CVE-2026-23455

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425931][ C1] tcf_ife_act (net/sched/act_ife.c:847 net/sched/act_ife.c:879)

To solve this issue, fix the replace behavior by adding the metalist to the ife rcu data structure.(CVE-2026-23378)

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN:…

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

icmp: fix NULL pointer dereference in icmp_tag_validation()

icmp_tag_validation() unconditionally dereferences the result of rcu_dereference(inet_protos[proto]) without checking for NULL. The inet_protos[] array is sparse -- only about 15 of 256 protocol numbers have registered handlers. When ip_no_pmtu_disc is set to 3 (hardened PMTU mode) and the kernel receives an ICMP Fragmentation Needed error with a quoted inner IP header containing an unregistered protocol number, the NULL dereference causes a kernel panic in softirq context.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:icmp_unreach (net/ipv4/icmp.c:1085 net/ipv4/icmp.c:1143) Call Trace: <IRQ> icmp_rcv (net/ipv4/icmp.c:1527) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:207) ip_local_deliver_finish (net/ipv4/ip_input.c:242) ip_local_deliver (net/ipv4/ip_input.c:262) ip_rcv (net/ipv4/ip_input.c:573) __netif_receive_skb_one_core (net/core/dev.c:6164) process_backlog (net/core/dev.c:6628) handle_softirqs (kernel/softirq.c:561) </IRQ>

Add a NULL check before accessing icmp_strict_tag_validation. If the protocol has no registered handler, return false since it cannot perform strict tag validation.(CVE-2026-23398)

In the Linux kernel, the following vulnerability has been resolved:

net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check

The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-bounds reads when the NDP32 is placed near the end of the NTB.

Add ndpoffset to the nframes bounds check and use struct_size_t() to express the NDP-plus-DPE-array size more clearly.

Compile-tested only.(CVE-2026-23447)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: Fix double-free in teql_master_xmit

Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following:

[ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ …

The Linux Kernel, the operating system core itself.

Security Fix(es):

IEEE P802.11-REVme D1.1 through D7.0 allows FragAttacks against mesh networks. In mesh networks using Wi-Fi Protected Access (WPA, WPA2, or WPA3) or Wired Equivalent Privacy (WEP), an adversary can exploit this vulnerability to inject arbitrary frames towards devices that support receiving non-SSP A-MSDU frames. NOTE: this issue exists because of an incorrect fix for CVE-2020-24588. P802.11-REVme, as of early 2025, is a planned release of the 802.11 standard.(CVE-2025-27558)

In the Linux kernel, a security vulnerability exists in the IOMMU Shared Virtual Addressing (SVA) feature. On x86 architecture when CONFIG_X86 is set, IOMMU hardware caches kernel page table entries. Due to the lack of notification mechanism for kernel page table changes, when kernel page table pages are freed and reused, the IOMMU may retain stale entries, leading to Use-After-Free (UAF) and Write-After-Free (WAF) conditions. This can be exploited to cause arbitrary physical memory DMA access or privilege escalation.(CVE-2025-71089)

In the Linux kernel, the following vulnerability has been resolved:

uacce: fix cdev handling in the cleanup path

When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove.(CVE-2026-23096)

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ife: Fix metalist update behavior

Whenever an ife action replace changes the metalist, instead of replacing the old data on the metalist, the current ife code is appending the new metadata. Aside from being innapropriate behavior, this may lead to an unbounded addition of metadata to the metalist which might cause an out of bounds error when running the encode op:

[ 138.423369][ C1] ================================================================== [ 138.424317][ C1] BUG: KASAN: slab-out-of-bounds in ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.424906][ C1] Write of size 4 at addr ffff8880077f4ffe by task ife_out_out_bou/255 [ 138.425778][ C1] CPU: 1 UID: 0 PID: 255 Comm: ife_out_out_bou Not tainted 7.0.0-rc1-00169-gfbdfa8da05b6 #624 PREEMPT(full) [ 138.425795][ C1] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 138.425800][ C1] Call Trace: [ 138.425804][ C1] <IRQ> [ 138.425808][ C1] dump_stack_lvl (lib/dump_stack.c:122) [ 138.425828][ C1] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 138.425839][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425844][ C1] ? __virt_addr_valid (./arch/x86/include/asm/preempt.h:95 (discriminator 1) ./include/linux/rcupdate.h:975 (discriminator 1) ./include/linux/mmzone.h:2207 (discriminator 1) arch/x86/mm/physaddr.c:54 (discriminator 1)) [ 138.425853][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425859][ C1] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:597) [ 138.425868][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425878][ C1] kasan_check_range (mm/kasan/generic.c:186 (discriminator 1) mm/kasan/generic.c:200 (discriminator 1)) [ 138.425884][ C1] __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 138.425889][ C1] ife_tlv_meta_encode (net/ife/ife.c:168) [ 138.425893][ C1] ? ife_tlv_meta_encode (net/ife/ife.c:171) [ 138.425898][ C1] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 138.425903][ C1] ife_encode_meta_u16 (net/sched/act_ife.c:57) [ 138.425910][ C1] ? __pfx_do_raw_spin_lock (kernel/locking/spinlock_debug.c:114) [ 138.425916][ C1] ? __asan_memcpy (mm/kasan/shadow.c:105 (discriminator 3)) [ 138.425921][ C1] ? __pfx_ife_encode_meta_u16 (net/sched/act_ife.c:45) [ 138.425927][ C1] ? srso_alias_return_thunk…

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)

• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)

• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)

• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)

• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)

• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)

• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)

• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)

• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)

• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)

• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)

• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)

• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)

• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)

• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)

• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)

• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)

• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)

• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)

• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)

• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)

• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)

• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2026-23455 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-23455 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-23455 in the linux package for Root:Debian:13. Multiple fixed versions available.

Root has patched CVE-2026-23455 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-23455 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation(). If the encoded length is 0, the decrement wraps to -1, which is then passed as a large value to the decoder, leading to an out-of-bounds read. Add a check to ensure len is positive after the decrement.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
• kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
• kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: mm: thp: deny THP for files on anonymous inodes (CVE-2026-23375)
• kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: io_uring/rsrc: reject zero-length fixed buffer import (CVE-2026-43006)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
• kernel: netfilter: ctnetlink: ensure safe access to master conntrack (CVE-2026-43116)
• kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: Linux kernel dpaa2-switch: Kernel memory corruption via out-of-bounds write (CVE-2026-43205)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
• kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

• kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981)
• kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
• kernel: ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CVE-2025-68347)
• kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116)
• kernel: Linux kernel: Denial of service and memory corruption in RDMA umad (CVE-2026-23243)
• kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270)
• kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
• kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
• kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() (CVE-2026-31532)
• kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
• kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
• kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
• kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
• kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
• kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
• kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
• kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
• kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ALSA: usb-audio: Use the right limit for PCM OOB check
• ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
• cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
• rcu: Fix rcu_read_unlock() deadloop due to softirq
• rcu: Fix racy re-initialization of irq_work causing hangs
• RDMA/efa: Fix possible deadlock {CVE-2026-31493}
• RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
• RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
• RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
• RDMA/efa: Extend admin timeout error print
• RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
• rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
• kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
• wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
• md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
• exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
• af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
• xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
• kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
• smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
• sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
• RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
• drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
• firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
• ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
• net: hinic: fix memory leak when reading function table {CVE-2022-50438}
• device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
• libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
• usbnet: fix memory leak in error case {CVE-2022-49657}
• hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
• seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
• net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
• nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
• leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
• bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
• RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
• sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
• tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
• kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
• NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
• i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
• can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
• regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
• wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
• netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
• can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
• bpf: Fix…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
• kyber: fix out of bounds access when preempted {CVE-2021-46984}
• can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
• tls: separate no-async decryption request handling from async {CVE-2024-58240}
• ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• nfsd: fix use-after-free due to delegation race {CVE-2021-47506}
• drm: bridge/panel: Cleanup connector on bridge detach {CVE-2021-47063}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• netfilter: nfnetlink_osf: avoid OOB read {CVE-2023-39189}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
• x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer {CVE-2021-47226}
• kvm: LAPIC: Restore guard to prevent illegal APIC register access {CVE-2021-47255}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
• ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• RDMA/cxgb4: Do not dma memory off of the stack {CVE-2019-17075}
• netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
• KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221) {CVE-2019-7221}
• RDMA/umad: Reject negative data_len in…

• libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
• svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
• drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
• netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
• mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
• scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
• bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
• drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
• ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
• tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
• wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
• drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
• drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
• KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
• skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
• nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
• icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
• RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
• scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
• Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
• team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
• proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
• cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
• bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
• net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
• scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
• ice: Fix memory corruption in VF driver {CVE-2022-49722}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
• tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• netfilter: nf_conntrack_helper: pass helper to…

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
• tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
• mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
• cpuset: fix warning when disabling remote partition {CVE-2025-71142}
• virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
• netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
• atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
• idpf: fix error handling in the init_task on load {CVE-2026-23017}
• rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
• block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
• can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
• virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
• crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
• net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
• gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
• KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
• ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
• xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
• can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
• RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
• RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
• scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
• net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
• drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
• iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
• net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
• can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
• Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
• ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
• drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
• mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
• lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
• scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
• io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
• net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
• net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
• module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
• udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
• net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
• scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
• af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
• netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

• i40e: remove read access to debugfs files {CVE-2025-39901}
• e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
• ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50638}
• usbip: validate number_of_packets in usbip_pack_ret_submit() {CVE-2026-31607}
• md: fix resync softlockup when bitmap size is less than array size {CVE-2023-53357}
• media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf() {CVE-2021-47288}
• md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
• HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
• netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
• scsi: pm8001: Fix use-after-free for aborted TMF sas_task {CVE-2022-48791}
• media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• selinux: Add boundary check in put_entry() {CVE-2022-50200}
• tracing: Only have rmmod clear buffers that its events were active in {CVE-2022-49006}
• ASoC: core: Fix use-after-free in snd_soc_exit() {CVE-2022-49842}
• nvme: fix a possible use-after-free in controller reset during load {CVE-2022-48790}
• scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
• net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
• xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
• ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
• ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
• igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
• dm raid: fix accesses beyond end of raid member array {CVE-2022-49674}
• md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
• usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
• atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
• cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
• drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
• wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
• Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
• usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
• iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
• ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
• ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
• scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
• sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output {CVE-2023-53676}
• mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING {CVE-2022-50430}

• CVE-2026-72463
  • xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
• CVE-2026-64600
  • xfs: resample the data fork mapping after cycling ILOCK {CVE-2026-64600}
• CVE-2026-46175
  • f2fs: fix fsck inconsistency caused by FGGC of node block {CVE-2026-46175}
• CVE-2025-68254
  • staging: rtl8723bs: fix out-of-bounds read in OnBeacon ESR IE parsing {CVE-2025-68254}
• CVE-2025-68255
  • staging: rtl8723bs: fix stack buffer overflow in OnAssocReq IE parsing {CVE-2025-68255}
• CVE-2026-64268
  • RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
• CVE-2025-68286
  • drm/amd/display: Check NULL before accessing {CVE-2025-68286}
• CVE-2026-53024
  • greybus: raw: fix use-after-free if write is called after disconnect {CVE-2026-53024}
• CVE-2026-53025
  • greybus: raw: fix use-after-free on cdev close {CVE-2026-53025}
• CVE-2026-52934
  • batman-adv: tvlv: reject oversized TVLV packets {CVE-2026-52934}
• CVE-2025-68303
  • platform/x86: intel: punit_ipc: fix memory corruption {CVE-2025-68303}
• CVE-2026-64280
  • fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() {CVE-2026-64280}
• CVE-2026-64188
  • net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() {CVE-2026-64188}
• CVE-2026-64109
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2026-64274
  • Input: goodix - clamp the device-reported contact count {CVE-2026-64274}
• CVE-2026-64270
  • Input: mms114 - reject an oversized device packet size {CVE-2026-64270}
• CVE-2026-64093
  • batman-adv: tp_meter: directly shut down timer on cleanup {CVE-2026-64093}
• CVE-2026-64091
  • batman-adv: tt: fix TOCTOU race for reported vlans {CVE-2026-64091}
• CVE-2026-53329
  • drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
• CVE-2026-64298
  • NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
• CVE-2026-64276
  • Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count {CVE-2026-64276}
• CVE-2026-64273
  • Input: iforce - bound the device-reported force-feedback effect index {CVE-2026-64273}
• CVE-2026-64271
  • Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• CVE-2026-64266
  • fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
• CVE-2026-64191
  • i2c: stub: Reject I2C block transfers with invalid length {CVE-2026-64191}
• CVE-2026-64189
  • netfilter: ipset: fix race between dump and ip_set_list resize {CVE-2026-64189}
• CVE-2026-31786
  • Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
• CVE-2025-68799
  • caif: fix integer underflow in cffrml_receive() {CVE-2025-68799}
• CVE-2025-68302
  • net: sxgbe: fix potential NULL dereference in sxgbe_rx() {CVE-2025-68302}
• CVE-2025-40243
  • hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() {CVE-2025-40243}
• CVE-2025-40233
  • ocfs2: clear extent cache after moving/defragmenting extents {CVE-2025-40233}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2026-43249
  • 9p/xen: protect xen_9pfs_front_free against concurrent calls {CVE-2026-43249}
• CVE-2026-31657
  • batman-adv: hold claim backbone gateways by reference {CVE-2026-31657}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-31768
  • iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() {CVE-2026-31768}
• CVE-2026-23216
  • scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216} *…

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

• usb: free iso schedules on failed submit {CVE-2026-64348}
• udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
• USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
• USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
• USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
• USB: iowarrior: fix use-after-free on disconnect {CVE-2026-64342}
• can: bcm: restore op->flags assignment lost in the bcm_tx_lock backport {CVE-2025-38004}
• can: bcm: fix out-of-bounds frame read introduced by the bcm_tx_lock backport {CVE-2025-38004}
• dm-log: fix a bitset_size overflow on 32bit machines {CVE-2026-72105}
• scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
• dm log: fix out-of-bounds write due to region_count overflow {CVE-2026-53059}
• netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 {CVE-2026-64114}
• Input: touchwin - reset the packet index on every complete packet {CVE-2026-64271}
• IB/mad: Drop unmatched RMPP responses before reassembly {CVE-2026-68425}
• wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one() {CVE-2026-68413}
• Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
• sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
• net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
• pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
• Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame {CVE-2026-53254}
• net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
• netfilter: nf_conntrack_sip: don't use simple_strtoul {CVE-2026-52986}
• tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}
• netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
• scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
• Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() {CVE-2026-53256}
• Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() {CVE-2026-31408}
• ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
• RDMA/srp: bound SRP_RSP sense copy by the received length {CVE-2026-53186}
• inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
• ipv6: mcast: Fix use-after-free when processing MLD queries {CVE-2026-53275}
• netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
• RDMA/umad: Reject negative data_len in ib_umad_write() {CVE-2026-23243}
• can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• netfilter: xt_tcpmss: check remaining length before reading option length {CVE-2026-43190}
• netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
• netfilter: nf_conntrack_irc: fix possible out-of-bounds read {CVE-2026-53268}
• scsi: libfc: Fix use after free in fc_exch_abts_resp() {CVE-2022-49114}
• drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
• wifi: libertas: fix use-after-free in lbs_free_adapter() {CVE-2026-23281}
• ALSA: usb-audio: Fix an OOB bug in parse_audio_mixer_unit {CVE-2019-15117}
• vfs: introduce FMODE_UNSIGNED_OFFSET for allowing negative f_pos {CVE-2019-18675}
• infiniband: fix a possible use-after-free bug {CVE-2018-14734}
• phonet: pep: fix use-after-free in pep_get_sb() {CVE-2026-68144}
• Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
• Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
• xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete {CVE-2026-46116}
• netfilter: require Ethernet MAC header before using eth_hdr()…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2026-64375
  • proc: protect ptrace_may_access() with exec_update_lock (FD links) {CVE-2026-64375}
  • exec: Add exec_update_mutex to replace cred_guard_mutex {CVE-2026-64375}
• CVE-2026-53266
  • netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
• CVE-2025-39964
  • crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
• CVE-2026-90413
  • IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
• CVE-2026-53062
  • dm cache policy smq: test e->allocated under the policy lock {CVE-2026-53062}
  • dm cache policy smq: fix missing locks in invalidating cache blocks {CVE-2026-53062}
• CVE-2026-64237
  • Input: elan_i2c - release the firmware on the short-file path {CVE-2026-64237}
  • Input: elan_i2c - validate firmware size before use {CVE-2026-64237}
• CVE-2026-64109
  • af_unix: fix the UAF read of tail->len without losing the wakeup condition {CVE-2026-64109}
  • af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
• CVE-2025-38512
  • wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
• CVE-2025-38117
  • Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
• CVE-2026-22980
  • nfsd: provide locking for v4_end_grace {CVE-2026-22980}
• CVE-2023-53254
  • cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
• CVE-2025-37885
  • KVM: x86: Reset IRTE to host control if new route isn't postable {CVE-2025-37885}
• CVE-2026-23191
  • ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
• CVE-2025-37879
  • 9p/net: fix improper handling of bogus negative read/write replies {CVE-2025-37879}
• CVE-2023-53039
  • HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
• CVE-2019-12456
  • scsi: mpt3sas_ctl: fix double-fetch bug in _ctl_ioctl_main() {CVE-2019-12456}
• CVE-2024-46812
  • drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• CVE-2026-31761
  • iio: gyro: mpu3050: Move iio_device_register() to correct location {CVE-2026-31761}
• CVE-2026-53120
  • PCI: RCU-protect driver_override against pci_match_device() UAF {CVE-2026-53120}
• CVE-2026-31598
  • ocfs2: fix possible deadlock between unlink and dio_end_io_write {CVE-2026-31598}
• CVE-2026-43075
  • ocfs2: fix out-of-bounds write in ocfs2_write_end_inline {CVE-2026-43075}
• CVE-2024-41013
  • xfs: don't walk off the end of a directory data block {CVE-2024-41013}
• CVE-2026-31527
  • driver core: platform: RCU-protect driver_override against match() UAF {CVE-2026-31527}
• CVE-2022-48744
  • net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
• CVE-2023-53510
  • scsi: ufs: core: Fix handling of lrbp->cmd {CVE-2023-53510}
• CVE-2026-23268
  • apparmor: fix unprivileged local user can do privileged policy management {CVE-2026-23268}
• CVE-2026-23269
  • apparmor: validate DFA start states are in bounds in unpack_pdb {CVE-2026-23269}
• CVE-2025-21812
  • ax25: rcu protect dev->ax25_ptr {CVE-2025-21812}
• CVE-2026-46266
  • inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
• CVE-2026-53228
  • ipv6: sit: reload inner IPv6 header after GSO offloads {CVE-2026-53228}
• CVE-2026-53355
  • net: rds: clear i_sends on setup unwind {CVE-2026-53355}
• CVE-2026-45970
  • bonding: alb: fix UAF in rlb_arp_recv during bond up/down {CVE-2026-45970}
• CVE-2023-52922
  • can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
• CVE-2026-52920
  • netfilter: xt_policy: fix strict mode inbound policy matching {CVE-2026-52920} *…

• CVE-2024-36894
  • usb: gadget: f_fs: drop the duplicate usb_ep_free_request() in ffs_user_copy_worker() {CVE-2024-36894}
• CVE-2026-97447
  • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op() {CVE-2026-97447}
• CVE-2026-93822
  • PCI: iproc: Protect root bus removal with rescan lock {CVE-2026-93822}
• CVE-2026-93826
  • HID: hidpp: fix potential UAF in hidpp_connect_event() {CVE-2026-93826}
• CVE-2026-97954
  • net/rds: fix tcp stream corruption with large pages {CVE-2026-97954}
• CVE-2026-97949
  • configfs: unhash the dentry before dropping the item in rmdir {CVE-2026-97949}
• CVE-2026-97931
  • ALSA: us122l: Prevent write upgrades for read mappings {CVE-2026-97931}
• CVE-2026-97940
  • ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
• CVE-2026-97539
  • usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
• CVE-2026-74510
  • Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
• CVE-2026-72084
  • scsi: target: Bound PR-OUT TransportID parsing to the received buffer {CVE-2026-72084}
• CVE-2026-90302
  • ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
• CVE-2026-90320
  • ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
• CVE-2026-90321
  • ocfs2: validate inline xattrs during inode block validation {CVE-2026-90321}
• CVE-2026-90431
  • remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
• CVE-2026-74637
  • perf/core: Fix group leader use-after-free after sibling detach {CVE-2026-74637}
• CVE-2026-74752
  • sctp: validate cookie AUTH state before use {CVE-2026-74752}
• CVE-2026-74387
  • ALSA: seq: midi: Serialize output teardown with event_input {CVE-2026-74387}
• CVE-2026-80536
  • xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
• CVE-2026-89659
  • NFSD: Prevent client use-after-free during delegation revoke {CVE-2026-89659}
• CVE-2026-80576
  • drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
• CVE-2026-90223
  • nfc: llcp: bound SNL TLV parsing to the skb and add length checks {CVE-2026-90223}
• CVE-2026-80994
  • net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
• CVE-2026-72398
  • sctp: add INIT verification after cookie unpacking {CVE-2026-72398}
• CVE-2026-74583
  • net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
• CVE-2026-72322
  • ipv6: mcast: Fix potential UAF in MLD delayed work {CVE-2026-72322}
• CVE-2026-93095
  • hfsplus: validate thread record before delete key rebuild {CVE-2026-93095}
• CVE-2026-72472
  • nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
• CVE-2026-90045
  • USB: gadget: ffs: fix mm lifetime handling {CVE-2026-90045}
• CVE-2026-90421
  • PCI: Fix UAF when probe runs concurrent to dyn ID removal {CVE-2026-90421}
• CVE-2026-64583
  • usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown {CVE-2026-64583}
• CVE-2026-68329
  • iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() {CVE-2026-68329}
• CVE-2026-89448
  • iommu/vt-d: Force requesting ACS when tboot is enabled {CVE-2026-89448}
• CVE-2026-64001
  • ALSA: pcm: oss: Fix setup list UAF on proc write error {CVE-2026-64001}
• CVE-2026-64305
  • crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
• CVE-2026-64348
  • usb: free iso schedules on failed submit {CVE-2026-64348}
• CVE-2026-64422
  • net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
• CVE-2026-90180
  • block:…

In the Linux kernel, the following vulnerability has been resolved: ksmbd: ipc: fix use-after-free in ipc_msg_send_request ipc_msg_send_request() waits for a generic netlink reply using an ipc_msg_table_entry on the stack.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of share_conf in compound request smb2_get_ksmbd_tcon() reuses work->tcon in compound requests without validating tcon->t_state.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protocol discriminator byte before passing it to DecodeH323_UserInformation().

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf.

In the Linux kernel, the following vulnerability has been resolved: media: dvb-net: fix OOB access in ULE extension header tables The ule_mandatory_ext_handlers.

It was discovered that the Linux kernel algif_aead module did not properly handle in-place cryptographic operations. This flaw is known as Copy Fail. A local attacker could use this to escalate privileges, or possibly escape a container.)(CVE-2026-31431)

In the Linux kernel, the following vulnerability has been resolved: ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len() After this commit (e2b76ab8b5c9 'ksmbd: add support for read compound'), response buffer management was changed to use dynamic iov array.

In the Linux kernel, the following vulnerability has been resolved: usbip: validate number_of_packets in usbip_pack_ret_submit() When a USB/IP client receives a RET_SUBMIT response, usbip_pack_ret_submit() unconditionally overwrites urb->number_of_packets from the network PDU. This value is subsequently used as the loop bound in usbip_recv_iso() and usbip_pad_iso() to iterate over urb->iso_frame_desc.

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkad_decrypt_ticket() decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether crypto_skcipher_decrypt() succeeded.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer.

In the Linux kernel, the following vulnerability has been resolved: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the allocation length for a global TT response in 16-bit temporaries.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment smb2_get_ea() applies 4-byte alignment padding via memset() after writing each EA entry.

In the Linux kernel, the following vulnerability has been resolved: net/x25: Fix potential double free of skb When alloc_skb fails in x25_queue_rx_frame it calls kfree_skb(skb) at line 48 and returns 1 (error).

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ipv6: icmp: clear skb2->cb.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix signededness bug in smb_direct_prepare_negotiation() smb_direct_prepare_negotiation() casts an unsigned __u32 value from sp->max_recv_size and req->preferred_send_size to a signed int before computing min_t(int, ...).

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() On the receive path, __ioam6_fill_trace_data() uses trace->nodelen to decide…

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: .

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).

In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev().

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly.

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).

In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence .

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return.

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted…

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues

The following security issues were fixed:

• CVE-2023-2058: x86/CPU: Fix FPDSS on Zen1 (bsc#1243603).
• CVE-2024-14027: xattr: switch to CLASS(fd) (bsc#1259420).
• CVE-2025-40181: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP (bsc#1253471).
• CVE-2025-68265: nvme: fix admin request_queue lifetime (bsc#1255360).
• CVE-2025-68310: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (bsc#1255160).
• CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules (bsc#1264837).
• CVE-2026-23168: flex_proportions: make fprop_new_period() hardirq safe (bsc#1258826).
• CVE-2026-23245: net/sched: act_gate: snapshot parameters with RCU on replace (bsc#1259799).
• CVE-2026-23271: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race (bsc#1260018).
• CVE-2026-23276: net: add xmit recursion limit to tunnel xmit functions (bsc#1260012).
• CVE-2026-23300: net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop (bsc#1260538).
• CVE-2026-23313: i40e: Fix preempt count leak in napi poll tracepoint (bsc#1260555).
• CVE-2026-23316: net: ipv4: fix ARM64 alignment fault in multipath hash seed (bsc#1260573).
• CVE-2026-23321: mptcp: pm: in-kernel: always mark signal+subflow endp as used (bsc#1260505).
• CVE-2026-23340: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs (bsc#1260523).
• CVE-2026-23346: arm64: io: Rename ioremap_prot() to __ioremap_prot() (bsc#1260529).
• CVE-2026-23351: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (bsc#1260526).
• CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint() (bsc#1260801).
• CVE-2026-23368: net: phy: register phy led_triggers during probe to avoid AB-BA deadlock (bsc#1260530).
• CVE-2026-23374: blktrace: fix __this_cpu_read/write in preemptible context (bsc#1260811).
• CVE-2026-23375: mm: thp: deny THP for files on anonymous inodes (bsc#1260576).
• CVE-2026-23378: net/sched: act_ife: Fix metalist update behavior (bsc#1260546).
• CVE-2026-23391: netfilter: xt_CT: drop pending enqueued packets on template removal (bsc#1260566).
• CVE-2026-23392: netfilter: nf_tables: release flowtable after rcu grace period on error (bsc#1260531).
• CVE-2026-23397: nfnetlink_osf: validate individual option lengths in fingerprints (bsc#1260728).
• CVE-2026-23399: nf_tables: nft_dynset: fix possible stateful expression memleak in error path (bsc#1261020).
• CVE-2026-23417: bpf: Fix constant blinding for PROBE_MEM32 stores (bsc#1261410).
• CVE-2026-23436: net: add helpers for lookup and walking netdevs under netdev_lock() (bsc#1261617).
• CVE-2026-23437: net: shaper: protect late read accesses to the hierarchy (bsc#1261635).
• CVE-2026-23440: net/mlx5e: Fix race condition during IPSec ESN update (bsc#1261641).
• CVE-2026-23441: net/mlx5e: Prevent concurrent access to IPSec ASO context (bsc#1261768).
• CVE-2026-23442: ipv6: add NULL checks for idev in SRv6 paths (bsc#1261581).
• CVE-2026-23445: igc: fix page fault in XDP TX timestamps handling (bsc#1261702).
• CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit (bsc#1261779).
• CVE-2026-23450: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() (bsc#1261584).
• CVE-2026-23455: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (bsc#1261687).
• CVE-2026-23456: netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (bsc#1261703).
• CVE-2026-23457: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (bsc#1261686).
• CVE-2026-23458: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (bsc#1261781).
• CVE-2026-23468: drm/amdgpu: Limit BO list entry count to prevent resource exhaustion (bsc#1261692).
• CVE-2026-23472: serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN (bsc#1261636).
• CVE-2026-23473: io_uring/poll: fix multishot recv missing EOF on…