-2019-19816} - sctp: avoid livelock while updating retransmit path {CVE-2026-98614} - scsi: libiscsi_tcp: Check the data direction of a Data-In PDU {CVE-2026-98479} - Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457} - net: atl1c: fix soft lockup on out-of-range tpd_cons read {CVE-2026-98489} - net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read {CVE-2026-98488} - Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough {CVE-2026-98602} - ipvs: filter some flags received in the backup server {CVE-2026-98794} - sctp: hold asoc or transport before mod_timer() in timer handlers {CVE-2026-98586} - Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461} - Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460} - net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494} - vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838} - USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697} - net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612} - sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548} - media: av7110: prevent underflow in write_ts_to_decoder() {CVE-2023-54284} - fbcon: Avoid OOB font access if console rotation fails {CVE-2026-46191} - wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163} - wifi: b43: enforce bounds check on firmware key index in b43_rx() {CVE-2026-46122} - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read {CVE-2026-89846} - ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920} - nfsd: fix posix_acl leak on SETACL decode failure {CVE-2026-53397} - dm: fix a buffer overflow in ioctl processing {CVE-2026-46294} - sctp: validate cookie AUTH state before use {CVE-2026-74752} - ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597} - selinux: require every boolean value to be defined {CVE-2026-80913} - netfilter: conntrack: remove sprintf usage {CVE-2026-53002}