CVE-2026-31408

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0]

We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0").

Let's apply the same fix to mptcp_do_fastclose().

[0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>(CVE-2025-68291)

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.(CVE-2026-23247)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: validate DFA start states are in bounds in unpack_pdb

Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0]

We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0").

Let's apply the same fix to mptcp_do_fastclose().

[0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>(CVE-2025-68291)

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.(CVE-2026-23247)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: validate DFA start states are in bounds in unpack_pdb

Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

syzbot reported divide-by-zero in __tcp_select_window() by MPTCP socket. [0]

We had a similar issue for the bare TCP and fixed in commit 499350a5a6e7 ("tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0").

Let's apply the same fix to mptcp_do_fastclose().

[0]: Oops: divide error: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 6068 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__tcp_select_window+0x824/0x1320 net/ipv4/tcp_output.c:3336 Code: ff ff ff 44 89 f1 d3 e0 89 c1 f7 d1 41 01 cc 41 21 c4 e9 a9 00 00 00 e8 ca 49 01 f8 e9 9c 00 00 00 e8 c0 49 01 f8 44 89 e0 99 <f7> 7c 24 1c 41 29 d4 48 bb 00 00 00 00 00 fc ff df e9 80 00 00 00 RSP: 0018:ffffc90003017640 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88807b469e40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003017730 R08: ffff888033268143 R09: 1ffff1100664d028 R10: dffffc0000000000 R11: ffffed100664d029 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 000055557faa0500(0000) GS:ffff888126135000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f64a1912ff8 CR3: 0000000072122000 CR4: 00000000003526f0 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:281 [inline] __tcp_transmit_skb+0xbc7/0x3aa0 net/ipv4/tcp_output.c:1568 tcp_transmit_skb net/ipv4/tcp_output.c:1649 [inline] tcp_send_active_reset+0x2d1/0x5b0 net/ipv4/tcp_output.c:3836 mptcp_do_fastclose+0x27e/0x380 net/mptcp/protocol.c:2793 mptcp_disconnect+0x238/0x710 net/mptcp/protocol.c:3253 mptcp_sendmsg_fastopen+0x2f8/0x580 net/mptcp/protocol.c:1776 mptcp_sendmsg+0x1774/0x1980 net/mptcp/protocol.c:1855 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0xe5/0x270 net/socket.c:742 __sys_sendto+0x3bd/0x520 net/socket.c:2244 __do_sys_sendto net/socket.c:2251 [inline] __se_sys_sendto net/socket.c:2247 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2247 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f66e998f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffff9acedb8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f66e9be5fa0 RCX: 00007f66e998f749 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffff9acee10 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007f66e9be5fa0 R14: 00007f66e9be5fa0 R15: 0000000000000006 </TASK>(CVE-2025-68291)

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.(CVE-2026-23247)

In the Linux kernel, the following vulnerability has been resolved:

apparmor: validate DFA start states are in bounds in unpack_pdb

Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix extent map use-after-free when handling missing device in read_one_chunk

Store the error code before freeing the extent_map. Though it's reference counted structure, in that function it's the first and last allocation so this would lead to a potential use-after-free.

The error can happen eg. when chunk is stored on a missing device and the degraded mount option is missing.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216721(CVE-2022-50300)

In the Linux kernel, the following vulnerability has been resolved:

parisc: Fix locking in pdc_iodc_print() firmware call

Utilize pdc_lock spinlock to protect parallel modifications of the iodc_dbuf[] buffer, check length to prevent buffer overflow of iodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong indentings.(CVE-2022-50518)

In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: Add length check in indx_get_root

This adds a length check to guarantee the retrieved index root is legit.

[ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243 [ 162.460851] [ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42 [ 162.461744] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 162.462609] Call Trace: [ 162.462954] <TASK> [ 162.463276] dump_stack_lvl+0x49/0x63 [ 162.463822] print_report.cold+0xf5/0x689 [ 162.464608] ? unwind_get_return_address+0x3a/0x60 [ 162.465766] ? hdr_find_e.isra.0+0x10c/0x320 [ 162.466975] kasan_report+0xa7/0x130 [ 162.467506] ? _raw_spin_lock_irq+0xc0/0xf0 [ 162.467998] ? hdr_find_e.isra.0+0x10c/0x320 [ 162.468536] __asan_load2+0x68/0x90 [ 162.468923] hdr_find_e.isra.0+0x10c/0x320 [ 162.469282] ? cmp_uints+0xe0/0xe0 [ 162.469557] ? cmp_sdh+0x90/0x90 [ 162.469864] ? ni_find_attr+0x214/0x300 [ 162.470217] ? ni_load_mi+0x80/0x80 [ 162.470479] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 162.470931] ? ntfs_bread_run+0x190/0x190 [ 162.471307] ? indx_get_root+0xe4/0x190 [ 162.471556] ? indx_get_root+0x140/0x190 [ 162.471833] ? indx_init+0x1e0/0x1e0 [ 162.472069] ? fnd_clear+0x115/0x140 [ 162.472363] ? _raw_spin_lock_irqsave+0x100/0x100 [ 162.472731] indx_find+0x184/0x470 [ 162.473461] ? sysvec_apic_timer_interrupt+0x57/0xc0 [ 162.474429] ? indx_find_buffer+0x2d0/0x2d0 [ 162.474704] ? do_syscall_64+0x3b/0x90 [ 162.474962] dir_search_u+0x196/0x2f0 [ 162.475381] ? ntfs_nls_to_utf16+0x450/0x450 [ 162.475661] ? ntfs_security_init+0x3d6/0x440 [ 162.475906] ? is_sd_valid+0x180/0x180 [ 162.476191] ntfs_extend_init+0x13f/0x2c0 [ 162.476496] ? ntfs_fix_post_read+0x130/0x130 [ 162.476861] ? iput.part.0+0x286/0x320 [ 162.477325] ntfs_fill_super+0x11e0/0x1b50 [ 162.477709] ? put_ntfs+0x1d0/0x1d0 [ 162.477970] ? vsprintf+0x20/0x20 [ 162.478258] ? set_blocksize+0x95/0x150 [ 162.478538] get_tree_bdev+0x232/0x370 [ 162.478789] ? put_ntfs+0x1d0/0x1d0 [ 162.479038] ntfs_fs_get_tree+0x15/0x20 [ 162.479374] vfs_get_tree+0x4c/0x130 [ 162.479729] path_mount+0x654/0xfe0 [ 162.480124] ? putname+0x80/0xa0 [ 162.480484] ? finish_automount+0x2e0/0x2e0 [ 162.480894] ? putname+0x80/0xa0 [ 162.481467] ? kmem_cache_free+0x1c4/0x440 [ 162.482280] ? putname+0x80/0xa0 [ 162.482714] do_mount+0xd6/0xf0 [ 162.483264] ? path_mount+0xfe0/0xfe0 [ 162.484782] ? __kasan_check_write+0x14/0x20 [ 162.485593] __x64_sys_mount+0xca/0x110 [ 162.486024] do_syscall_64+0x3b/0x90 [ 162.486543] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 162.487141] RIP: 0033:0x7f9d374e948a [ 162.488324] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008 [ 162.489728] RSP:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

mISDN: hfcpci: Fix warning when deleting uninitialized timer

With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat:

[ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] <TASK> [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update.(CVE-2025-39833)

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd/pmc: Add support for Van Gogh SoC

The ROG Xbox Ally (non-X) SoC features a similar architecture to the Steam Deck. While the Steam Deck supports S3 (s2idle causes a crash), this support was dropped by the Xbox Ally which only S0ix suspend.

Since the handler is missing here, this causes the device to not suspend and the AMD GPU driver to crash while trying to resume afterwards due to a power hang.(CVE-2025-68334)

In the Linux kernel, the following vulnerability has been resolved:

team: Move team device type change at the end of team_port_add

Attempting to add a port device that is already up will expectedly fail, but not before modifying the team device header_ops.

In the case of the syzbot reproducer the gre0 device is already in state UP when it attempts to add it as a port device of team0, this fails but before that header_ops->create of team0 is changed from eth_header to ipgre_header in the call to team_dev_type_check_change.

Later when we end up in ipgre_header() struct ip_tunnel* points to nonsense as the private data of the device still holds a struct team.

Example sequence of iproute2 commands to reproduce the hang/BUG(): ip link add dev team0 type team ip link add dev gre0 type gre ip link set dev gre0 up ip link set dev gre0…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)

• kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)

• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

• kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)

• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)

• kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)

• kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)

• kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)

• kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)

• kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)

• kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-31408 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31408 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-31408 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-31408 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-31408 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net: af_can: do not leave a dangling sk pointer in can_create() (CVE-2024-56603)
• kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CVE-2025-39766)
• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
• kernel: scsi: qla2xxx: Fix improper freeing of purex item (CVE-2025-68741)
• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
• kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling (CVE-2026-23401)
• kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (CVE-2026-31402)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() (CVE-2026-31607)
• kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128)
• kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)
• kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300)
• kernel: Read root-owned files as an unprivileged user (CVE-2026-46333)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free.

Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.

Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

• octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c {CVE-2024-56726}
• octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c {CVE-2024-56679}
• USB: chipidea: fix memory leak with using debugfs_lookup() {CVE-2023-53334}
• drivers: serial: jsm: fix some leaks in probe {CVE-2022-50312}
• drm: amd: display: Fix memory leakage {CVE-2023-53605}
• netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent {CVE-2026-43026}
• net: Drop the lock in skb_may_tx_timestamp() {CVE-2026-43216}
• nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
• ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
• net: mdio: unexport __init-annotated mdio_bus_init() {CVE-2022-49350}
• netfilter: ipset: Rework long task execution when adding/deleting entries {CVE-2023-53549}
• ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() {CVE-2023-53275}
• thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash {CVE-2022-50494}
• can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message {CVE-2026-23307}
• usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
• tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
• cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() {CVE-2023-52942}
• net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path {CVE-2023-52703}
• usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() {CVE-2022-50246}
• bus: mhi: host: Range check CHDBOFF and ERDBOFF {CVE-2023-53598}
• hwmon: (coretemp) Simplify platform device handling {CVE-2023-53612}
• scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
• dm crypt: add cond_resched() to dmcrypt_write() {CVE-2023-53051}
• xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
• wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() {CVE-2024-43879}
• RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() {CVE-2023-53335}
• regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
• HID: prodikeys: Check presence of pm->input_ep82 {CVE-2026-43251}
• perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() {CVE-2022-50510}
• wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
• trace/blktrace: fix memory leak with using debugfs_lookup() {CVE-2023-53408}
• dm-verity: correctly handle dm_bufio_client_create() failure {CVE-2026-43132}
• pstore: ram_core: fix incorrect success return when vmap() fails {CVE-2026-43124}
• crypto: af-alg - fix NULL pointer dereference in scatterwalk {CVE-2026-43043}
• net: use skb_header_pointer() for TCPv4 GSO frag_off check {CVE-2026-43036}
• scsi: mpi3mr: Fix config page DMA memory leak {CVE-2023-53120}
• net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
• net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx {CVE-2023-53546}
• drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() {CVE-2025-37852}
• bpf: Prevent decl_tag from being referenced in func_proto arg {CVE-2022-50883}
• arm64: set __exception_irq_entry with __irq_entry as a default {CVE-2023-54322}
• class: fix possible memory leak in __class_register() {CVE-2022-50578}
• ALSA: usb-audio: Stop parsing channels bits when all channels are found. {CVE-2024-27436}
• net/mlx5: fix potential memory leak in mlx5e_init_rep_rx {CVE-2023-54106}
• net/mlx5: E-Switch, Fix an Oops in error handling code {CVE-2023-53058}
• scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() {CVE-2023-53078}
• ice: xsk: disable txq irq before flushing hw {CVE-2023-53102}
• selinux: fix memleak in security_read_state_kernel() {CVE-2022-50201}
• efi: runtime: Fix potential overflow of soft-reserved region size {CVE-2024-26843}
• drm/amdgpu: Fix potential null pointer derefernce {CVE-2023-52814}
• ata: libata-core: Fix null…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

• ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
• tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
• mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
• cpuset: fix warning when disabling remote partition {CVE-2025-71142}
• virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
• idpf: fix error handling in the init_task on load {CVE-2026-23017}
• rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
• block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
• can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
• virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
• net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
• gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
• RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
• iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
• lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
• scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
• module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
• af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• media: dvbdev: adopts refcnt to avoid UAF {CVE-2022-50274}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields {CVE-2021-47485}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• proc/vmcore: fix clearing user buffer by properly using clear_user()
• staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
• ASoC: ops: Correct bounds check for second channel on SX controls {CVE-2022-48951}
• ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• media: dvbdev: adopts refcnt to avoid UAF {CVE-2022-50274}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields {CVE-2021-47485}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• proc/vmcore: fix clearing user buffer by properly using clear_user()
• staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
• ASoC: ops: Correct bounds check for second channel on SX controls {CVE-2022-48951}
• ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}

• KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role {CVE-2026-46113}
• btrfs: fix use-after-free after failure to create a snapshot {CVE-2022-48733}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfs: delete attr leaf freemap entries when empty {CVE-2026-43158}
• net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
• media: dvbdev: adopts refcnt to avoid UAF {CVE-2022-50274}
• igbvf: fix double free in igbvf_probe {CVE-2021-47589}
• scsi: scsi_debug: Sanity check block descriptor length in resp_mode_select() {CVE-2021-47576}
• ALSA: seq: Fix race of snd_seq_timer_open() {CVE-2021-47281}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields {CVE-2021-47485}
• wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
• proc/vmcore: fix clearing user buffer by properly using clear_user()
• staging: rtl8192e: Fix use after free in _rtl92e_pci_disconnect()
• ASoC: ops: Correct bounds check for second channel on SX controls {CVE-2022-48951}
• ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() {CVE-2022-48951}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}

• ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: conntrack: switch to siphash {CVE-2021-3773}
• gpiolib: cdev: fix NULL-pointer dereferences {CVE-2022-50453}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• xen: fix buffer overflow in buildid_show() {CVE-2026-31786}
• NTB: fix possible name leak in ntb_register_device() {CVE-2023-52652}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2025-68214
  • timers: Fix NULL function pointer race in timer_shutdown_sync() {CVE-2025-68214}
• CVE-2024-58093
  • PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-64095
  • batman-adv: bla: avoid double decrement of bla.num_requests {CVE-2026-64095}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64096
  • batman-adv: mcast: fix use-after-free in orig_node RCU release {CVE-2026-64096}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64218
  • batman-adv: bla: fix report_work leak on backbone_gw purge {CVE-2026-64218}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64115
  • vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
• CVE-2026-64114
  • ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• CVE-2026-64113
  • ixgbevf: fix use-after-free in VEPA multicast source pruning {CVE-2026-64113}
• CVE-2026-64103
  • scsi: isci: Fix use-after-free in device removal path {CVE-2026-64103}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2025-39686
  • comedi: Make insn_rw_emulate_bits() do insn->n samples {CVE-2025-39686}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2025-39901
  • i40e: remove read access to debugfs files {CVE-2025-39901}
• CVE-2023-54207
  • HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
• CVE-2023-53446
  • PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
• CVE-2022-50422
  • scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• CVE-2022-50066
  • net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
• CVE-2025-71152
  • net: dsa: properly keep track of master (conduit) reference {CVE-2025-71152}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-31685
  • netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2023-53338
  • lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
• CVE-2026-43076…

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2025-38068
  • crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• CVE-2024-56570
  • ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
• CVE-2025-21753
  • btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
• CVE-2026-46116
  • xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• CVE-2022-49811
  • drbd: use after free in drbd_create_device() {CVE-2022-49811}
• CVE-2022-49059
  • nfc: nci: add flush_workqueue to prevent uaf {CVE-2022-49059}
• CVE-2025-22004
  • net: atm: fix use after free in lec_send() {CVE-2025-22004}
• CVE-2025-21764
  • ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• CVE-2025-21762
  • arp: use RCU protection in arp_xmit() {CVE-2025-21762}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2026-46090
  • ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• CVE-2026-53131
  • netfilter: require Ethernet MAC header before using eth_hdr() {CVE-2026-53131}
• CVE-2026-53091
  • net: pull headers in qdisc_pkt_len_init() {CVE-2026-53091}
• CVE-2026-52986
  • netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• CVE-2025-71116
  • libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
• CVE-2026-43493
  • crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• CVE-2026-31597
  • ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY {CVE-2026-31597}
• CVE-2026-43116
  • netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• CVE-2026-43458
  • serial: caif: hold tty->link reference in ldisc_open and ser_release {CVE-2026-43458}
• CVE-2026-53002
  • netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• CVE-2026-46212
  • batman-adv: bla: prevent use-after-free when deleting claims {CVE-2026-46212}
• CVE-2026-31787
  • xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• CVE-2023-53357
  • md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2026-43076
  • ocfs2: validate inline data i_size during inode read {CVE-2026-43076}
• CVE-2025-38464
  • tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43279
  • ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
• CVE-2024-36013
  • Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• CVE-2026-46270
  • power: supply: rt9455: Fix use-after-free in power_supply_changed() {CVE-2026-46270}
• CVE-2026-46259
  • procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• CVE-2026-52998
  • netfilter: xt_osf: fix potential NULL…

• net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
• ocfs2: validate directory-index entry counts when reading metadata {CVE-2026-89492}
• ocfs2: validate dx_root extent list fields during block read {CVE-2026-89492}
• nvme-tcp: reject a read that transferred too few bytes {CVE-2026-89480}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• net/packet: defer vmalloc TX_RING free until skbs finish {CVE-2026-80841}
• netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
• netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
• packet: use consistent hard_header_len in non-ring send paths {CVE-2026-74582}
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header {CVE-2026-80731}
• net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
• net: do not send ICMP/NDISC Redirects when peer allocation fails {CVE-2026-74550}
• tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() {CVE-2026-72404}
• net/sched: sch_teql: move rcu_read_lock()/spin_lock() from _bh variants {CVE-2026-72390}
• net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF {CVE-2026-72390}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• sunrpc: route to a populated pool in svc_pool_for_cpu() {CVE-2026-89549}
• sctp: fix stream->outcnt underflow on duplicate RECONF responses {CVE-2026-89476}
• sctp: distinguish sequence zero from wildcard in reconf lookup {CVE-2026-89476}
• ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• net/sched: fix packet loop on netem when duplicate is on {CVE-2026-63983}
• net: Introduce skb tc depth field to track packet loops {CVE-2026-63983}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst {CVE-2026-72255}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• scsi: xen: scsiback: Free unsubmitted command instead of double-putting it {CVE-2026-72085}
• ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). {CVE-2026-74289}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• net/sched: defer qdisc freeing after failed creation {CVE-2026-98017}
• IB/isert: wait for deferred control PDU completions before releasing the connection {CVE-2026-98357}
• RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
• sctp: validate embedded address parameter length {CVE-2026-74287}
• nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget {CVE-2026-89674}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
• RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() {CVE-2026-46181}
• nvmet-tcp: fix race between ICReq handling and queue teardown {CVE-2026-46135}
• ALSA: aloop: Fix peer runtime UAF during format-change stop {CVE-2026-46090}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
• gfs2: Fix use-after-free in iomap inline data write path {CVE-2026-45984}
• bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
• mt76: fix use-after-free by removing a non-RCU wcid pointer {CVE-2022-49328}
• mt76: fix per-driver wcid range checks after wcid array size bump {CVE-2022-49328}
• af_unix: Fix UAF read of…