CVE-2026-31786

In the Linux kernel, the following vulnerability has been resolved:

Buffer overflow in drivers/xen/sys-hypervisor.c

The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string.

The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL.

00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017

So use a memcpy instead of sprintf to have the correct value:

00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014

(the above have a hack to embed a zero inside and check it's returned correctly).

This is XSA-485 / CVE-2026-31786

In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree.

This happens as follows:

1. Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2. Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A);

3. Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4. Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.

Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.(CVE-2025-39759)

In the Linux kernel, the following vulnerability has been resolved:

wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'.(CVE-2025-39952)

In the Linux kernel, the following vulnerability has been resolved:

iio: accel: bmc150: Fix irq assumption regression

The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts:

Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read

PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4

This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why.

Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not.(CVE-2025-68330)

In the Linux kernel, the following vulnerability has been resolved:

staging: most: remove broken i2c driver

The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging.

Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it.(CVE-2025-68755)

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)

• kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)

• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)

• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)

• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)

• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)

• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)

• kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)

• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)

• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)

• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)

• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

• Rocky Linux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [rhel-10.2.z] (JIRA:Rocky Linux-166047)

• Rocky Linux9.5 crash due to lpfc NULL ndlp->vport [rhel-10.2.z] (JIRA:Rocky Linux-171774)

• objtool static_call check blocks build of out-of-tree livepatch modules on Rocky Linux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:Rocky Linux-178495)

• ibmveth Adapter Freeze with Small MSS [rhel-10.2.z] (JIRA:Rocky Linux-179723)

• rbd: eliminate a race in lock_dwork draining on unmap [rhel-10.2.z] (JIRA:Rocky Linux-183127)

• Rocky Linux10.0 - s390/mm: Add missing secure storage access fixups [rhel-10.2.z] (JIRA:Rocky Linux-183319)

• [Rocky Linux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:Rocky Linux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-31786 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31786 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: Buffer overflow in drivers/xen/sys-hypervisor.c The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is neither NUL terminated nor a string. The first causes a buffer overflow as sprintf in buildid_show will read and copy till it finds a NUL. 00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| 00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| 00000017 So use a memcpy instead of sprintf to have the correct value: 00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| 00000010 b9 a8 01 42 |...B| 00000014 (the above have a hack to embed a zero inside and check it's returned correctly). This is XSA-485 / CVE-2026-31786

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: Linux kernel: smb: client: reject userspace cifs.spnego descriptions (CVE-2026-46243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CVE-2026-31474)
• kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669)
• kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641)
• kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787)
• kernel: Buffer overflow in drivers/xen/sys-hypervisor.c (CVE-2026-31786)
• kernel: net: mana: fix use-after-free in add_adev() error path (CVE-2026-43056)
• kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
• kernel: bnxt_en: Fix RSS context delete logic (CVE-2026-43260)
• kernel: crypto: caam - fix overflow on long hmac keys (CVE-2026-43330)
• kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331)
• kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)
• kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
• kernel: wifi: mac80211: remove station if connection prep fails (CVE-2026-46125)
• kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173)
• kernel: wifi: mac80211: use safe list iteration in radar detect work (CVE-2026-46166)

Bug Fix(es) and Enhancement(s):

• AlmaLinux10.0 - s390/ap: Expose ap_bindings_complete_count counter via sysfs [almalinux-10.2.z] (JIRA:AlmaLinux-166047)
• AlmaLinux9.5 crash due to lpfc NULL ndlp->vport [almalinux-10.2.z] (JIRA:AlmaLinux-171774)
• objtool static_call check blocks build of out-of-tree livepatch modules on AlmaLinux 10.2 GA kernels ? missing upstream revert f495054bd12e (JIRA:AlmaLinux-178495)
• ibmveth Adapter Freeze with Small MSS [almalinux-10.2.z] (JIRA:AlmaLinux-179723)
• rbd: eliminate a race in lock_dwork draining on unmap [almalinux-10.2.z] (JIRA:AlmaLinux-183127)
• AlmaLinux10.0 - s390/mm: Add missing secure storage access fixups [almalinux-10.2.z] (JIRA:AlmaLinux-183319)
• [AlmaLinux10.2.z] Enable Pretimeout Watchdog Panic Functionality on x86 (JIRA:AlmaLinux-182299)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
• Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
• net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
• bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
• net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• net: Fix an unsafe loop on the list {CVE-2024-50024}
• sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
• wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
• wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
• drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
• xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
• serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
• iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
• octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
• sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
• net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
• sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
• netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
• thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
• x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
• net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
• ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
• drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
• Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
• fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
• sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
• dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
• netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
• tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
• mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
• xen/netfront: stop tx queues during live migration {CVE-2022-48969}
• Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
• ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
• can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
• nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
• smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
• cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
• netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
• drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
• drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
• bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
• wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
• trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
• drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
• bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
• drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
• ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
• RDMA/irdma: Initialize…

• ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
• futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock {CVE-2026-53166}
• rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
• net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• driver core: enforce device_lock for driver_match_device() {CVE-2026-31688}
• driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: conntrack: switch to siphash {CVE-2021-3773}
• gpiolib: cdev: fix NULL-pointer dereferences {CVE-2022-50453}
• tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
• tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
• nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
• crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
• xen: fix buffer overflow in buildid_show() {CVE-2026-31786}
• NTB: fix possible name leak in ntb_register_device() {CVE-2023-52652}
• ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
• erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}

• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
• net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
• net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() {CVE-2025-40187}
• sctp: auth: verify auth requirement when auth_chunk is NULL {CVE-2026-68300}
• ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup() {CVE-2026-53221}
• cifs: some missing initializations on replay {CVE-2026-31693}
• drop_monitor: perform u64_stats updates under IRQ-disabled section {CVE-2026-68286}
• net/tcp-md5: Fix MAC comparison to be constant-time {CVE-2026-43383}
• ima: Handle error code returned by ima_filter_rule_match() {CVE-2025-68740}
• accel/ivpu: Add bounds check for firmware runtime memory {CVE-2026-53206}
• ata: libata-core: Disable LPM on ST1000DM010-2EP102 {CVE-2026-43487}
• ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
• NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags {CVE-2025-68764}
• bonding: fix devconf_all NULL dereference when IPv6 is disabled {CVE-2026-68336}
• mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
• octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
• net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
• spi: fix use-after-free on controller registration failure {CVE-2026-31389}
• nvme: fix admin request_queue lifetime {CVE-2025-68265}
• RDMA/bnxt_re: Add sanity checks on rdev validity {CVE-2025-21901}
• smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
• net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow {CVE-2025-39834}
• sctp: Fix MAC comparison to be constant-time {CVE-2025-40204}
• net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path {CVE-2025-39830}
• nfsd: Fix cred ref leak in nfsd_nl_threads_set_doit() {CVE-2026-23297}
• thermal/of: Fix reference leak in thermal_of_cm_lookup() {CVE-2026-45925}
• usbnet: Prevents free active kevent {CVE-2025-68312}
• smb: client: fix oops due to uninitialised var in smb2_unlink() {CVE-2026-23282}
• fs/buffer: add alert in try_to_free_buffers() for folios without buffers {CVE-2025-71295}
• cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update {CVE-2025-23137}
• Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync {CVE-2026-53251}
• wifi: iwlwifi: mvm: don't send a 6E related command when not supported {CVE-2026-43325}
• io_uring/napi: cap busy_poll_to 10 msec {CVE-2026-53321}
• io_uring/net: fix io_req_post_cqe abuse by send bundle {CVE-2025-23154}
• xfs: fix a resource leak in xfs_alloc_buftarg() {CVE-2026-46005}
• firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() {CVE-2026-68444}
• i2c: core: fix adapter deregistration race {CVE-2026-64279}
• wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv() {CVE-2026-68439}
• firmware: arm_ffa: Check for NULL FF-A ID table while driver registration {CVE-2026-64166}
• wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv() {CVE-2026-68309}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
• ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408}
• accel/ivpu: Add bounds checks for firmware log indices {CVE-2026-53205}
• PCI/P2PDMA: Release per-CPU pgmap ref when vm_insert_page() fails {CVE-2026-45880}
• nvme-multipath: fix lockdep WARN due to partition scan work {CVE-2025-68218}
• dm: fix unlocked test for dm_suspended_md {CVE-2026-46327}
• net: slip: serialize receive against buffer reallocation…

• FIX: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
• mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit().
• net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
• ipv4: start using dst_dev_rcu()
• tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
• tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• udp6: Fix race condition in udp6_sendmsg & connect
• ipv6: use RCU in ip6_output() {CVE-2025-40158}
• ipv6: use RCU in ip6_xmit() {CVE-2025-40135}
• ipv6: start using dst_dev_rcu()
• net: dst: introduce dst->dev_rcu
• neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158}
• net: Add locking to protect skb->dev access in ip_output
• ipv6: adopt skb_dst_dev() and skb_dst_dev_net_rcu helpers
• ipv6: adopt dst_dev() helper
• ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
• net: dst: add four helpers to annotate data-races around dst->dev
• tcp: convert to dev_net_rcu()
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• ndisc: ndisc_send_redirect() cleanup
• ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
• ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
• ipv6: icmp: convert to dev_net_rcu()
• ipv4: icmp: convert to dev_net_rcu()
• ipv4: use RCU protection in __ip_rt_update_pmtu() {CVE-2025-21766}
• ipv6: use RCU protection in ip6_default_advmss() {CVE-2025-21765}
• fix: ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
• neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763}
• arp: use RCU protection in arp_xmit() {CVE-2025-21762}
• openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761}
• ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760}
• ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759}
• ipv6: mcast: add RCU protection to mld_newpack() {CVE-2025-21758}
• ipv4: use RCU protection in rt_is_expired()
• ipv4: use RCU protection in inet_select_addr()
• ipv4: add RCU protection to ip4_dst_hoplimit()
• flow_dissector: use RCU protection to fetch dev_net()
• net: add dev_net_rcu() helper
• net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
• Revert "net: add dst_dev_rcu() helper for safe dst->dev access"
• Revert "net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}"
• Revert "ipv6: use RCU for dst->dev access in ip6_xmit, ip6_output, ip6_finish_output2 {CVE-2025-40135} {CVE-2025-40158}"
• nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers {CVE-2026-23112}
• Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
• nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
• NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• drop_monitor: fix size calculations for 64-bit attributes {CVE-2026-68287}
• sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
• RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
• IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
• drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
• RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
• nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
• smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
• usb: free iso schedules on failed submit {CVE-2026-64348}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
• crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
• net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• net: tun: bound receive headroom {CVE-2026-81000}
• bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
• scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
• rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
• mpls: reload header after pskb_may_pull() {CVE-2026-89555}
• vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
• net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
• ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
• ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
• ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
• netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
• netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
• libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
• udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
• ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
• libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• libceph: remove debugfs files before client teardown {CVE-2026-68153}
• libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
• media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
• sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
• ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
• can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

Upstream kernel version 6.6.137 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Vanilla upstream kernel version 6.6.137 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

These are all security issues fixed in the kernel-devel-7.0.3-1.1 package on the GA media of openSUSE Tumbleweed.