CVE-2026-98739

• net: bridge: fix vlan tunnel dst refcnt when egressing {CVE-2021-47222}
• net: bridge: fix vlan tunnel dst null pointer dereference {CVE-2021-47223}
• writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() {CVE-2026-64378}
• writeback, cgroup: increment isw_nr_in_flight before grabbing an inode {CVE-2026-64378}
• writeback, cgroup: add smp_mb() to cgroup_writeback_umount() {CVE-2026-64378}
• fs/writeback.c: use rcu_barrier() to wait for inflight wb switches going into workqueue when umount {CVE-2026-64378}
• libceph: validate banner payload length {CVE-2026-90067}
• drm/virtio: release the GEM object on virtio_gpu_vram_create() errors {CVE-2026-98606}
• procfs: fix missing RCU protection when reading real_parent in do_task_stat() {CVE-2026-46259}
• NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• smb: client: cancel reconnect work in clean_demultiplex_info() {CVE-2026-98175}
• smb: client: reject userspace cifs.idmap descriptions {CVE-2026-97564}
• smb: client: fix UAF and buffer leak in cifs_check_trans2() for malformed secondary T2 {CVE-2026-89637}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() {CVE-2026-89633}
• net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow {CVE-2026-98025}
• RDMA/siw: Fix endpoint/socket association handling {CVE-2026-74345}
• RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs {CVE-2026-74390}
• nfsd: fix clock domain mismatch in clients_still_reclaiming() {CVE-2026-89685}
• vdpa_sim_blk: reject out-of-range sector starts {CVE-2026-97991}
• Drivers: hv: vmbus: use generic driver_override infrastructure {CVE-2026-80676}
• HID: wacom: Fix OOB write in wacom_hid_set_device_mode() {CVE-2026-63916}
• nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone {CVE-2026-89482}
• nvmet-tcp: fix page fragment cache leak in error path {CVE-2026-74386}
• bpf: mark a NULL call argument precise {CVE-2026-98019}
• bpf: Don't predict JMP32 pointer vs zero comparisons {CVE-2026-98041}
• ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get {CVE-2026-72262}
• ASoC: SOF: ipc3-topology: Move and correct size checks in sof_ipc3_control_load_bytes() {CVE-2026-72262}
• Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan {CVE-2026-98108}
• mm/page_reporting: use system_freezable_wq to fix UAF during suspend {CVE-2026-74481}
• netfilter: synproxy: refresh tcphdr after skb_ensure_writable {CVE-2026-64007}
• netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
• reboot: fix cad_pid use-after-free race {CVE-2026-97938}
• fs/resctrl: Fix UAF from worker threads when domains are removed {CVE-2026-93099}
• ext4: fix out-of-bounds read in ext4_read_inline_dir() {CVE-2026-89786}
• ext4: fix dirtyclusters double decrement on fs shutdown {CVE-2026-45920}
• openvswitch: Fix CT limit teardown use-after-free {CVE-2026-89488}
• sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
• netfilter: conntrack: remove sprintf usage {CVE-2026-53002}
• fuse: re-lock request before replacing page cache folio {CVE-2026-53388}
• fanotify: fix false positive on permission events {CVE-2026-46150}
• configfs_lookup(): don't leave ->s_dentry dangling on failure {CVE-2026-74359}
• sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• sctp: fix err_chunk memory leaks in INIT handling {CVE-2026-72413}
• sctp: validate embedded INIT chunk and address list lengths in cookie {CVE-2026-53224}
• sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
• sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing {CVE-2026-53246}
• sctp: diag: reject stale associations in dump_one path {CVE-2026-52917}
• sctp: Hold sock lock while iterating over address list {CVE-2026-52917}
• sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL {CVE-2026-46227}
• nfsd: gate nfs3…

• CVE-2022-49416
  • wifi: mac80211: fix use-after-free in chanctx code {CVE-2022-49416}
• CVE-2022-49685
  • iio: trigger: sysfs: fix use-after-free on remove {CVE-2022-49685}
• CVE-2021-47670
  • can: peak_usb: fix use after free bugs {CVE-2021-47670}
• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98579
  • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure {CVE-2026-98579}
• CVE-2026-98581
  • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() {CVE-2026-98581}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
  • netlink: use blocking notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98829
  • wifi: mac80211: drop oversized fragments to avoid extra_len overflow {CVE-2026-98829}
• CVE-2026-98708
  • wifi: mac80211: keep paired old chanctx alive {CVE-2026-98708}
• CVE-2026-98707
  • wifi: mac80211: shut down RX BA session timer on teardown {CVE-2026-98707}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98461
  • Bluetooth: hci_sock: validate event length before filtering {CVE-2026-98461}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98739
  • Bluetooth: RFCOMM: Fix initial port reference race {CVE-2026-98739}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98856
  • kprobes: Skip disarmed probes when checking optkprobe overlap {CVE-2026-98856}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98681
  • smb: client: split cifsFileInfo bitfields to avoid shared-byte RMW races {CVE-2026-98681}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98696
  • USB: serial: fix driver deregistration order {CVE-2026-98696}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in …

• CVE-2026-46267
  • nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267}
• CVE-2026-53004
  • sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• CVE-2026-98716
  • KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716}
• CVE-2026-98714
  • KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded {CVE-2026-98714}
• CVE-2026-98715
  • KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715}
• CVE-2026-98662
  • iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662}
• CVE-2026-98430
  • RDMA/efa: Keep admin queues alive while IRQ is registered {CVE-2026-98430}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
• CVE-2026-98763
  • usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763}
• CVE-2026-46064
  • ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-53149
  • thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• CVE-2026-46163
  • wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}
• CVE-2026-52962
  • ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962}
• CVE-2026-98386
  • scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386}
• CVE-2026-45916
  • power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2023-54243
  • netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243}
• CVE-2026-53255
  • Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255}
• CVE-2026-98409
  • watchdog: rtd119x: Avoid division by zero {CVE-2026-98409}
• CVE-2026-98598
  • ipv6: Prevent rt6_insert_exception() for dying fib6_info. {CVE-2026-98598}
• CVE-2026-53392
  • NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• CVE-2026-98422
  • wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown {CVE-2026-98422}
• CVE-2026-98393
  • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
• CVE-2026-53129
  • fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129}
• CVE-2023-53794
  • cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794}
• CVE-2026-98494
  • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
• CVE-2026-98428
  • ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428}
• CVE-2026-53157
  • net: phonet: free phonet_device after RCU grace period {CVE-2026-53157}
• CVE-2026-98709
  • wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98811
  • net/sched: cls_api: reclaim an empty proto on the error path {CVE-2026-98811}
• CVE-2026-43042
  • mpls: add seqcount to protect the…

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: Fix initial port reference race

For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path tests the bit separately from the install path setting it, so both can drop that reference.

The synchronous hangup does not prevent this race: port->tty is not assigned until tty_port_open(), after installation. The following interleaving is possible:

1. Install and release each obtain a reference with rfcomm_dev_get().
2. Release observes RFCOMM_TTY_OWNED clear.
3. Install sets RFCOMM_TTY_OWNED and drops the initial reference.
4. Release drops the same initial reference again.
5. TTY cleanup drops its reference and frees the device.
6. Release performs its final tty_port_put() on the freed port.

KASAN reported:

BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190 Write of size 4 at addr ffff8881001d3d5c by task poc/92

Call Trace: tty_port_put+0x22/0x190 rfcomm_dev_ioctl+0x1d4/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0

Allocated by task 88: rfcomm_dev_ioctl+0x8f6/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0

Freed by task 65: kfree+0x131/0x3c0 rfcomm_dev_destruct+0x23b/0x2f0 release_one_tty+0xc1/0x370 process_one_work+0x661/0x1090

Use test_and_set_bit() in both paths so that only the caller that changes RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path keeps its own lookup reference until release or TTY cleanup, preserving the existing callback ordering and error handling.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial tty_port reference. The release path tests the bit separately from the install path setting it, so both can drop that reference. The synchronous hangup does not prevent this race: port->tty is not assigned until tty_port_open(), after installation. The following interleaving is possible: 1. Install and release each obtain a reference with rfcomm_dev_get(). 2. Release observes RFCOMM_TTY_OWNED clear. 3. Install sets RFCOMM_TTY_OWNED and drops the initial reference. 4. Release drops the same initial reference again. 5. TTY cleanup drops its reference and frees the device. 6. Release performs its final tty_port_put() on the freed port. KASAN reported: BUG: KASAN: slab-use-after-free in tty_port_put+0x22/0x190 Write of size 4 at addr ffff8881001d3d5c by task poc/92 Call Trace: tty_port_put+0x22/0x190 rfcomm_dev_ioctl+0x1d4/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Allocated by task 88: rfcomm_dev_ioctl+0x8f6/0x1930 sock_do_ioctl+0x110/0x260 sock_ioctl+0x380/0x590 __x64_sys_ioctl+0x134/0x1c0 Freed by task 65: kfree+0x131/0x3c0 rfcomm_dev_destruct+0x23b/0x2f0 release_one_tty+0xc1/0x370 process_one_work+0x661/0x1090 Use test_and_set_bit() in both paths so that only the caller that changes RFCOMM_TTY_OWNED from clear to set drops the initial reference. Each path keeps its own lookup reference until release or TTY cleanup, preserving the existing callback ordering and error handling.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
• CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
• CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
• CVE-2026-80879: ocfs2: fix circular locking dependency…