CVE-2026-43499

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree.

This happens as follows:

1. Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2. Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A);

3. Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4. Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.

Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.(CVE-2025-39759)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'.(CVE-2025-39952)

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.(CVE-2025-68330)

In the Linux kernel, the following vulnerability has been resolved:

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it.(CVE-2025-68755)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979)

• kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)

• kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)

• kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

• kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)

Bug Fix(es) and Enhancement(s):

• Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:Rocky Linux-183236)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

• kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)

• kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Linux kernel: Memory leak in networking due to incorrect GRO packet handling (CVE-2026-22979)
• kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
• kernel: net: bridge: use a stable FDB dst snapshot in RCU readers (CVE-2026-46086)
• kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
• kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)

Bug Fix(es) and Enhancement(s):

• Kernel panic very early during boot while reading a tracefs file (available_filter_functions) due to invalid module name pointer [9.8.z] (JIRA:AlmaLinux-183236)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
• kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
• kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Please update

Please update

In remove_waiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Linux kernel, the following vulnerability has been resolved:

rtmutex: Use waiter::task instead of current in remove_waiter()

remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().

In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:

1. the rbtree dequeue happens without waiter::task::pi_lock being held

2. the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.

3. rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task

Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.

[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• net: usb: pegasus: validate USB endpoints {CVE-2026-23290}

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• brcmfmac: add subtype check for event handling in data path {CVE-2019-9503}
• nl80211: validate beacon head {CVE-2019-16746}
• ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c {CVE-2018-19824}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• mac80211: Reject malformed SSID elements {CVE-2019-17133}

• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• i40e: Fix use-after-free in i40e_client_subtask() {CVE-2021-46991}
• ethernet:enic: Fix a use after free bug in enic_hard_start_xmit {CVE-2021-46998}

• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• brcmfmac: add subtype check for event handling in data path {CVE-2019-9503}
• nl80211: validate beacon head {CVE-2019-16746}
• ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c {CVE-2018-19824}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• mac80211: Reject malformed SSID elements {CVE-2019-17133}

• CVE-2026-53166
  • futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• CVE-2026-43499
  • rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• Miscellaneous upstream changes
  • Revert "ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}"
• Bump ABI 4.15.0-262

• CVE-2026-53166
  • futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• CVE-2026-43499
  • rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• Miscellaneous upstream changes
  • Revert "ext4: fix warning in ext4_iomap_begin as race between bmap and write {CVE-2022-50082}"
• Bump ABI 4.15.0-262

• CVE-2026-53166
  • futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• CVE-2026-43499
  • rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• Bump ABI 4.4.0-285

• ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: conntrack: switch to siphash {CVE-2021-3773}
• gpiolib: cdev: fix NULL-pointer dereferences {CVE-2022-50453}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• xen: fix buffer overflow in buildid_show() {CVE-2026-31786}
• NTB: fix possible name leak in ntb_register_device() {CVE-2023-52652}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}

• CVE-2026-31607
  • usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• CVE-2026-31527
  • driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• CVE-2026-43493
  • crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• CVE-2026-43038
  • ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}
• CVE-2026-43037
  • ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• CVE-2026-23083
  • fou: Don't allow 0 for FOU_ATTR_IPPROTO. {CVE-2026-23083}
• CVE-2024-57982
  • xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}
• CVE-2024-50115
  • KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
• CVE-2026-53166
  • futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• CVE-2026-43499
  • rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• CVE-2023-6546
  • tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2023-53286
  • RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
• CVE-2023-53259
  • VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
• CVE-2026-31500
  • Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• CVE-2023-52916
  • media: aspeed: Fix memory overwrite if timing is 1600x900 {CVE-2023-52916}
• CVE-2022-50021
  • ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• CVE-2022-49799
  • tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• CVE-2022-49234
  • net: dsa: Avoid cross-chip syncing of VLAN filtering {CVE-2022-49234}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2026-23164
  • rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164}
• CVE-2026-23150
  • nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). {CVE-2026-23150}
• CVE-2026-23133
  • wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133}
• CVE-2026-23121
  • mISDN: annotate data-race around dev->work {CVE-2026-23121}
• CVE-2026-23108
  • can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
• CVE-2026-23103
  • ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• CVE-2026-23101
  • leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101}
• CVE-2026-23095
  • gue: Fix skb memleak with inner IP protocol 0. {CVE-2026-23095}
• CVE-2026-23084
  • be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084}
• CVE-2026-23080
  • can: mcba_usb: mcba_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23080}
• CVE-2026-23071
  • regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071}
• CVE-2026-23058
  • can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
• CVE-2026-23038
  • pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• CVE-2026-23011
  • ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
• CVE-2026-23003
  • ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• CVE-2025-71194
  • btrfs: fix deadlock in wait_current_trans() due to ignored transaction type {CVE-2025-71194}
• CVE-2026-31417
  • net/x25: Fix overflow when accumulating packets {CVE-2026-31417}
• CVE-2026-31396
  • net: macb: fix use-after-free access to PTP clock…

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

• IB/mlx5: Fix potential deadlock in MR deregistration
• eventpoll: fix ep_remove struct eventpoll / struct file UAF {CVE-2026-46242}
• locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-43499}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}

• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• net: usb: pegasus: validate USB endpoints {CVE-2026-23290}