Accepted linux 6.1.190-1 (source) into oldstable-security

Kurzinfo

Metadaten

  • Original (extern): Link oeffnen
  • Veroeffentlicht: 2026-10-17 10:31 UTC
  • Importiert: 2026-10-21 10:18 UTC
  • CVSS: 9.8
  • Quelle-ID: debian_pts_linux
  • uid_hash: c32e45a7f7a68cfd4624447444fe24a204801d684e6273ae768952c1f8db0f32
Debian PTS — linux (Quellpaket)

Inhalt

From:

        Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To:

         <debian-lts-changes@lists.debian.org>

        ,
         <dispatch@tracker.debian.org>

Subject:

    Accepted linux 6.1.190-1 (source) into oldstable-security

Date:

    Sat, 17 Oct 2026 10:10:12 +0000

Signed by: Salvatore Bonaccorso carnil@debian.org

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Format: 1.8 Date: Fri, 16 Oct 2026 23:46:12 +0200 Source: linux Architecture: source Version: 6.1.190-1 Distribution: bookworm-security Urgency: high Maintainer: Debian Kernel Team debian-kernel@lists.debian.org Changed-By: Salvatore Bonaccorso carnil@debian.org Closes: 1108860 Changes: linux (6.1.190-1) bookworm-security; urgency=high .

  • New upstream stable update: https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.188
    • ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191)
    • ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
    • clocksource/drivers/timer-sun4i: Advertise a real minimum delta
    • [powerpc*] pseries/iommu: switch to Default DMA window during kdump
    • timers/itimer: Zero-init old itimerval before copy to userspace (CVE-2026-89765)
    • include/linux/list.h: mark list_add and __list_add as __always_inline
    • mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)
    • mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)
    • mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)
    • tools/compiler: match glibc 2.42 definition of attribute_const
    • [x86] tdx: Fix off-by-one in port I/O handling (CVE-2026-89751)
    • [x86] insn-eval: Move assign_register() out of KVM as insn_assign_reg()
    • hwtracing: hisi_ptt: Propagate DMA reset timeout in trace_start()
    • tracing: Fix crash passing ERR_PTR to kthread_stop() (CVE-2026-89749)
    • tracing: Fix use-after-free with same-name named triggers (CVE-2026-89746)
    • device property: fix infinite loop in fwnode_for_each_child_node() (CVE-2026-89744)
    • [powerpc*] powermac: fix OF node refcount
    • rapidio: mport_cdev: fix use-after-free in dma_req_free() (CVE-2026-89742)
    • Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
    • staging: greybus: hid: fix SET_REPORT return value
    • usb: dwc2: gadget: Exit partial power down state when changing USB pull-up
    • USB: phy: fsl-usb: fix missing static keywords
    • usb: gadget: u_audio: Fix use-after-free on sound card disconnect (CVE-2026-89736)
    • usb: gadget: snps_udc_plat: clean up PHY on probe deferral
    • usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()
    • usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (CVE-2026-89733)
    • usb: gadget: f_fs: Prevent deadlock during ep0 read loop (CVE-2026-89732)
    • fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (CVE-2026-89730)
    • HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (CVE-2026-89729)
    • lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)
    • media: cec: stm32: prevent out-of-bounds write on RX overflow (CVE-2026-89725)
    • media: vicodec: fix out-of-bounds write in FWHT encoder (CVE-2026-89724)
    • nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (CVE-2026-89723)
    • of: fix out-of-bounds read in of_alias_scan() stem parser
    • ubifs: fix out-of-bounds read in signature length check (CVE-2026-89720)
    • NFSD: Encode only the status in NFS-ACL v2 GETACL error replies
    • NFSD: Fix off-by-one in DRC bucket pruning limit
    • NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)
    • NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check (CVE-2026-89711)
    • NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710)
    • nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
    • nfsd: return NFS4ERR_NOTSUPP for unsupported netloc4 types
    • nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704)
    • nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
    • nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697)
    • nfsd: add filehandle match check to nfsd4_delegreturn()
    • nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
    • nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694)
    • nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684)
    • nfsd: fix version mismatch loops in nfsd_acl_init_request()
    • nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget (CVE-2026-89674)
    • nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo
    • nfsd: initialize copy-notify stateid before publishing it (CVE-2026-89669)
    • nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE (CVE-2026-89665)
    • nfsd: reject reclaim LOCK after RECLAIM_COMPLETE
    • nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)
    • NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
    • libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)
    • ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)
    • ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)
    • ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
    • ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
    • audit: avoid dropping live tree ref on fsnotify rule autoremove (CVE-2026-89643)
    • cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)
    • smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)
    • smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
    • smb: client: harden DFS cache against invalid target hints
    • HID: picolcd: clamp eeprom debugfs read to bytes actually received (CVE-2026-89628)
    • HID: roccat: free buffered reports when destroying device (CVE-2026-89627)
    • HID: sensor: custom: Fix field sysfs group cleanup on failure (CVE-2026-89626)
    • HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)
    • eCryptfs: bound the packet-length peek to the user buffer
    • ecryptfs: fix tag 11 packet exact-fit size check
    • ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVE-2026-89609)
    • ecryptfs: pass packet set buffer size to parser (CVE-2026-89608)
    • ecryptfs: reject oversized encrypted_key_size in parse_tag_3_packet (CVE-2026-89607)
    • ecryptfs: reject too-small tag 70 packets (CVE-2026-89606)
    • ecryptfs: release message context on send failure (CVE-2026-89605)
    • ecryptfs: show filename encryption options
    • efivarfs: Rate limit statfs() handler (CVE-2026-89604)
    • fat: restore original value when fat_ent_write failed
    • fbdev: omapfb: panel-dsi-cm: initialize lock before registering display (CVE-2026-89599)
    • fbdev: pvr2fb: correct user pointer annotation and sentinel initializer
    • fbdev: uvesafb: unregister connector callback on init failure (CVE-2026-89597)
    • forcedeth: fix off-by-one when saving/restoring non-PCI config space (CVE-2026-89596)
    • fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
    • hsi: omap_ssi_core: fix missing DMA mask setup for SSI controller device (CVE-2026-89594)
    • ACPI: pfr_update: fix stack buffer overflow in query_capability() (CVE-2026-89587)
    • ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes (CVE-2026-89586)
    • auxdisplay: charlcd: cancel backlight work on registration failure (CVE-2026-89585)
    • Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU
    • Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU
    • Bluetooth: eir: Fix OOB read in eir_get_service_data() (CVE-2026-89583)
    • bnx2x: fix double free in bnx2x_init_firmware() error path (CVE-2026-89582)
    • bpf: Harden bloom filter sizing and indexing on 32-bit kernels (CVE-2026-89579)
    • dm-era: fix shadowed superblock leak on take-snap failure (CVE-2026-89576)
    • dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
    • dm array: reject an array block whose value size is not the caller's (CVE-2026-89573)
    • cpufreq: schedutil: Fix rate limit overflow
    • Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative
    • Bluetooth: hci_uart: Fix false success return in hci_uart_setup()
    • Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready (CVE-2026-80914)
    • Bluetooth: RFCOMM: serialize security confirmation handling (CVE-2026-89569)
    • Bluetooth: hci_conn: re-enable advertising only for peripheral role
    • Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection
    • Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative
    • Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative
    • ipip: fix skb leak in collect_md mode when metadata_dst allocation fails (CVE-2026-89565)
    • ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() (CVE-2026-89563)
    • ip6_gre: fix hardware header length for NBMA tunnels (CVE-2026-89562)
    • ipv6: use RCU iterator to dump route exceptions
    • libnvdimm/labels: Prevent integer overflow in __nd_label_validate() (CVE-2026-89559)
    • mailbox: qcom-ipcc: fix duplicate channel allocation across holes
    • md: do overflow check for sb->bblog_shift in super_1_load() (CVE-2026-89557)
    • mpls: reload header after pskb_may_pull() (CVE-2026-89555)
    • mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction (CVE-2026-89554)
    • SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow (CVE-2026-89551)
    • sunrpc: route to a populated pool in svc_pool_for_cpu() (CVE-2026-89549)
    • SUNRPC: always drain cache_cleaner before destroying a cache_detail (CVE-2026-89548)
    • SUNRPC: Guard svcauth_gss_release() dispatch on rq_auth_stat
    • SUNRPC: harden gss_krb5_unwrap_v2 against short tokens (CVE-2026-89542)
    • SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
    • sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540)
    • SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field (CVE-2026-89538)
    • svcrdma: Fix offset arithmetic in read_chunk_range (CVE-2026-89533)
    • svcrdma: Fix pcl_for_each_segment for empty chunks (CVE-2026-89532)
    • udf: reject VAT indexes equal to the entry count (CVE-2026-89525)
    • wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets (CVE-2026-89524)
    • staging: media: tegra-video: vi: fix probe failure on skipped last port
    • rpmsg: glink: smem: order FIFO read after availability check
    • [arm64] dts: rockchip: Fix rk3399-roc-pc-plus analog audio
    • remoteproc: scp: Fix device reference leak on failed lookup (CVE-2026-89512)
    • qede: Fix NULL pointer dereference in TPA fragment processing (CVE-2026-89511)
    • RDMA/cxgb4: Cancel reg_work before freeing device on remove (CVE-2026-89510)
    • RDMA/ucma: Lock the handler in ucma_set_ib_path() (CVE-2026-89508)
    • regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer (CVE-2026-89504)
    • regulator: max8998_pmic_dt_parse_pdata: of_node_put on reg_np after ownership transferred to rdata
    • orangefs: fix double-free of trailer_buf on readdir copy failure (CVE-2026-89498)
    • orangefs: skip leading spaces before parsing client debug masks (CVE-2026-89497)
    • ocfs2: always run deallocs on copy-on-write completion (CVE-2026-89496)
    • ocfs2: bound namelen in dlm_migrate_request_handler (CVE-2026-89495)
    • ocfs2: validate lengths in dlm_mig_lockres_handler (CVE-2026-89494)
    • ocfs2: validate rl_used against rl_count in refcount block validator (CVE-2026-89493)
    • ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (CVE-2026-89491)
    • ocfs2: cluster: avoid lock order inversion in o2hb_region_pin() from drop_item
    • ocfs2: cluster: fix o2hb_dependent_users leak on pin failure
    • ocfs2: fix readdir position truncation on 32-bit kernels (CVE-2026-89490)
    • openvswitch: only skb_tx_error() a packet we are about to drop (CVE-2026-89487)
    • [arm64] compat: Fix decrementing LDM/STM alignment emulation
    • [amd64] ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
    • hwmon: (max6621) fix negative temperature offset and crit readings
    • hwmon: (max6621) fix temperature clamp range
    • lockd: pin next file across nlm_inspect_file lock-drop (CVE-2026-89485)
    • nvme: nvme-fc: Fix nvme_fc_create_hw_io_queues() queue deletion in error path
    • nvme: zero the discard fallback page (CVE-2026-89483)
    • nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)
    • nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
    • nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
    • sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
    • sctp: drop a chunk if its transport was removed (CVE-2026-89478)
    • sctp: fix NULL deref on untransmitted RECONF completion (CVE-2026-89477)
    • sctp: distinguish sequence zero from wildcard in reconf lookup
    • sctp: fix stream->outcnt underflow on duplicate RECONF responses (CVE-2026-89476)
    • power: supply: bq24257: fix use-after-free on remove (CVE-2026-89475)
    • power: supply: bq256xx: drain usb_work before freeing the charger (CVE-2026-89474)
    • power: supply: cros_usbpd-charger: bound the EC-reported port count (CVE-2026-89471)
    • power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS (CVE-2026-89470)
    • power: supply: lp8727: fix use-after-free in lp8727_release_irq() (CVE-2026-89469)
    • power: supply: twl4030_charger: cancel workers via devm (CVE-2026-89464)
    • power: supply: ucs1002: fix use-after-free on remove (CVE-2026-89463)
    • power: supply: max17040: synchronize work cancellation on suspend (CVE-2026-89461)
    • PCI: Fix 32-bit config write in Intel PCH Root Port MPC ACS quirk
    • PCI: meson: Fix GPIO state while requesting PERST#
    • PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]
    • PCI/sysfs: Avoid spurious runtime PM wakeup on config space accesses
    • PCI/MSI: Enable memory decoding before restoring MSI-X messages
    • PCI/proc: Avoid spurious runtime PM wakeup on config space accesses
    • PCI/proc: Use file_ns_capable() when checking config space read access
    • PCI/proc: Warn on writes to kernel-exclusive config space regions
    • [amd64] iommu/vt-d: Fix no_iommu to disable platform opt-in
    • [x86] platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer (CVE-2026-89444)
    • mmc: via-sdmmc: stop card-detect handling on probe failure (CVE-2026-89440)
    • [x86] platform/x86: ishtp_eclite: Fix ACPI device reference leak in probe error path
    • platform/chrome: sensorhub: Bound the EC-reported sensor number (CVE-2026-81017)
    • interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (CVE-2026-81008)
    • ipmi: ipmb: validate write message length (CVE-2026-81007)
    • ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)
    • net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
    • xdp: fix zero-copy frame layout (CVE-2026-81002)
    • slip: fix use-after-free in sl_sync() (CVE-2026-81001)
    • net: usb: qmi_wwan: add Telit Cinterion FE990D50 composition
    • net: tun: bound receive headroom (CVE-2026-81000)
    • net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)
    • net: openvswitch: fix nf_connlabels leak in ovs_ct_init
    • net: ravb: avoid dereferencing an invalid PTP clock (CVE-2026-80992)
    • NTB: ntb_transport: Recycle TX entries before client callbacks
    • NTB: ntb_transport: Fail TX enqueue when the QP link is down (CVE-2026-80988)
    • NTB: ntb_transport: Reject oversized TX buffers (CVE-2026-80987)
    • net: ntb_netdev: Avoid double-accounting netif_rx() drops
    • net: ntb_netdev: Count packets dropped on RX refill failure
    • net/smc: fix socket refcount leak in smc_switch_conns() (CVE-2026-80983)
    • net/smc: fix use-after-free in smc_rx_pipe_buf_release() (CVE-2026-80982)
    • net: cap advertised IP tunnel headroom (CVE-2026-80978)
    • net: fix spurious TX timeout after dev_activate()
    • net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)
    • seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)
    • ALSA: 6fire: bound the MIDI event length from the device (CVE-2026-80973)
    • ALSA: aloop: Check card index validity at probe (CVE-2026-80972)
    • ALSA: bcd2000: clear the URB pointers on disconnect (CVE-2026-80971)
    • ALSA: mpu401: Check card index validity at probe (CVE-2026-80969)
    • ALSA: mts64: Check card index validity at probe (CVE-2026-80968)
    • ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (CVE-2026-80967)
    • ALSA: portman2x4: Check card index validity at probe (CVE-2026-80966)
    • ALSA: serial-u16550: Check card index validity at probe (CVE-2026-80965)
    • ALSA: virmidi: Check card index validity at probe (CVE-2026-80964)
    • cgroup/cpuset: Fix misplaced DL migration reset
    • PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
    • [x86] tdx: Fix zero-extension for 32-bit port I/O
    • arch_numa: avoid false positive fortify warning in setup_node_to_cpumask_map()
    • dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)
    • dm-switch: use WRITE_ONCE() in switch_region_table_write()
    • i3c: master: Fix info leak and UAF in device unregister path (CVE-2026-80952)
    • i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951)
    • wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (CVE-2026-80949)
    • wifi: mwifiex: Detach sync cmd buffer on interrupted wait (CVE-2026-80944)
    • wifi: rtl818x: initialize eeprom_93cx6 struct to zero
    • wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (CVE-2026-80941)
    • wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (CVE-2026-80938)
    • vsock/virtio: flush works in dependency order (CVE-2026-80932)
    • w1: ds28e17: reject an oversize length on an I2C block read (CVE-2026-80931)
    • xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()
    • tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (CVE-2026-80930)
    • signal: avoid shared siginfo namespace rewrites
    • smack: fix cred UAF in smack_file_send_sigiotask() (CVE-2026-80928)
    • taskstats: fix cpumask parsing cutting off the last character
    • timer: Keep debugobjects state consistent in migrate_timer_list()
    • udf: Fix i_lenExtents truncation on 32-bit kernels
    • platform/chrome: sensorhub: Fix dropped timestamp events and log spam
    • net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() (CVE-2026-90049)
    • net: openvswitch: fix kernel-doc warnings in internal headers
    • openvswitch: Fix CT limit teardown use-after-free (CVE-2026-89488)
    • landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation (CVE-2026-89560)
    • netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565)
    • fsnotify: Fix stale object mask after concurrent mark updates (CVE-2026-89595)
    • tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
    • entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603)
    • selinux: avoid implicit conversions in services code
    • selinux: reject an unclaimed class value in security_get_classes() (CVE-2026-80912)
    • ALSA: seq: Fix port lock leak in deliver_to_subscribers()
    • net: ntb_netdev: Fix TX busy and drop handling
    • vxlan: use pskb_network_may_pull() for transmit path header pulls (CVE-2026-74474)
    • tracing/mmiotrace: Remove reference to unused per CPU data pointer
    • tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions (CVE-2026-80689)
    • mm/huge_memory: use folio's memcg inside __folio_split()
    • scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables() (CVE-2026-89515)
    • usb: image: mdc800: change kmalloc() to kzalloc() (CVE-2026-90034)
    • ALSA: usb-audio: fix OOB write in snd_usbmidi_us122l_output() (CVE-2026-90033)
    • clk: qcom: gcc-mdm9607: Increase delay for USB PHY reset
    • media: usbtv: keep device alive while ALSA card exists (CVE-2026-90032)
    • usb-storage: ene_ub6250: fix race between scan work and probe (CVE-2026-90031)
    • usb: f_mass_storage: Bump local buffer size in fsg_common_create_luns()
    • usb: typec: ucsi: displayport: Fix OOB altmode array index (CVE-2026-90025)
    • USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() (CVE-2026-90020)
    • usb: gadget: fix null pointer dereference in usb_put_function_instance() (CVE-2026-90019)
    • staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() (CVE-2026-90018)
    • staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() (CVE-2026-90017)
    • thermal/drivers/imx: Disable clock on runtime resume failure
    • thermal/drivers/qoriq: Disable clock on resume failure
    • scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
    • scsi: pm8001: Use rollback index when freeing MSI-X vectors (CVE-2026-90007)
    • mm/damon/sysfs: kobject_del() region and target (error) dirs
    • mm/damon/sysfs: kobject_del() target (normal), context and kdamond dirs
    • futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)
    • HID: rmi: fix OOB access with undersized RMI reports (CVE-2026-90000)
    • HID: wacom: validate report length in wacom_intuos_pro2_bt_irq (CVE-2026-89999)
    • dm: fix race when loading and unloading a table (CVE-2026-89998)
    • dm: fix resume-vs-remove race (CVE-2026-89997)
    • dmaengine: dw-edma: Complete descriptors before pausing
    • dmaengine: dw-edma: Initialize IRQ data before requesting IRQs (CVE-2026-89993)
    • cpuidle: dt_idle_genpd: kfree() the original name allocation (CVE-2026-89992)
    • block: flag zoned disks with GENHD_FL_NO_PART
    • ata: ahci: work around lost interrupts on Marvell 88SE61xx
    • ima: Check for ERR_PTR from dentry_path() in validate_hash_algo() (CVE-2026-89989)
    • kprobes: Protect kprobe_blacklist with RCU (CVE-2026-89988)
    • Input: aiptek - validate raw macro indices before updating state
    • rtc: rzn1: Fix weekday underflow when alarm crosses month boundary
    • rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
    • perf/x86/intel: Fix kernel address leakages in LBR stack (CVE-2026-89984)
    • i2c: core: fix debugfs UAF on adapter removal (CVE-2026-89983)
    • i2c: mux: Fix channel node leak on adapter add failure (CVE-2026-89982)
    • ALSA: harmony: initialize locks before requesting IRQ (CVE-2026-89980)
    • ALSA: pcm: Fix race between non-atomic ops and trigger-start (CVE-2026-89979)
    • nvme-tcp: check the data direction of a C2HData PDU (CVE-2026-89973)
    • nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU (CVE-2026-89969)
    • nvmet-tcp: reject unsolicited H2CData PDUs (CVE-2026-89968)
    • Revert "irqchip/mbigen: Fix mbigen node address layout"
    • mm/hugetlb: fix missing migratable flag on same-node hugetlb migration
    • nvdimm/btt: reject an arena whose nfree is below the lane count (CVE-2026-89965)
    • [powerpc*] pseries: Handle and log pseries-wdt registration failures
    • [powerpc*] pseries: Move H_WATCHDOG definitions to a common header
    • [powerpc*] crash: stop watchdogs before booting kdump kernel
    • mtd: afs: validate v2 image info bounds (CVE-2026-89954)
    • mtd: mtdoops: free page bitmap when the backing MTD is removed (CVE-2026-89953)
    • mtd: rawnand: validate ONFI extended parameter page sections (CVE-2026-89952)
    • batman-adv: fix stale receive device on merged fragments (CVE-2026-89951)
    • batman-adv: dat: avoid unaligned fault in IP extraction (CVE-2026-89949)
    • batman-adv: bla: fix freeing of claims on meshif deletion (CVE-2026-89948)
    • batman-adv: bla: prevent CRC corruptions after claim flush
    • clk: qcom: gcc-msm8916: Fix enable_reg for gcc_blsp1_sleep_clk
    • clk: qcom: gcc-msm8939: Fix enable_reg for gcc_blsp1_sleep_clk
    • clk: qcom: gcc-mdm9607: Drop incorrect apss_tcu_clk_src
    • clk: qcom: gcc-mdm9607: Drop incorrect system_noc_bfdcd_clk_src
    • clk: qcom: gcc-mdm9607: Fix enable_reg for gcc_blsp1_sleep_clk
    • clk: qcom: gcc-mdm9607: Fix halt_reg for gcc_apss_axi_clk
    • clk: qcom: gcc-mdm9607: Drop incorrect BIMC PLL and related clocks
    • i2c: mux: demux-pinctrl: fix OF node leak on kstrdup failure
    • ASoC: cs35l33: drain threaded IRQ before runtime suspend (CVE-2026-89946)
    • ASoC: cs35l34: drain threaded IRQ before runtime suspend (CVE-2026-89945)
    • ASoC: fsl: mpc5200-i2s: Free DMA resources on probe failure
    • AsoC: intel: sst: fix PCI device reference leak on probe failure
    • ASoC: samsung: aries_audio_probe: double of_node_put due to direct assignment without of_node_get
    • iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable (CVE-2026-89939)
    • iio: chemical: sgp30: Handle IAQ thread creation failure (CVE-2026-89937)
    • iio: dac: m62332: Fix regulator reference count imbalance (CVE-2026-89936)
    • iio: gyro: mpu3050: fix sign of raw angular velocity readings
    • iio: light: cm32181: return zero after writing calibscale
    • iio: light: gp2ap002: Disable regulators on resume failure
    • iio: srf04: fix pm_runtime handling on probe error path
    • iio: temperature: hid-sensor-temperature: switch to non-devm iio_device_register()
    • [x86] KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932)
    • [x86] KVM: nVMX: Service local TLB flushes on failed nested VM-Enter (CVE-2026-89930)
    • [x86] KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock (CVE-2026-89927)
    • media: airspy: use vb2_video_unregister_device() on disconnect to fix NULL deref (CVE-2026-89901)
    • media: cec: meson: ao-cec-g12a: name the CEC core regmap to avoid debugfs clash
    • media: cec: Serialize exclusive follower delivery (CVE-2026-89897)
    • media: cedrus: fix memory leak in cedrus_init_ctrls() (CVE-2026-89896)
    • media: cobalt: Avoid freeing ALSA private data twice (CVE-2026-89895)
    • media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
    • media: cx23885: cancel NetUP CI work before teardown (CVE-2026-89893)
    • media: em28xx: defer audio-only extension registration (CVE-2026-89892)
    • media: em28xx: fix use-after-free of dev_next->devlist on disconnect (CVE-2026-89891)
    • media: go7007: defer the ALSA v4l2 put until card release (CVE-2026-89890)
    • media: i2c: ov02a10: fix endpoint parsing use-after-free (CVE-2026-89888)
    • media: i2c: ov7740: fix use-after-destroy in remove (CVE-2026-89887)
    • media: meson: vdec: fix NULL pointer deref in vdec_try_fmt_common
    • media: rc: sunxi-cir: Unregister rc device on probe failure (CVE-2026-89883)
    • media: rtl2832_sdr: use vb2_video_unregister_device() on remove to fix DMA leak (CVE-2026-89881)
    • media: rtl2832_sdr: release URBs and stream buffers on start_streaming() failure (CVE-2026-89880)
    • media: s2255: bound JPEG frame size before copying into the buffer (CVE-2026-89879)
    • media: s2255: check firmware size before reading trailing marker (CVE-2026-89878)
    • media: saa7164: fix cleanup on resource allocation failure (CVE-2026-89877)
    • media: tda18250: fix possible integer overflow (CVE-2026-89876)
    • media: v4l2-ctrls: Allow unknown HDR10 white point and luminance
    • media: v4l2-fwnode: Fix fwnode leak in v4l2_fwnode_parse_link (CVE-2026-89872)
    • media: venus: fix payload size returned by parse_caps() and parse_alloc_mode()
    • media: venus: fix payload size calculation in parse_raw_formats()
    • media: video-i2c: fix kthread error pointer left in kthread_vid_cap on failure (CVE-2026-89871)
    • media: vimc: fix pixel format lookup in enum_framesizes
    • media: zoran: Avoid freeing a registered video_device twice (CVE-2026-89870)
    • scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers (CVE-2026-89865)
    • scsi: qla2xxx: Bound i2c->length in I2C bsg handlers (CVE-2026-89864)
    • scsi: qla2xxx: edif: Fix NULL pointer deref in RX SA delete check (CVE-2026-89863)
    • scsi: qla2xxx: Fix Name Server logout detection on FWI2 adapters
    • scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() (CVE-2026-89861)
    • scsi: qla2xxx: Check entry_status in qla24xx_modify_vp_config()
    • scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() (CVE-2026-89858)
    • scsi: qla2xxx: Clamp MSI-X derived queue counts to avoid truncation (CVE-2026-89856)
    • scsi: qla2xxx: Serialize flash version read in reset handler (CVE-2026-89855)
    • scsi: qla2xxx: Fix cs84xx use-after-free on host teardown (CVE-2026-89854)
    • scsi: qla2xxx: Fix FCE trace use-after-free during firmware dump (CVE-2026-89853)
    • scsi: qla2xxx: Zero mailbox struct in qla2x00_get_firmware_state() (CVE-2026-89852)
    • scsi: qla2xxx: Fix FCE trace enable parsing in debugfs (CVE-2026-89851)
    • scsi: qla2xxx: Don't query firmware state while chip is down (CVE-2026-89850)
    • scsi: qla2xxx: Reject non-SCSI SRB on status IOCB fast path (CVE-2026-89849)
    • scsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()
    • scsi: qla2xxx: Avoid double completion in async IOCB timeout (CVE-2026-89847)
    • scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)
    • scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() (CVE-2026-89845)
    • scsi: qla2xxx: Drop vport reference under lock in report ID acquisition
    • scsi: qla2xxx: Use coherent DMA buffer for D_Port diagnostics
    • scsi: qla2xxx: Zero-init bsg stack buffers to avoid info leak (CVE-2026-89843)
    • f2fs: return symlink writeback errors
    • f2fs: reject overlapping move range after len expansion
    • f2fs: return writeback error from collapse range
    • f2fs: fix i_size when pinned fallocate partially fails
    • drm/bridge: dw-hdmi: fix i2c adapter leak on probe failure
    • drm/panel-edp: fix i2c adapter leak on probe failure (CVE-2026-89824)
    • drm: fix race between partial drm_dev_register() failure and ioctl (CVE-2026-89823)
    • [x86] drm/i915: Guard against NULL driver_data in i915_pci_probe() (CVE-2026-89822)
    • drm/sun4i: fix refcount leak in sun4i_backend_init_sat()
    • drm/hibmc: Fix list of formats on the primary plane
    • drm/hibmc: Use drm_atomic_helper_check_plane_state()
    • drm/amd/display: avoid divide-by-zero in __is_lut_linear() (CVE-2026-89821)
    • drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (CVE-2026-89818)
    • drm/gud: NUL-terminate TV mode names read from the device (CVE-2026-89817)
    • drm/gud: validate TV mode names before creating enum property
    • drm/msm/dsi: round 6G byte clock rate to the PLL-achievable value
    • drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used (CVE-2026-89816)
    • drm/amdgpu: check thunderbolt before switcheroo registration
    • drm/amdgpu: fix autosuspend cleanup during removal
    • drm/amdgpu: use AMDGPU_GPU_PAGE_SHIFT instead of PAGE_SHIFT
    • drm/nouveau: Use write-combined maps for coherent
    • xhci: fix lost bounce buffers on TDs spanning several ring segments (CVE-2026-90015)
    • tcp: clear sock_ops cb flags before force-closing a child socket (CVE-2026-74268)
    • net/mlx5e: xsk: Fix unlocked writing to ICOSQ (CVE-2026-64210)
    • nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
    • mm/damon/core-kunit: check region count before testing in split_at()
    • mm/damon/vaddr: drop last same folio access check optimization
    • mm/damon/paddr: drop last same folio access check reuse optimization
    • mm/damon/vaddr-kunit: check region count in three_regions test
    • mm/damon/sysfs-schemes: kobject_del() scheme dirs
    • mm/damon/tests/core-kunit: catch test failure in test_merge_regions_of()
    • bpf: Guard stack limits against 32bit overflow (CVE-2023-52676)
    • ax25: fix use-after-free bugs caused by ax25_ds_del_timer (CVE-2024-35887)
    • [x86] mm/ident_map: Use gbpages only where full GB page should be mapped. (CVE-2024-50017)
    • net: hns3: fix kernel crash when 1588 is sent on HIP08 devices (CVE-2025-21649)
    • wifi: ath11k: fix RCU stall while reaping monitor destination ring (CVE-2024-58097)
    • wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path (CVE-2025-23129)
    • net: fix NULL pointer dereference in l3mdev_l3_rcv (CVE-2025-22103)
    • net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry reads (CVE-2025-37833)
    • ext4: move ext4_percpu_param_init() before ext4_mb_init() (CVE-2026-43288)
    • netfilter: nft_counter: serialize reset with spinlock (CVE-2026-45897)
    • net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check (CVE-2026-23448)
    • net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check (CVE-2026-23447)
    • bridge: mrp: reject zero test interval to avoid OOM panic (CVE-2026-31420)
    • net: af_key: zero aligned sockaddr tail in PF_KEY exports (CVE-2026-43088)
    • bpf: Fix same-register dst/src OOB read and pointer leak in sock_ops (CVE-2026-53078)
    • net: hns3: don't auto enable misc vector (CVE-2025-21651)
    • ksmbd: fix overflow in dacloffset bounds check (CVE-2025-22039)
    • ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE (CVE-2026-52944)
    • batman-adv: dat: atomically update mac addresses (CVE-2026-93204)
    • batman-adv: bla: avoid CRC corruption due to parallel claim add (CVE-2026-93203)
    • perf sched: Fix register_pid() overflow, strcpy, and BUG_ON (CVE-2026-80671)
    • clk: meson: align gxbb_32k_clk_sel number of parents with actual count (CVE-2026-89947)
    • mm/damon/core: skip aging from repeated aggressive merging
    • drm: lcdif: Wait for vblank before disabling DMA
    • drm/rockchip: vop2: Recognise 10-bit YUV422 as YUV format
    • drm/bridge: cdns-mhdp8546: Return an error pointer on allocation failure
    • smack: fix incorrect task context in smack_msg_queue_msgrcv (CVE-2026-93191)
    • smack: simplify write handlers of sysfs entries
    • smack: deduplicate smackfs/{direct,mapped} file_operations
    • smack: restrict smackfs/{direct,mapped} values to 0-255
    • usb: typec: Add partner PD object wrapper
    • platform/chrome: cros_ec_typec: Set parent of partner PD object
    • platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count (CVE-2026-93190)
    • HID: core: quiesce input in hid_hw_stop() to prevent use-after-free (CVE-2026-93189)
    • HID: nintendo: Fix imu_timestamp_us double increment per report
    • HID: roccat: bound device-supplied profile index (CVE-2026-93188)
    • soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
    • media: cec-pin: Fix event FIFO ordering
    • clk: versaclock7: Fix APLL clock leak on probe failure
    • clk: moxart: remove unused variables, fix refcount leak
    • ASoC: rt700-sdw: always drain jack work on remove (CVE-2026-93185)
    • clk: hisilicon: reset: Use devm_kzalloc to initialize hisi_reset_controller
    • clk: imx: scu: drop redundant init.ops variable assignment
    • drm/lima: call drm_mm_init() with a valid allocation range (CVE-2026-93183)
    • sched/fair: Fix overflow in update_tg_cfs_runnable() (CVE-2026-93182)
    • [x86] perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails
    • pinctrl: bcm2835: Don't remove an unregistered GPIO chip
    • media: keymaps: Remove obsolete RC_MAP_RC5_TV keymap define
    • media: keymaps: Remove obsolete RC_MAP_HAUPPAUGE_NEW keymap define
    • perf tests stat_bpf_counters: Fix usage of '==' to address shellcheck warning
    • perf test: raise limit to 20 percent for perf_stat_--bpf-counters_test
    • perf test bpf-counters: Add test for BPF event modifier
    • perf test stat_bpf_counter.sh: Stabilize the test results
    • perf test: Use sqrtloop workload to test bperf event
    • perf test: Fix perf stat --bpf-counters on hybrid machines
    • perf tests: Fix flakiness in BPF counters test on hybrid systems
    • drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup (CVE-2026-93178)
    • drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup (CVE-2026-93177)
    • tools/bpf/bpftool: Reset vmlinux BTF after map commands
    • bpftool: Define _GNU_SOURCE only once
    • bpftool: clean-up usage of libbpf_get_error()
    • tools/bpf/bpftool: Reset vmlinux BTF after struct_ops commands
    • dmaengine: mediatek: mtk-uart-apdma: Return -ENOMEM on memory allocation failure
    • dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers (CVE-2026-93170)
    • dmaengine: hisilicon: Return -ENOMEM on dynamic memory allocation in probe
    • soundwire: qcom: Fix port exhaustion check in stream_alloc_ports
    • iio: orientation: hid-sensor-rotation: Avoid race between callback setup and device exposure
    • csky: Fix a4/a5 restoration in syscall trace path (CVE-2026-93167)
    • platform/chrome: sensorhub: Fix memory overread in ring handler (CVE-2026-93165)
    • wifi: rtw89: fix HE extended capability length check
    • [x86] perf/x86/amd/uncore: Refactor uncore management
    • [x86] perf/x86/amd/uncore: Add group validation
    • crypto: qat - clear AES key schedule from stack (CVE-2026-93161)
    • crypto: atmel-ecc - replace min_t with min
    • crypto: atmel-ecc - clean up and improve ECDH comments
    • crypto: atmel-ecc - reject hardware ECDH without a public key (CVE-2026-93160)
    • crypto: atmel-sha204a - fix heap info leak on I2C transfer failure (CVE-2026-93159)
    • crypto: sa2ul - stop probe if context pool creation fails (CVE-2026-93158)
    • nvme-apple: Use acquire/release for queue enabled state (CVE-2026-93152)
    • nvmet-rdma: avoid circular locking dependency on install_queue()
    • nvmet-rdma: use sbitmap to replace rsp free list
    • nvmet-rdma: factor out response resource cleanup
    • nvmet-rdma: fix response resource leak on queue teardown (CVE-2026-93151)
    • bus: ti-sysc: Fix /chosen node reference leak
    • PM: sleep: Fix off-by-one in wakelocks number limit check
    • [arm64] dts: qcom: sm7225-fairphone-fp4: Fix address in fb node name
    • bus: qcom-ebi2: Simplify with scoped for each OF child loop
    • bus: qcom-ebi2: Fix clock leak on probe failure
    • wifi: mac80211_hwsim: avoid NULL skb in stop queue drain (CVE-2026-93149)
    • staging: greybus: audio: correct sscanf() return value check
    • staging: sm750fb: gate dualview dataflow using g_dualview
    • greybus: audio: bound the topology section sizes against the fetched size
    • staging: fbtft: Use sysfs_emit_at() to print to sysfs file
    • staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
    • staging: octeon: fix free_irq dev_id mismatch in cvm_oct_rx_shutdown
    • staging: octeon: ethernet-mem: replace pr_warn with dev_warn in free functions
    • staging: octeon: replace pr_warn with dev_warn in fill and rx paths
    • staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
    • staging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()
    • ALSA: via82xx: Remove unreachable branch in snd_via686_pcm_pointer()
    • irqchip/gic-v3-its: Fix memleak in its_probe_one()
    • clocksource: Unregister subsystem on device registration failure
    • y2038: uapi: Use 64-bit __kernel_old_timespec::tv_nsec on x32
    • timekeeping: Account for monotonicity adjustment in ntp_error
    • clk: qcom: gdsc: propagate gdsc_check_status() errors from gdsc_poll_status
    • clk: qcom: gdsc: propagate gdsc_enable() failure for ALWAYS_ON domains
    • clk: qcom: gdsc: tear down per-domain genpds in gdsc_unregister() (CVE-2026-93145)
    • thermal/drivers/rcar_gen3_thermal: Do not call set_trips() when resuming
    • thermal/drivers/rcar_gen3_thermal: Create device local ops struct
    • thermal/drivers/rcar_gen3_thermal: Fix device initialization
    • thermal/hwmon: Do not set no_hwmon before calling thermal_add_hwmon_sysfs()
    • thermal/drivers/rcar: Fix error checking in probe() (CVE-2026-93142)
    • usb: gadget: r8a66597: avoid double free of ep0_req in probe error path (CVE-2026-93141)
    • udf: Mark LVID buffer as uptodate before marking it dirty (CVE-2026-93140)
    • bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux (CVE-2026-93138)
    • efi: fix stale reference to efi_recover_from_page_fault()
    • bpf: Fix use-after-free on mm_struct in bpf_find_vma() (CVE-2026-93137)
    • bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation (CVE-2026-93136)
    • [amd64] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors
    • [amd64] iommu/amd: Add support for Hygon family 18h model 4h IOAPIC
    • [amd64] iommu/amd: Fix false positive in SB IOAPIC IVRS validation
    • leds: pca9532: Fix inverted GPIO output polarity
    • [x86] platform/x86: dell-privacy: Fix race condition (CVE-2026-93131)
    • [x86] platform/x86: dell-wmi-base: Fix resource leak on module load failure (CVE-2026-93130)
    • hwspinlock: propagate errno when registering single lock
    • usb: gadget: configfs: fix out-of-bounds read of qw_sign (CVE-2026-93120)
    • usb: gadget: aspeed_udc: Convert to platform remove callback returning void
    • usb: gadget: aspeed_udc: check endpoint DMA allocation (CVE-2026-93118)
    • Bluetooth: Add support for hci devcoredump
    • Bluetooth: btusb: Add btusb devcoredump support
    • USB: core: Use device_driver directly in struct usb_driver and usb_device_driver
    • USB: make single lock for all usb dynamic id lists
    • USB: make to_usb_driver() use container_of_const()
    • usb: fix UAF when probe runs concurrent to dyn ID removal (CVE-2026-93117)
    • platform/mellanox: mlxbf-pmc: Check ACPI_COMPANION() against NULL (CVE-2026-93115)
    • platform/surface: acpi-notify: Check ACPI companion before use (CVE-2026-93114)
    • usb: mtu3: allow system suspend during active gadget connection
    • usb: renesas_usbhs: Fix power-off ordering on unbind
    • drm/panel: samsung-s6d16d0: Power off on prepare failure
    • perf metricgroups: Use zfree() to reduce chances of use after free
    • perf metricgroup: Fix metric expression copy leaks
    • bus: qcom-ebi2: use managed resources for clocks and children
    • iio: accel: dmard09: Implement IIO_CHAN_INFO_SCALE
    • RDMA/core: Wait for RCU callbacks before unloading ib_core (CVE-2026-93110)
    • RDMA/mlx: Calling qp event handler in workqueue context
    • RDMA/mlx5: Drain RCU callbacks during module teardown (CVE-2026-93109)
    • RDMA/ipoib: Drain RCU callbacks during module teardown (CVE-2026-93108)
    • hwrng: ks-sa - access private data via struct hwrng
    • hwrng: ks-sa - Fix runtime PM cleanup on registration failure
    • xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full (CVE-2026-89783)
    • ALSA: hpi: Check transport errors during HPI6000 adapter initialization
    • pmdomain: bcm: bcm2835: handle genpd provider registration errors
    • misc: rtsx_usb: avoid USB I/O in runtime autosuspend
    • RDMA/hfi1: Preserve unit 0 on allocation failure (CVE-2026-93103)
    • RDMA/hfi1: Free RX data on late probe failure (CVE-2026-93102)
    • RDMA/hfi1: Remove redundant PCI device ID validation
    • RDMA/hfi1: Create workqueues before device initialization
    • RDMA/hfi1: Stop flushing the global IB workqueue
    • RDMA/hfi1: Initialize debugfs after probe completes
    • ASoC: apple: mca: increase SERDES reset delay
    • isofs: fix out-of-bounds page array access on empty zisofs block (CVE-2026-89778)
    • rpmsg: glink: remove duplicate code for rpmsg device remove
    • rpmsg: glink: fix deadlock in endpoint destroy during driver detach (CVE-2026-93098)
    • hfsplus: validate thread record before delete key rebuild (CVE-2026-93095)
    • wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
    • libnvdimm/labels: Bound the on-media label size before the shift
    • dax: read holder_ops once in dax_holder_notify_failure() (CVE-2026-93073)
    • cpufreq: spear: Fix an IS_ERR() vs NULL bug in spear1340_set_cpu_rate()
    • PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN
    • PCI: xgene: Drop unnecessary OF node reference
    • cpufreq: intel_pstate: Fix setting minimum P-state at init time
    • cpufreq: schedutil: Fix self-contradictory comment in sugov_iowait_apply()
    • remoteproc: qcom: Fix glink->node reference leak in qcom_add_glink_subdev
    • drm/bridge: tc358767: clamp the reported AUX read size to the request (CVE-2026-93067)
    • [arm64] dts: qcom: msm8996-xiaomi-gemini: Fix up ti,drv2604 enable GPIO
    • wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser (CVE-2026-93064)
    • wifi: iwlmei: don't send SAP messages if AMT is disabled
    • wifi: iwlwifi: mei: add support for SAP version 4
    • wifi: iwlwifi: mei: check SAP message length before reading it (CVE-2026-93063)
    • wifi: iwlwifi: mei: pass correct argument to function
    • gpu: host1x: Fix offset calculation in trace_write_gather
    • gpu: host1x: Avoid stack over-read in debug output helpers (CVE-2026-93061)
    • crypto: sl3516 - drop invalid sg_dma_len checks before DMA mapping
    • ACPI: processor: idle: Expand _LPI package sanity checks
    • usb: gadget: f_uac1_legacy: remove broken string configfs attributes (CVE-2026-93056)
    • tty: hvc: restrict HVC_DCC to ARMv6+ and ARM64
    • UDF symlink pathComponent header OOB read (CVE-2026-93055)
    • uio: Fix stale info pointer in failed registration path (CVE-2026-93054)
    • accessibility: speakup: Fix incorrect string length computation in report_char_chartab_status()
    • speakup: keyhelp: guard letter_offsets possible out-of-range indexing (CVE-2026-93053)
    • misc: bcm-vk: Use acquire/release for msgq_inited (CVE-2026-93052)
    • misc: rtsx: add missing write register handling
    • misc: ad525x_dpot: use driver core groups for sysfs files (CVE-2026-93051)
    • ppdev: prevent overflow when setting port timeout
    • tty: hvsi: remove an extra variable from hvsi_write()
    • tty: propagate u8 data to tty_operations::write()
    • tty: ipoctal: convert to u8 and size_t
    • ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove (CVE-2026-93050)
    • char: xilinx_hwicap: unregister class on init errors
    • vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
    • mtd: mtdswap: Avoid freeing registered blktrans device twice (CVE-2026-93049)
    • mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() (CVE-2026-93048)
    • perf ui hists: Fix uninitialized stack memory free on pstack allocation failure
    • software node: Fix software_node_get_reference_args() with index -1 (CVE-2026-93046)
    • driver core: soc: remove layering violation for the soc_bus
    • driver core: soc: Unregister bus on early device registration failure
    • dmaengine: dw-edma: Serialize abort state updates (CVE-2026-93041)
    • dmaengine: dw-edma: Serialize channel state checks (CVE-2026-93040)
    • dmaengine: dw-edma: Clear stale requests on termination
    • ASoC: meson: Keep link pointers valid on realloc failure (CVE-2026-93039)
    • [arm64] dts: amlogic: meson-axg-s400: enable mipi_pcie_analog_dphy for PCIe
    • RDMA/hfi1: Propagate sdma_txinit_ahg() errors (CVE-2026-93037)
    • RDMA/rxe: Validate num_sge/cur_sge before indexing wqe->dma.sge[] (CVE-2026-92525)
    • RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
    • kcsan: avoid unintended access checking in NMIs
    • irqchip/gic-v3-its: Prevent leak in its_vpe_irq_domain_alloc() (CVE-2026-92524)
    • RDMA/nldev: validate dynamic counter attribute length (CVE-2026-92523)
    • ACPI: EC: Avoid _REG disconnect on GPIO IRQ defer
    • ACPI: processor: validate MADT IOAPIC entry bounds (CVE-2026-92522)
    • ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root (CVE-2026-92521)
    • ext4: fix out-of-bounds read in ext4_read_inline_dir() (CVE-2026-89786)
    • ext4: skip extra isize expansion during mount to prevent deadlock
    • libbpf: Search /lib64 and /lib in resolve_full_path()
    • RDMA/srpt: Pass the mapped task attribute to target_init_cmd()
    • RDMA/erdma: Fix CEQ tasklet use-after-free on removal (CVE-2026-92514)
    • RDMA/nldev: Add NULL check to silence false warnings
    • RDMA/core: Add support to set privileged QKEY parameter
    • RDMA/core: Add an option to display driver-specific QPs in the rdmatool
    • RDMA/restrack: Fix typos in the comments
    • RDMA/nldev: Fix locking when accessing mr->pd (CVE-2026-74334)
    • RDMA/core: Add rdma_restrack_begin/abort/commit_del() operations
    • RDMA/core: Fix use after free in ib_query_qp() (CVE-2026-92512)
    • RDMA/core: Fix potential use after free in ib_destroy_cq_user() (CVE-2026-92511)
    • RDMA/core: Fix potential use after free in ib_destroy_srq_user() (CVE-2026-92510)
    • RDMA/core: Fix potential use after free in counter_release() (CVE-2026-92509)
    • RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq()
    • RDMA/core: Fix potential use after free in ib_free_cq() (CVE-2026-92508)
    • RDMA/core: Fix potential use after free in ib_dealloc_pd_user() (CVE-2026-92507)
    • iommu/qcom: Remove sysfs device on probe failure path
    • iommu/qcom: Fix inverted fault report check in qcom_iommu_fault()
    • thermal: intel: int3400: clean up ODVP on probe failures (CVE-2026-92504)
    • ext4: drain in-flight DIO before buffered write fallback (CVE-2026-92501)
    • wifi: ath6kl: avoid buffer overreads in WMI event handlers (CVE-2026-92498)
    • wifi: ath11k: Correctly copy the hint BSSID in WMI scan request
    • wifi: ath11k: Avoid buffer overread in ath11k_wmi_tlv_op_rx() (CVE-2026-92496)
    • ext4: fix buffer_head leak in ext4_init_orphan_info (CVE-2026-92494)
    • ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() (CVE-2026-89787)
    • perf cs-etm: Flush thread stacks after decoder reset
    • perf cs-etm: Avoid truncating AUX buffer sizes to int
    • leds: pca9532: Fix phantom device registration on missing hardware
    • drm/tve200: add OF module alias for autoloading
    • netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet
    • [arm64] dts: rockchip: Fix Gru WLAN sideband interrupt
    • [armhf] lpc32xx: only run SoC init on LPC32xx hardware
    • pinctrl: mediatek: Use C99 initializers in PINCTRL_PIN_GROUP()
    • pinctrl: mediatek: Add EINT support for multiple addresses
    • pinctrl: mediatek: Fix the invalid conditions
    • pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms
    • pinctrl: mediatek: free EINT resources on unbind (CVE-2026-92481)
    • tools/build: Add bpftool-skeletons feature test
    • tools/build: Allow versioning of all LLVM tools defined in Makefile.include
    • power: supply: sbs-battery: Use a per-device serial number buffer
    • scsi: ufs: debugfs: Reserve space for a string terminator (CVE-2026-92477)
    • crypto: keembay - Initialize completion before requesting IRQ (CVE-2026-92476)
    • crypto: keembay - publish OF module alias for OCS AES/SM4
    • RDMA/mlx5: Fix integer overflow of user QP buffer size (CVE-2026-90435)
    • isofs: release zisofs block pointer buffer head (CVE-2026-90434)
    • w1: ds2482: Fix signedness bug in ds2482_w1_triplet()
    • remoteproc: core: Drop redundant initialization of 'ret' in rproc_shutdown()
    • remoteproc: Allow shutdown of crashed processors
    • remoteproc: core: Attach rproc asynchronously in rproc_add() path via schedule_work()
    • remoteproc: Prevent crash handling to race with rproc_del() (CVE-2026-90431)
    • staging: rtl8723bs: use kfree_sensitive() for key material
    • RDMA/efa: Fix PBL chunk length computation
    • [arm64] dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
    • clk: tegra: tegra124-emc: put EMC node on register failure
    • clk: palmas: Manage external-control prepare with devm
    • [x86] clk/x86: pmc_atom: add kasprintf return value check
    • nilfs2: fix infinite loop in nilfs_clean_segments() (CVE-2026-90420)
    • nilfs2: prevent out-of-bounds read in super root block parsing (CVE-2026-90419)
    • scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches.
    • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs (CVE-2026-90416)
    • RDMA/mlx5: Send cong param changes to the resolved port mdev
    • RDMA/cxgb4: free STAG index when TPT entry write fails (CVE-2026-90415)
    • IB/isert: reject PDUs declaring more data than was received (CVE-2026-90414)
    • IB/isert: reject login PDUs declaring more data than was received (CVE-2026-90413)
    • nvme-fc: unmap cmd_iu DMA on rsp_iu mapping failure in init_request (CVE-2026-90411)
    • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() (CVE-2026-90403)
    • bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
    • md/raid5-ppl: fix use-after-free in ppl_do_flush()
    • tracing/osnoise: Add osnoise/options file
    • tracing/osnoise: Add OSNOISE_WORKLOAD option
    • tracing/osnoise: Add PANIC_ON_STOP option
    • tracing/osnoise: Add preempt and/or irq disabled options
    • rcu: Remove unused function declaration rcu_eqs_special_set()
    • rcu: Rename rcu_momentary_dyntick_idle() into rcu_momentary_eqs()
    • rcu: Mark accesses to ->rcu_urgent_qs and ->rcu_need_heavy_qs
    • [arm64] dts: qcom: sagit: add initial device tree for sagit
    • [arm64] dts: qcom: msm8998: Don't pull-up I2C pins by default in sleep
    • dt-bindings: clock: Add SM8550 GCC clocks
    • clk: qcom: Add LUCID_OLE PLL type for SM8550
    • clk: qcom: Add GCC driver for SM8550
    • clk: qcom: gcc-sm8550: Mark RCGs shared where applicable
    • clk: qcom: gcc-sm8550: Don't park the USB RCG at registration time
    • clk: qcom: gcc-qcm2290: don't park QUP RCGs upon registration
    • [arm64] dts: qcom: sc8280xp-crd: Fix the pin index for misc_3p3_reg_en
    • [arm64] dts: qcom: Add base SM8550 dtsi
    • [arm64] dts: qcom: sm8550: add QCrypto nodes
    • [arm64] dts: qcom: sm8350: add PCIe devices
    • [arm64] dts: qcom: sm8550: Add UFS host controller and phy nodes
    • [arm64] dts: qcom: sm8550: Add PCIe PHYs and controllers nodes
    • [arm64] dts: qcom: Remove "iommus" property from PCIe nodes
    • [arm64] dts: qcom: sdm845: Fix the PCIe iommu-map entries
    • [arm64] dts: qcom: sm8150: Fix the PCIe iommu-map entries
    • [arm64] dts: qcom: sm8250: Fix the PCIe iommu-map entries
    • [arm64] dts: qcom: sm8350: Fix the PCIe iommu-map entries
    • [arm64] dts: qcom: sm8450: Fix the PCIe iommu-map entries
    • [arm64] dts: qcom: sm8550: Use GIC-ITS for PCIe0 and PCIe1
    • [arm64] dts: qcom: sm8550: Fix the msi-map entries
    • [arm64] dts: qcom: sm8550: Fix the PCIe iommu-map entries
    • power: supply: isp1704_charger: cancel work on remove (CVE-2026-90395)
    • power: supply: sc2731_charger: Convert to platform remove callback returning void
    • power: supply: sc2731_charger: cancel work on remove (CVE-2026-90394)
    • bpf: Fix potential UAF in bpf_netns_link_update_prog (CVE-2026-90393)
    • lib/test_hmm: fail dmirror_fault() when the mirrored mm is gone (CVE-2026-90391)
    • clk: qcom: Return expected ENOMEM error on dynamic allocation failure
    • iommu/dma: Check atomic pool allocation result directly (CVE-2026-90388)
    • i3c: dw: avoid shift-out-of-bounds when DAA assigns no devices (CVE-2026-90386)
    • i3c: master: Fix device_register() error path
    • locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
    • misc: vmc_vmci: Fix potential memory leak in vmci_event_subscribe()
    • fanotify: report full event length for FIONREAD
    • wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length (CVE-2026-90382)
    • wifi: mt76: mt7915: move wed init routines in mmio.c
    • wifi: mt76: mt7915: enable wed for mt7986 chipset
    • wifi: mt76: mt7915: enable wed for mt7986-wmac chipset
    • wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
    • wifi: mt76: mt792x: Fix memory leak in SDIO TX path (CVE-2026-90378)
    • wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss (CVE-2026-90372)
    • wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
    • wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
    • perf: arm_spe: Make wakeup range check overflow safe
    • drm/msm/dpu: Drop sneaky dev_pm_opp_set_rate(0)
    • drm/msm/dsi: Drop dev_pm_opp_set_rate(0) (CVE-2026-90362)
    • wifi: ath11k: fix leak in ath11k_service_ready_ext_event() (CVE-2026-90361)
    • regulator: core: use system_freezable_wq for init complete work (CVE-2026-90360)
    • perf machine: Guard against NULL strlist in machines__findnew()
    • perf machine: Use snprintf() for guestmount path construction
    • perf machine: Check snprintf truncation in machines__findnew()
    • perf machine: Don't abort guest map creation on first inaccessible dir
    • perf machine: Reset errno before strtol in guest kernel map creation
    • perf machine: Free scandir entries in guest kernel map creation
    • perf machine: Check snprintf truncation for guest kallsyms path
    • wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement (CVE-2026-90357)
    • wifi: mt76: mt7915: fix double hif2 init on the non-WED path (CVE-2026-90354)
    • wifi: mt76: mt7915: rework mt7915_dma_reset()
    • wifi: mt76: mt7915: enable full system reset support
    • wifi: mt76: mt7915: add full system reset into debugfs
    • wifi: mt76: mt7915: enable coredump support
    • wifi: mt76: mt7915: fix ext PHY use-after-free on register error path (CVE-2026-90353)
    • wifi: mt76: mt7915: release hif2 reference on probe IRQ failure (CVE-2026-90352)
    • wifi: ath10k: snoc: use memcpy_fromio() for MSA ramdump (CVE-2026-90348)
    • iommu/arm-smmu-v3: Convert to use atomic poll timeout
    • wifi: mac80211: send TWT teardown to peer after setup TX failure
    • wifi: zd1211rw: reject secondary interfaces to prevent conflicts
    • wifi: mac80211: skip unused probe response countdown offsets
    • firmware: google: Add bounds checks in coreboot_table_populate()
    • firmware: coreboot: Validate table bounds (CVE-2026-90341)
    • powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass
    • serial: amba-pl011: unprepare console clock on unregister
    • tty: clear cdev pointer after cdev_add() failure (CVE-2026-90334)
    • HID: split apart hid_device_probe to make logic more apparent
    • HID: ensure timely release of driver-allocated resources
    • HID: synchronize input before cleaning up a failed probe (CVE-2026-90329)
    • HID: i2c-hid: Fold i2c_hid_execute_reset() into i2c_hid_hwreset()
    • HID: i2c-hid: Switch i2c_hid_parse() to goto style error handling
    • HID: i2c-hid: Fix "(null)" output when reading report descriptor fails
    • HID: lg4ff: validate report length before fixed offsets
    • perf thread-stack: Fix heap buffer overflow on branch stack wrap copy
    • perf auxtrace: Fix queue grow overflow and old array leak
    • perf intel-pt: Fix off-by-one in auxtrace_info minimum size check
    • perf intel-bts: Fix off-by-one in auxtrace_info minimum size check
    • iio: light: tsl2772: fix ALS calibscale readback
    • iio: light: isl29028: return zero in write_raw() on success
    • iio: light: tsl2583: return zero in write_raw() on success
    • phonet: pep: do not write beyond optlen in getsockopt (CVE-2026-90327)
    • blk-cgroup: skip dying blkg in blkcg_activate_policy()
    • block/blk-stat: drain per-cpu callback stats over possible CPUs
    • block/blk-iocost: collect per-cpu latency stats over possible CPUs
    • block/kyber-iosched: flush per-cpu latency buckets over possible CPUs
    • lib/string: fix memchr_inv() for large ranges
    • pps: don't try to wait for negative timeouts in PPS_FETCH
    • pps: clients: gpio: Bypass edge's direction check when not needed
    • pps: pps-gpio: split IRQ handler into hardirq timestamper + threaded handler
    • pps-gpio: remove dead capture_clear code
    • rapidio: clear mport->net when rio_add_net() fails (CVE-2026-90319)
    • fat: release buffer head after rebuilding parent (CVE-2026-90318)
    • drm/omap: dsi: Do not copy isr table (CVE-2026-90316)
    • remoteproc: Move resource table data structure to its own header
    • remoteproc: use rsc_table_for_each_entry() in rproc_handle_resources()
    • remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() (CVE-2026-90314)
    • [arm64] dts: qcom: sm7225-fairphone-fp4: move status property down
    • [arm64] dts: qcom: sm7225-fairphone-fp4: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
    • scripts/tags.sh: improve compiled sources generation
    • scripts/tags.sh: Prevent binary files appearing in cscope.files
    • modpost: prevent leak when early return no suffix .o in read_symbols()
    • RDMA/erdma: Hold CQ references when processing EQ events (CVE-2026-90309)
    • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ (CVE-2026-90307)
    • [armhf] 9485/1: mm: acquire mmap write lock around show_pte() for user faults (CVE-2026-90303)
    • ocfs2: use bitmap API in fill_node_map
    • ocfs2: synchronize heartbeat callbacks with o2net teardown (CVE-2026-90302)
    • drm/sun4i: vi scaler: Fix coefficient selection
    • of: property: add missing kerneldoc for of_graph_get_endpoint_count()
    • of: property: use unsigned int return on of_graph_get_endpoint_count()
    • of: property: add of_graph_get_next_port()
    • of: property: add of_graph_get_next_port_endpoint()
    • bitfield: Add less-checking _FIELD{GET,PREP}()
    • bitfield: Add non-constant field_{prep,get}() helpers
    • drm/sun4i: tcon-top: Keep mixer routes distinct
    • drm/sun4i: tcon: Set output mux for DSI and LVDS
    • drm/sun4i: tcon: Drop TCON TOP device reference (CVE-2026-90298)
    • drm/sun4i: crtc: Propagate layer initialization error (CVE-2026-90297)
    • drm/sun4i: tcon: Drop remote endpoint reference
    • drm/sun4i: dw-hdmi: Drop TCON TOP port reference
    • drm/sun4i: hdmi-phy: Fix H6 8-bit MPLL config at 594 MHz
    • cpufreq: imx6q: fix devres accumulation across driver rebind (CVE-2026-90296)
    • cpufreq: imx6q: fix out-of-bounds write when probed more than once (CVE-2026-90295)
    • IB/isert: delay the final Login Response until the session is registered (CVE-2026-90294)
    • IB/isert: post the full-feature receive buffers after session registration (CVE-2026-90293)
    • RDMA/siw: Introduce siw_free_cm_id
    • RDMA/siw: Fix use-after-free in siw_accept() (CVE-2026-90292)
    • RDMA/erdma: restrict the driver to little-endian systems
    • wifi: mac80211: skip default WMM setup for AP_VLAN links
    • [arm64] hibernate: mask DAIF before restoring hibernated kernel
    • [arm64] hibernate: Restore DAIF state on error (CVE-2026-90290)
    • mfd: rave-sp: validate received frame payload lengths
    • mfd: iqs62x: Reject zero-length firmware records
    • drm/amdgpu/gfx6: Fixup emit_cntxcntl()
    • ext4: fix spurious message about orphan cleanup on RO fs
    • [arm64] dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
    • phy: sunplus: fix error handling in sp_uphy_init() (CVE-2026-90287)
    • phy: rockchip: phy-rockchip-inno-csidphy: fix rk1808 hsfreq table
    • perf trace-event: Fix buffer overflow in read_string()
    • drm/amdgpu/gfx6: Fixup emitting SWITCH_BUFFER packets
    • drm/amdgpu/gfx6: Use PFP on the compute queues too (CVE-2026-90286)
    • scsi: qla2xxx: Remove redundant VPD flash read in sysfs read path (CVE-2026-90285)
    • firmware_loader: do not queue completed sysfs fallback requests (CVE-2026-90284)
    • pinctrl: rockchip: Reset the pin count when recalculating SoC data
    • hugetlbfs: release subpool on fill_super failure (CVE-2026-90283)
    • soc: fsl: qe: check platform_driver_register() in qe_ic_of_init()
    • phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend (CVE-2026-90281)
    • coresight: etm4x: fix wrong check of etm4x_sspcicrn_present()
    • coresight: Change syncfreq to be a u8
    • coresight: etm4x: fix underflow for usage of (nrseqstate - 1) (CVE-2026-90274)
    • regulator: qcom-rpmh: Fix PMIC5 BOB bypass mode handling
    • ACPI: video: Release PCI device reference after lookup
    • sched/fair: Check CPU capacity before comparing group types during load balance
    • Bluetooth: btqca: Fix qca_set_bdaddr() waiting for wrong HCI event
    • Bluetooth: btusb: Fix BD_ADDR byte order in btusb_set_bdaddr_wcn6855()
    • perf trace-event: Fix integer truncation in do_read() and skip()
    • scsi: sd: Fix sd_done() sense handling condition
    • Bluetooth: virtio_bt: avoid OOB read of build info string (CVE-2026-90257)
    • Bluetooth: hci_event: Use HCI error defines instead of magic values
    • Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (CVE-2024-50029)
    • Bluetooth: hci_conn: fix the SCO setup context lifetime (CVE-2026-90255)
    • Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths (CVE-2026-90254)
    • Bluetooth: MGMT: free the mesh send cancel command when it is cancelled (CVE-2026-90253)
    • Bluetooth: MSFT: validate evt_prefix_len against the response length (CVE-2026-90251)
    • iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes (CVE-2026-90249)
    • iio: light: gp2ap002: re-enable irq if runtime suspend fails
    • net/sched: cls_api: fix teardown of an adopted proto on insert-race loss (CVE-2026-90248)
    • [arm64] dts: turris-mox: fix usb3 phys
    • perf stat: Clear screen only if output file is a tty
    • perf stat: Fix evsel_list leak in cmd_stat
    • perf synthetic-events: Fix uninitialized pthread_join
    • perf synthetic-events: Fix divide by zero in perf_event__synthesize_threads
    • fbdev: tdfxfb: fix PCI enable cleanup with pcim_enable_device()
    • fbdev: kyro: Validate overlay viewport coordinates (CVE-2026-90245)
    • [amd64] iommu/vt-d: Fix UCTP context table slot when copying root entries
    • [arm64] Disable KCSAN instrumentation in delay.o
    • SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 (CVE-2026-89784)
    • powerpc/configs: enable CONFIG_RAS to fix EDAC support
    • spi: sprd-adi: Fix probe succeeding without registering the controller
    • ASoC: qcom: q6apm: keep the graph start count in sync with the DSP
    • nvme-apple: Don't set a DMA direction for commands without a data transfer
    • nvme-apple: Never set the opcode in the NVMMU TCB
    • nvme: introduce nvme_start_request
    • nvme-apple: return directly instead of else
    • nvme: apple: Add Apple A11 support
    • nvme-apple: Drop the PRP null check chicken bit
    • nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns() (CVE-2026-90228)
    • nfc: llcp: avoid userspace overflow on invalid optlen (CVE-2026-90226)
    • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt (CVE-2026-90225)
    • nfc: nci: fix double completion race in nci_data_exchange_complete (CVE-2026-90224)
    • nfc: llcp: bound SNL TLV parsing to the skb and add length checks (CVE-2026-90223)
    • nfc: pn533: hold a reference to the request skb during send_frame (CVE-2026-90222)
    • nfc: digital: Do not dump a NULL response in command completion
    • nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing (CVE-2026-90221)
    • dmaengine: qcom-bam-dma: fix autosuspend cleanup during removal
    • RDMA/cxgb4: Free debugfs on registration failure (CVE-2026-90219)
    • RDMA/cma: Fix WARNING in res_to_rt (CVE-2026-90218)
    • ASoC: pxa: Use devm_clk_get_optional() for extclk clock
    • ASoC: fsl-asoc-card: defer probe when the CPU DAI device is not ready
    • ubi: fastmap: Fix missed ec updating after erasing old fastmap data block
    • ubi: fastmap: erase_block: Get erase counter from wl_entry rather than flash
    • ubi: fastmap: Allocate memory with GFP_NOFS in ubi_update_fastmap
    • ubi: Replace erase_block() with sync_erase()
    • UBI: Preserve torture flag when rescheduling failed erasures
    • UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
    • ubi: fastmap: Add fastmap control support for module parameter
    • ubi: Simplify bool conversion
    • ubi: fastmap: Wait until there are enough free PEBs before filling pools
    • ubi: fastmap: Fix lapsed wear leveling for first 64 PEBs
    • ubi: fastmap: Add module parameter to control reserving filling pool PEBs
    • ubi: Fix rollback for explicit UBI device numbers (CVE-2026-90216)
    • ASoC: xilinx: formatter_pcm: fix stream_data leak on open error (CVE-2026-90214)
    • UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
    • kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
    • spi: img-spfi: don't disable runtime PM on DMA deferred probe
    • power: supply: bd99954: Drop bad register fields
    • power: supply: bq27xxx: bq27520g4: fix REG_TTES address
    • power: supply: bq27xxx: bq28z610: fix invalid AverageEnergy address
    • power: supply: bq27xxx: bq27z561: fix invalid AverageEnergy address
    • xenbus: Unregister reboot notifier on init failure
    • clocksource/drivers/clps711x: Do not unmap clocksource MMIO
    • clocksource/drivers/armada: Unwind timer clock on init failure
    • ALSA: seq: midi: Optimize event_input locking with RCU
    • ALSA: seq: midi: Serialize input teardown with event_input (CVE-2026-90207)
    • [x86] pkeys: Fix pkey_alloc() return value when pkeys are not supported
    • bpftool: Fix double close in map dump
    • ocfs2: fix circular locking dependency in ocfs2_init_acl()
    • Squashfs: check block offset is not negative (CVE-2026-90203)
    • scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (CVE-2026-90202)
    • ALSA: core: Fix use-after-free in snd_card_do_free() (CVE-2026-90198)
    • tracing: Remove "attribute()" from the type field of event format
    • tracing: Have trace_event_update_all() only handle module that is loading
    • ASoC: SOF: validate topology volume range before allocation (CVE-2026-90196)
    • ACPI: scan: fix bus ID cleanup on device_add() failures (CVE-2026-90194)
    • bpf: Fix pending_pos walk on 32-bit ring position wrap
    • crypto: hisilicon/sec2 - fix CCM algorithm long packet failure
    • perf dso: Guard close() against invalid fd in dso__decompress_kmodule_path()
    • perf dso: Guard against cache underflow on short reads in dso_cache__memcpy()
    • mailbox: rockchip: disable pclk on probe failure and unbind
    • mailbox: pcc: Fix the possible race in updation of chan_in_use flag
    • mailbox: pcc: Always clear the platform ack interrupt first
    • mailbox: pcc: Use acpi_os_ioremap() instead of ioremap()
    • mailbox: pcc: Always map the shared memory communication address
    • mailbox/pcc: support mailbox management of the shared buffer
    • Revert "mailbox/pcc: support mailbox management of the shared buffer"
    • mailbox: pcc: Fix command timeout due to missed interrupt
    • null_blk: use DEFINE_MUTEX for the file-scope mutex (CVE-2026-90190)
    • null_blk: support read-only and offline zone conditions
    • null_blk: add configfs variable shared_tags
    • null_blk: register configfs subsystem after creating default devices (CVE-2026-90189)
    • null_blk: free global tag_set on init error path (CVE-2026-90188)
    • null_blk: reject per-device queue resize for shared tag set (CVE-2026-90186)
    • null_blk: serialize configfs attribute stores with the lock (CVE-2026-90185)
    • null_blk: serialize configfs attribute updates with device setup (CVE-2026-90184)
    • block: mtip32xx: synchronize ioctls with device removal (CVE-2026-90180)
    • ksmbd: Do not skip lock checks for single-byte ranges (CVE-2026-90176)
    • smb/server: preserve error status in smb2_handle_negotiate()
    • lwt_bpf: Restore reserved headroom after xmit program (CVE-2026-90160)
    • bpf: Reject negative optlen in cgroup getsockopt hook (CVE-2026-90157)
    • nfs: replace atomic bitops sequence with clear_and_wake_up_bit helper
    • nfs: refactor pNFS functions using clear_and_wake_up_bit
    • NFSv4: remove callback IDR entry on client allocation failure (CVE-2026-90151)
    • clk: ti: use kcalloc() instead of kzalloc()
    • clk: ti: mux: resolve parent clocks by DT index, not by name
    • octeontx2-af: initialize lmac_bmap in rvu_mcs_set_lmac_bmap()
    • net: kcm: Hold RCU read lock while running BPF parser (CVE-2026-90143)
    • net: dsa: b53: fix error propagation from b53_fdb_dump()
    • pppox: drain queued packets on channel handoff
    • hsr: Use a single struct for self_node.
    • net: hsr: Use full string description when opening HSR network device
    • net: hsr: Provide RedBox support (HSR-SAN)
    • net: hsr: free learned nodes on device setup failure
    • ipvs: fix integer overflow in ftp helper port/address parsing (CVE-2026-90141)
    • vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes (CVE-2026-89776)
    • tls: fix RX desync on overlapping skbs
    • net: bridge: vlan: fix inverted default vlan notification
    • cuse: wait for pending RCU callbacks on module exit (CVE-2026-90140)
    • ALSA: hda: Fix connection list comparison in proc output
    • 8139cp: fix Rx and Tx not being disabled in cp_suspend
    • [x86] platform/x86: dell-wmi-sysman: Fix instance ID bounds
    • vsock: use sock_error() to consume sk_err after a failed connect
    • bonding: initialize err for empty target lists
    • i3c: mipi-i3c-hci: Fix DAT/DCT entry sizes
    • i3c: mipi-i3c-hci: Fix number of DAT/DCT entries for HCI versions < 1.1
    • i3c: mipi-i3c-hci: Quieten initialization messages
    • i3c: mipi-i3c-hci: Switch PIO data allocation to devm_kzalloc()
    • i3c: mipi-i3c-hci: Refactor PIO register initialization
    • i3c: mipi-i3c-hci: Fix missing STAT_IBI_STATUS_THLD in PIO mode
    • virtio_balloon: disable indirect descriptors
    • vdpa/mlx5: fix wrong list iterated in add_direct_chain error path (CVE-2026-90128)
    • rtc: pcf8563: fix clock provider leak on unbind (CVE-2026-90126)
    • rtc: zynqmp: Return optional clock lookup errors
    • irqchip/renesas-rzg2l: Fix loss of interrupt (CVE-2026-90124)
    • rtc: gamecube: check return value of devm_rtc_register_device()
    • prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator
    • clk: ti: Make sure clk_init_data is fully initialized
    • clk: visconti: Make sure clk_init_data is fully initialized (CVE-2026-90122)
    • RDMA/ucma: Allow path records to exactly fit the output buffer
    • net: bridge: Reject descending VLAN tunnel ranges (CVE-2026-90114)
    • net: thunderbolt: Count delivered packets in rx_packets and rx_bytes
    • forcedeth: stop the tx_timeout register dump past the requested window
    • net: ipa: Convert to platform remove callback returning void
    • net: ipa: balance runtime PM reference on remove error
    • inetpeer: randomize RB-tree node comparison using SipHash (CVE-2026-90110)
    • net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition (CVE-2026-90108)
    • net/smc: free pending qentry in smc_llc_flow_stop() before memset (CVE-2026-90107)
    • NFSv4.2: fix LAYOUTSTATS send buffer exhaustion (CVE-2026-90103)
    • nfs: move the nfs4_data_server_cache into struct nfs_net
    • NFSv4/pnfs: key the data server cache on the NFS version (CVE-2026-90102)
    • scsi: qla2xxx: Fix an loop timeout test
    • erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic
    • Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN (CVE-2026-90092)
    • Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
    • Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (CVE-2026-90091)
    • Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX
    • Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path (CVE-2026-90090)
    • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop (CVE-2026-90088)
    • gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free (CVE-2026-89789)
    • net: qualcomm: rmnet: restore skb->dev on deaggregated frames (CVE-2026-89780)
    • octeontx2-af: Fix TL3/TL2 link config ENA clearing
    • net/rds: use wq_has_sleeper() in rds_cong_map_updated() (CVE-2026-90081)
    • cifs: fix clearing stats for fastest execution of each smb2 command
    • net/sched: act_skbmod: fix length calculations and avoid invalid header warnings (CVE-2026-90078)
    • net/sched: fq_codel: clamp default quantum and mtu (CVE-2026-90075)
    • net/sched: sch_codel: clamp default mtu to avoid disabling CoDel
    • net/sched: fq_pie: clamp default quantum to avoid signed overflow (CVE-2026-90074)
    • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow (CVE-2026-90073)
    • net/sched: sfq: clamp quantum to avoid signed overflow soft lockup (CVE-2026-90072)
    • net/sched: sch_teql: restore skb->dev on the slave failure path (CVE-2026-90071)
    • tpm: st33zp24: Return zero on status read failure (CVE-2026-90070)
    • tpm: st33zp24: Validate locality read result
    • apparmor: Replace sprintf/strcpy with scnprintf/strscpy in aa_policy_init
    • apparmor: policy_int make sure list heads are initialized before fail path
    • ASoC: dapm: Fix off-by-one check on the second enum channel (CVE-2026-90068)
    • libceph: validate banner payload length (CVE-2026-90067)
    • net: ethernet: sun4i-emac: Fix IRQ error handling
    • net: stmmac: selftests: Pass the IP proto mask in the TC selftest
    • virtio-net: Ensure that TCP packets don't overflow gso_segs (CVE-2026-90063)
    • netfilter: nf_tables: move hardware offload step after building the chain blob (CVE-2026-90062)
    • netfilter: xt_cgroup: Make it independent from net_cls
    • netfilter: xt_HL: add pr_fmt and checkentry validation
    • netfilter: x_tables: replace pr_{info,err}() by pr_info_ratelimited()
    • ALSA: control: Make snd_ctl_find_id() argument const
    • ALSA: control: Introduce unlocked version for snd_ctl_find_*() helpers
    • ALSA: control_led: Use guard() for locking
    • ALSA: control: Don't add invalid kcontrols to LED layer (CVE-2026-90060)
    • net: stmmac: selftests: Check multiple MMC counters
    • net: stmmac: dwmac1000: Account for the primary MAC address for UC filtering
    • net: stmmac: dwmac4: Account for the primary MAC address for UC filtering
    • net: stmmac: dwxgmac: Account for the primary MAC address for UC filtering
    • net: stmmac: selftests: Account for the UC filter list for filtering tests
    • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup (CVE-2026-90058)
    • slip: remove slip_hangup() to fix use-after-free in slip_receive_buf() (CVE-2026-90057)
    • net: fec: only stop PTP if it was initialized (CVE-2026-90056)
    • usb: atm: usbatm: fix invalid ci_range initialization (CVE-2026-90055)
    • tcp: fix corruption of urgent data on multi-segment retransmit (CVE-2026-90054)
    • net/sched: sch_htb: limit htb_classify inner-class filter hops (CVE-2026-90053)
    • [x86] perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
    • nvme: target: rdma: fix ndev refcount leak on queue connect
    • Bluetooth: coredump: fix building with coredump disabled
    • pinctrl: mediatek: eint: Drop base from mtk_eint_chip_write_mask()
    • pinctrl: mediatek: Fix new design debounce issue
    • pinctrl: mediatek: common-v1: Fix EINT breakage on older controllers
    • [arm64] dts: qcom: pm8998: don't use GIC_SPI for SPMI interrupts
    • [arm64] dts: qcom: Re-enable resin on MSM8998 and SDM845 boards
    • clk: qcom: rcg2: add clk_rcg2_shared_floor_ops
    • clk: qcom: gcc-sm8550: Use floor ops for SDCC RCGs
    • clk: qcom: gcc-sm8550: Add the missing RETAIN_FF_ENABLE GDSC flag
    • clk: qcom: gcc-sm8550: Mark the PCIe GDSCs votable
    • clk: qcom: gcc-sm8550: Do not turn off PCIe GDSCs during gdsc_disable()
    • clk: qcom: gcc-sm8550: use collapse-voting for PCIe GDSCs
    • clk: qcom: gcc-sm8550: Don't use parking clk_ops for QUPs
    • [arm64] dts: qcom: sm8550: Add missing properties for cryptobam
    • [arm64] dts: qcom: sm8550: remove invalid interconnect property from cryptobam
    • [arm64] dts: qcom: sm8550: Fix UFS PHY clocks
    • [arm64] dts: qcom: sm8550: Enable UHS-I SDR50 and SDR104 SD card modes
    • [arm64] dts: qcom: sm8550: Mark UFS controller as cache coherent
    • [arm64] dts: qcom: sm8550: Fix xo clock supply of platform SD host controller
    • [arm64] dts: qcom: sm8550: Fix GIC_ITS range length
    • [arm64] dts: qcom: sm8550: Fix the PCI I/O port range
    • [arm64] dts: qcom: sm8550: Mark QUPs and GPI dma-coherent
    • [arm64] dts: qcom: sm8550: Fix SPMI channels size
    • [arm64] dts: qcom: sm8550: Update idle state time requirements
    • [arm64] dts: qcom: sm8550: Separate out X3 idle state
    • [arm64] dts: qcom: sm8550: Flush RSC sleep & wake votes
    • [arm64] dts: qcom: sm8550: correct pinctrl unit address
    • [arm64] dts: qcom: sm8550: fix qup_spi0_cs node
    • [arm64] dts: qcom: sm8550: Fix the aoss_qmp node name
    • [arm64] dts: qcom: sm8350: correct PCI phy unit address
    • [arm64] dts: qcom: sm8350: Fix the PCI I/O port range
    • wifi: mt76: mt7915: fallback to non-wed mode if platform_get_resource fails in mt7915_mmio_wed_init()
    • wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
    • HID: fix an error code in hid_check_device_match()
    • Bluetooth: hci_event: Fix connection regression between LE and non-LE adapters
    • nvme-apple: Prevent shared tags across queues on Apple A11 (CVE-2026-72131)
    • nvme-apple: Reset q->sq_tail during queue init
    • net: hsr: enable promiscuous mode on interlink port with fwd offload
    • net: hsr: Use the seqnr lock for frames received via interlink port.
    • net: hsr: init prune_proxy_timer sooner
    • tools/build: Use SYSTEM_BPFTOOL for system bpftool
    • pinctrl: mediatek: common-v1: Fix error checking in mtk_eint_init()
    • net: hsr: must allocate more bytes for RedBox support
    • nvmet-rdma: fix queue leak when connect backlog is exceeded
    • Bluetooth: Devcoredump: Fix storing u32 without specifying byte order issue https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.189
    • drm/gem: Consider GEM object reclaimable if shrinking fails
    • bus: fsl-mc: wait for the MC firmware to complete its boot
    • ALSA: usb-audio: Propagate write errors in generic mixer put callbacks
    • ima: return error early if file xattr cannot be changed
    • usb: gadget: udc: skip pullup() if already connected
    • [arm64] tee: optee: Allow MT_NORMAL_TAGGED shared memory
    • PCI: Stop setting cached power state to 'unknown' on unbind
    • hfsplus: fix issue of direct writes beyond end-of-file
    • wifi: nl80211: reject beacons with bad HE operation (CVE-2026-97517)
    • wifi: mac80211: always allow transmitting null-data on TXQs
    • wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result() (CVE-2026-97516)
    • firmware: stratix10-svc: change get provision data to async SMC call
    • bridge: Do not suppress ARP probes and DAD NS unconditionally
    • soundwire: validate DT compatible before parsing it
    • media: rc: mceusb: Add support for 04eb:e033
    • [amd64] thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response() (CVE-2026-97510)
    • [amd64] thunderbolt: Keep XDomain reference during the lifetime of a service (CVE-2026-97509)
    • [amd64] thunderbolt: Keep the domain reference while processing hotplug
    • [amd64] thunderbolt: Set tb->root_switch to NULL when domain is stopped (CVE-2026-97508)
    • [amd64] thunderbolt: Don't create multiple DMA tunnels on firmware connection manager
    • media: dm1105: fix missing error check for dma_alloc_coherent (CVE-2026-97507)
    • net: dsa: mv88e6xxx: fix number of g1 interrupts for 6320 family
    • PCI: switchtec: Add Gen6 Device IDs
    • net: dsa: mv88e6xxx: define .pot_clear() for 6321
    • net: dsa: mv88e6xxx: enable .rmu_disable() for 6320 family
    • media: em28xx-video: fix missing res_free() on init_usb_xfer failure
    • crypto: ixp4xx - fix buffer chain unwind on allocation failure (CVE-2026-97506)
    • [arm64] clk: renesas: cpg-mssr: Add number of clock cells check
    • drm/bridge: tc358768: Set pre_enable_prev_first for reverse order
    • ASoC: ti: omap3pandora: update board check to use DT compatible
    • mmc: core: Add validation for host-provided max_segs
    • mmc: davinci: avoid NULL deref of host->data in IRQ handler (CVE-2026-97502)
    • drm/amd/display: Fix CRC open failure during active rendering
    • PCI: intel-gw: Enable clock before PHY init
    • hfsplus: rework hfsplus_readdir() logic
    • drm/gud: Add RCade Display Adapter VID/PID pair
    • media: video-i2c: use vb2_video_unregister_device on driver removal
    • net: dsa: realtek: rtl8365mb: add support for RTL8367SB
    • integrity: Check for NULL returned by asymmetric_key_public_key
    • clk: samsung: exynos850: mark APM I3C clocks as critical
    • scsi: pm8001: Reject firmware update in fatal error state
    • scsi: pm8001: Reject non-fatal dump when controller is crashed
    • crypto: ecc - Unbreak the build on arm with CONFIG_KASAN_STACK=y
    • crypto: atmel-ecc - add support for atecc608b
    • media: imon: Add iMON VFD HID OEM v1.2 key mappings
    • RDMA/mlx5: Use QP port when decoding responder CQEs
    • mailbox: Make mbox_send_message() return error code when tx fails
    • PCI: Wait for device readiness after D3hot -> D0uninitialized transition
    • drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (CVE-2026-97497)
    • drm/amdkfd: Check bounds on allocate_doorbell (CVE-2026-97495)
    • ALSA: usx2y: Drain pending US-428 pipe-4 output commands
    • 9p: invalidate readdir buffer on seek
    • [arm64] daifflags: Make local_daif_*() helpers __always_inline
    • 9p: use kvzalloc for readdir buffer
    • [arm64] firmware: arm_scmi: Validate SENSOR_UPDATE payload size
    • [arm64] firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
    • wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed (CVE-2026-97492)
    • bitfield: wire __bf_shf to __builtin_ctzll
    • nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl
    • net: usb: qmi_wwan: add MeiG SRM813Q
    • net: bridge: remove stale rcu_barrier() in br_multicast_dev_del()
    • net/sched: sch_drr: make cl->quantum lockless
    • net/rds: Don't sleep inside rds_ib_conn_path_shutdown (CVE-2026-97491)
    • befs: handle set_blocksize failures
    • affs: handle set_blocksize failures (CVE-2026-97490)
    • bfs: handle set_blocksize failures (CVE-2026-97489)
    • minix: handle set_blocksize failures
    • qnx4: handle set_blocksize failures (CVE-2026-97488)
    • jfs: handle set_blocksize failures (CVE-2026-97487)
    • hpfs: handle set_blocksize failures (CVE-2026-97486)
    • omfs: handle set_blocksize failures (CVE-2026-97485)
    • isofs: handle set_blocksize failures
    • HID: bpf: Add Huion Inspiroy Frego M button quirk
    • usbip: vhci_hcd: fix NULL deref in status_show_vhci (CVE-2026-97484)
    • usb: core: hcd: fix possible deadlock in rh control transfers (CVE-2026-97483)
    • usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log (CVE-2026-97482)
    • USB: cdc-acm: start bulk-IN polling when ALWAYS_POLL_CTRL is set
    • usb: gadget: aspeed_udc: avoid past-the-end iterator in dequeue
    • serial: 8250: fix possible ISR soft lockup (CVE-2026-97481)
    • usb: host: add ARCH_AIROHA in XHCI MTK dependency
    • char/nvram: Remove redundant nvram_mutex
    • wifi: rtw89: pci: enable LTR based on pcie control register
    • netlabel: fix IPv6 unlabeled address add error handling
    • rds: filter RDS_INFO_* getsockopt by caller's netns (CVE-2026-97476)
    • rds: annotate data-race around rs_seen_congestion
    • clk: socfpga: agilex: implement l3_main_free_clk
    • thermal/drivers/tegra/soctherma: Switch to devm cooling device registration (CVE-2026-97475)
    • drm/panel: simple: Add AM-1280800W8TZQW-T00H
    • iio: adc: qcom-spmi-iadc: balance enable_irq_wake() on driver unbind
    • irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed
    • ALSA: usb-audio: Add quirk for Novation Mininova
    • net: hsr: require valid EOT supervision TLV
    • ipv6: addrconf: fix temp address generation after prefix deprecation (CVE-2026-97472)
    • net: thunderx: fix PTP device ref leak in nicvf_probe()
    • drm/amd/pm/si: Fix updating clock limits from power states
    • ACPICA: Fix condition check in acpi_ps_parse_loop() (CVE-2026-97456)
    • ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() (CVE-2026-97455)
    • ACPICA: add boundary checks in acpi_ps_get_next_field() (CVE-2026-97454)
    • ACPICA: validate byte_count in acpi_ps_get_next_package_length() (CVE-2026-97453)
    • ACPICA: Prevent adding invalid references (CVE-2026-97452)
    • ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op) (CVE-2026-97451)
    • ACPICA: Improve argument parsing in acpi_ps_get_next_simple_arg()
    • ACPICA: validate handler object type in two places (CVE-2026-97450)
    • ACPICA: Add package limit checks in parser functions (CVE-2026-97449)
    • ACPICA: Add validation for node in acpi_ns_build_normalized_path() (CVE-2026-97448)
    • ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()
    • ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package() (CVE-2026-97446)
    • ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources() (CVE-2026-97445)
    • ACPICA: add boundary checks in two places (CVE-2026-97444)
    • hfs: rework hfsplus_readdir() logic
    • pinctrl: renesas: rzv2m: Use -ENOTSUPP instead of -EOPNOTSUPP
    • [arm64,armhf] host1x: bus: Fix missing ops null check in error teardown
    • scripts: modpost: detect and report truncated buf_printf() output
    • [x86] ASoC: Intel: catpt: Complete coredump handling
    • libbpf: Add __NR_bpf definition for LoongArch
    • soundwire: dmi-quirks: Disable ghost Realtek devices
    • soundwire: only handle alert events when the peripheral is attached
    • mmc: davinci: fix mmc_add_host order in probe
    • [arm64] mmc: renesas_sdhi: Add OF entry for RZ/G2N SoC
    • tracing: Disable KCOV instrumentation for trace_irqsoff.o
    • [arm64] mmc: renesas_sdhi: Add OF entry for RZ/G2E SoC
    • iio: light: stk3310: Deal with the ps interrupt issue in PM
    • perf/ftrace: Fix WARNING in __unregister_ftrace_function
    • iio: accel: mma8452: switch to non-devm request_threaded_irq()
    • libbpf: Also reset {insn,data}_cur on realloc failure
    • net: ibm: emac: Reserve VLAN header in MJS limit
    • wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi (CVE-2026-97442)
    • ASoC: qcom: q6apm: return error code to consumers on failures
    • ASoC: codecs: pcm3168a: Drop CONFIG_PM-conditional preproc directive
    • ata: ahci: fail probe if BAR too small for claimed ports (CVE-2026-97441)
    • ACPI: PCI: Clear _DEP dependencies after PCI root bridge attach
    • net: qrtr: fix node refcount leak on ctrl packet alloc failure (CVE-2026-97440)
    • net: wwan: t7xx: Add delay between MD and SAP suspend
    • [arm64,armhf] iommu/rockchip: disable fetch dte time limit
    • fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib (CVE-2026-97439)
    • fs/ntfs3: validate index entry key bounds (CVE-2026-97438)
    • ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e() (CVE-2026-97437)
    • ASoC: codecs: rk3328: Use managed GPIO and clock helpers
    • ALSA: seq: oss: Reject reads that cannot fit the next event
    • dpaa2-switch: rework FDB management on the bridge leave path (CVE-2026-97436)
    • dpaa2-switch: fix the error path in dpaa2_switch_rx()
    • net: dsa: sja1105: flower: reject cross-chip redirect (CVE-2026-97435)
    • dpaa2-switch: fix handling of NAPI on the remove path (CVE-2026-97434)
    • xhci: Prevent queuing new commands if xhci is inaccessible (CVE-2026-97430)
    • drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (CVE-2026-97427)
    • RDMA/irdma: Fix typo in SQ completions generation
    • clk: keystone: don't cache clock rate
    • ALSA: hda/realtek: Add quirk for ASUS VivoBook X509DAP
    • ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
    • wifi: nl80211: Increase ie_len size to prevent truncated IEs in new peer notifications
    • RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() (CVE-2026-97421)
    • RDMA/mlx5: Fix state and counter desync on loopback enable failure
    • bpf: NUL-terminate replaced sysctl value (CVE-2026-97420)
    • net: cpsw_new: unregister devlink on port registration failure
    • hsr: broadcast netlink notifications in the device's net namespace (CVE-2026-97419)
    • ALSA: es18xx: check control allocation before private data setup (CVE-2026-97418)
    • netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
    • btrfs: balance: fix potential bg lookup failure in btrfs_may_alloc_data_chunk() (CVE-2026-97416)
    • btrfs: tree-checker: validate names in ROOT_REF and ROOT_BACKREF (CVE-2026-97415)
    • NFS: fix eof updates after NFSv4.2 fallocate/zero-range
    • RDMA/rtrs-srv: Fix integer underflow in process_read and process_write (CVE-2026-97413)
    • xprtrdma: Add request-pool slack for delayed recycling
    • configfs_depend_prep(): pass configfs_dirent instead of dentry
    • net: ibm: emac: mal: fix potential system hang in mal_remove() (CVE-2026-97411)
    • [x86] platform/x86: dell-laptop: add Inspiron N5110 to touchpad LED quirk table
    • wifi: mt76: transform aspm_conf for pci_disable_link_state
    • btrfs: protect sb_write_pointer() with invalidate lock
    • hwmon: (adt7462) Add of_match_table to support devicetree
    • vdpa/ifcvf: handle dev_set_name() failure in ifcvf_vdpa_dev_add()
    • ALSA: hda/realtek: Add quirk for HP 255 15.6 inch G9 Notebook PC
    • ata: libata-pmp: add JMicron JMS562 quirk
    • [x86] platform/x86: intel-hid: Add HP ProBook x360 440 G1 to button_array_table
    • sctp: Unwind address notifier registration on failure
    • PCI: Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems
    • dmaengine: dw-axi-dmac: fix PM for system sleep and channel alloc
    • hwmon: (pmbus/lm25066) Fix PMBus coefficients for LM5064/5066/5066i
    • spi: xilinx: let transfers timeout in case of no IRQ
    • Bluetooth: btusb: Add Mercusys MA530 for Realtek RTL8761BUV
    • Bluetooth: btusb: Add support for TP-Link TL-UB250
    • Bluetooth: L2CAP: validate connectionless PSM length (CVE-2026-97408)
    • [arm64] ASoC: rockchip: rockchip_pdm: Handle runtime PM resume failures in set_fmt (CVE-2026-97407)
    • [arm64] ASoC: rockchip: rockchip_pdm: Reorder clock enable sequence
    • [arm64] ASoC: rockchip: spdif: Restore regcache cache-only mode on sync failure
    • net: stmmac: xgmac2: disable RBUE in default RX interrupt mask (CVE-2026-93830)
    • ptp: ocp: add shutdown callback
    • vsock: use sk_acceptq_is_full() helper in all transports
    • e1000e: limit endianness conversion to boundary words
    • net/sched: act_csum: don't mangle UDP tunnel GSO packets
    • i3c: mipi-i3c-hci: Tolerate i3c_master_add_i3c_dev_locked() failures in DAA
    • ALSA: hda/realtek: Add quirk for Lenovo Xiaoxin 14 GT
    • HID: hidpp: fix potential UAF in hidpp_connect_event() (CVE-2026-93826)
    • fuse: set ff->flock only on success
    • scsi: bfa: Reduce kernel stack usage in bfa_fcs_lport_fdmi_build_portattr_block()
    • gpio: pisosr: Read "ngpios" as u32
    • spi: Add NULL check for spi_get_device_id() in spi_get_device_match_data() (CVE-2026-93825)
    • ALSA: usb-audio: Add quirk flags for SC13A
    • tls: reject the combination of TLS and sockmap (CVE-2026-93824)
    • ALSA: hda/conexant: Add pin config quirk for Lenovo IdeaPad Slim 5 16AKP10
    • leds: uleds: Return -EFAULT on copy_to_user() failure
    • leds: pca9532: Don't stop blinking for non-zero brightness
    • mfd: rsmu: Add 8a34002 support
    • ALSA: usb-audio: Add quirk for YAMAHA CDS3000
    • PCI: iproc: Protect root bus removal with rescan lock (CVE-2026-93822)
    • PCI: altera: Protect root bus removal with rescan lock (CVE-2026-93821)
    • PCI: rockchip: Protect root bus removal with rescan lock (CVE-2026-93820)
    • PCI: mediatek: Protect root bus removal with rescan lock (CVE-2026-93819)
    • md/raid5: account discard IO
    • md/raid5: let stripe batch bm_seq comparison wrap-safe
    • f2fs: validate inline dentry name lengths before conversion (CVE-2026-93816)
    • rtc: aspeed: add AST2700 compatible
    • ksmbd: align SMB2 oplock break ack handling
    • ksmbd: use connection ClientGUID for lease lookup
    • ksmbd: treat unnamed DATA stream as base file
    • ksmbd: apply create security descriptor first
    • ksmbd: start file id allocation at 1
    • ksmbd: break RH leases before delete-on-close
    • PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
    • PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
    • regulator: da9121: Use subvariant ids in the I2C table
    • net: au1000: move free_irq out of the close-time spinlocked section (CVE-2026-93815)
    • blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
    • rtc: bq32000: add delay between RTC reads
    • eth: mlx5: fix macsec dependency
    • fbdev: pm2fb: unwind WC setup on probe failure
    • spi: core: Abort active target transfer on controller suspend (CVE-2026-93814)
    • btrfs: tree-checker: validate INODE_REF's namelen (CVE-2026-93813)
    • drm/arm/malidp: use clk_bulk API in runtime PM resume and suspend
    • netfilter: nf_conntrack_expect: zero at allocation time
    • ksmbd: fix sd_ndr.data memory leak in ksmbd_vfs_set_sd_xattr (CVE-2026-93812)
    • drm/arm/komeda: fix error handling for clk_prepare_enable() and callers
    • ksmbd: fix n.data memory leak in ksmbd_vfs_set_dos_attrib_xattr
    • ksmbd: Fix acl.sd_buf memory leak and invalid sd_size error handling (CVE-2026-93811)
    • xen/front-pgdir-shbuf: free grant reference head on errors
    • freevxfs: don't BUG() on unknown typed-extent type
    • xen/gntalloc: validate grant count before allocation
    • ksmbd: fix outstanding credit leak on abort and error paths
    • cachefiles: Fix double fput (CVE-2026-93810)
    • [amd64] ASoC: amd: yc: Add Alienware m15 R7 AMD to DMIC quirk table
    • ksmbd: fix credit charge calculation for SMB2 QUERY_INFO
    • ALSA: usb-audio: caiaq: validate EP1 reply lengths (CVE-2026-93808)
    • wifi: ralink: RT2X00: init EEPROM properly
    • wifi: mac80211: validate deauth frame length before reason access
    • wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers (CVE-2026-93807)
    • wifi: libertas: reject short monitor TX frames
    • wifi: cfg80211: validate assoc response length before status and IE access (CVE-2026-93806)
    • ksmbd: find bound sessions during reauthentication
    • ksmbd: mark invalid session responses as signed
    • ksmbd: validate SID namespace before mapping IDs
    • wifi: cfg80211: validate rx/tx MLME callback frame lengths before access (CVE-2026-93805)
    • gpio: dwapb: Mask interrupts at hardware initialization
    • wifi: libipw: fix key index receive bound checks (CVE-2026-93803)
    • netfilter: ipset: mark the rcu locked areas properly
    • wifi: rsi: validate beacon length before fixed buffer copy (CVE-2026-93802)
    • ALSA: hda/realtek: Fix speakers on MECHREVO WUJIE Series
    • btrfs: only account delalloc bytes for regular file inodes in btrfs_getattr()
    • btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol() (CVE-2026-93800)
    • spi: dw-dma: Wait for controller idle before completing Tx
    • btrfs: fix reloc root cleanup in merge_reloc_roots() (CVE-2026-93798)
    • wifi: iwlwifi: mvm: fix an off-by-1 boundary check (CVE-2026-93797)
    • wifi: iwlwifi: mvm: fix sched scan IE sizing
    • ALSA: hda/realtek: Add quirk for HP EliteBook 830 G8 (8AB8) to enable mute LEDs
    • blk-cgroup: fix leaks and online flag on radix_tree_insert failure (CVE-2026-93795)
    • [arm64] fixmap: Allow 256K early_ioremap() at any offset
    • [arm64] kprobes: Allow reentering kprobes while single-stepping
    • drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized
    • wifi: iwlwifi: bound aligned TLV advance in FW parser (CVE-2026-93789)
    • ALSA: usb-audio: Add FIXED_RATE quirk for JBL Quantum650 Wireless
    • wifi: iwlwifi: acpi: validate WGDS table revision index (CVE-2026-93788)
    • wifi: mwifiex: replace one-element arrays with flexible array members
    • smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787)
    • regulator: core: clamp voltage constraints before applying apply_uV
    • wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
    • drm/gma500: return errors from Oaktrail HDMI I2C reads
    • phonet: check register_netdevice_notifier() error in phonet_device_init()
    • ALSA: usb-audio: Add dB map quirk for Razer Barracuda X 2.4
    • ALSA: hda/realtek: Add mute LED quirk for HP Laptop 14s-dr1xxx
    • ice: pass the return value of skb_checksum_help()
    • [powerpc*] pseries: Ensure vpa,slb_shadow & dtl are unregistered during crash
    • cifs: validate idmap key payload length (CVE-2026-93785)
    • wifi: cfg80211: validate IEs in cfg80211_wext_siwgenie() (CVE-2026-93784)
    • Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CVE-2026-93783)
    • ALSA: usb-audio: Add quirk for Corsair Virtuoso (later revision)
    • vhost-scsi: flush backend after device ioctls (CVE-2026-93782)
    • spi: dw: fix wrong RX_SAMPLE_DLY setting after resume
    • ASoC: rt5645: Perform the initial jack detect at probe
    • scsi: core: Do not block on tag allocation in scsi_eh_lock_door() (CVE-2026-93781)
    • netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
    • firmware: stratix10-svc: fix FCS SMC call kernel-doc
    • ksmbd: remove stale channels from all sessions on teardown
    • tracing/histograms: Simplify last_cmd_set()
    • clk: at91: pmc: #undef field_{get,prep}() before definition
    • wifi: mt76: mt7921: validate CLC firmware records (CVE-2026-98159)
    • wifi: mt76: mt7921: skip unknown CLC firmware records
    • ppp_async: drop the errored frame instead of resetting its headroom (CVE-2026-98158)
    • ksmbd: validate ACE size against SID sub-authorities (CVE-2026-68097)
    • sctp: close UDP tunnel sockets during netns teardown (CVE-2026-68161)
    • drop_monitor: perform u64_stats updates under IRQ-disabled section (CVE-2026-68286)
    • drop_monitor: fix size calculations for 64-bit attributes (CVE-2026-68287)
    • net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD (CVE-2026-68288)
    • tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() (CVE-2026-68289)
    • Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CVE-2026-68391)
    • Bluetooth: ISO: fix malformed ISO_END/CONT handling (CVE-2026-72334)
    • bpf: Mask pseudo pointer values in verifier logs (CVE-2026-72402)
    • sctp: fix err_chunk memory leaks in INIT handling (CVE-2026-72413)
    • ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). (CVE-2026-74289)
    • ASoC: meson: aiu: Validate written enum values (CVE-2026-74294)
    • ksmbd: use memcmp() to compare ClientGUIDs (CVE-2026-74521)
    • af_unix: Unlink scc_entry in unix_del_edge(). (CVE-2026-80521)
    • mm/damon/core: avoid infinite kdamond_merge_regions() internal loop (CVE-2026-89796)
    • Revert "Bluetooth: btusb: Add ASUS USB-BT600 for Realtek 8761CU"
    • Revert "Bluetooth: btusb: Add ASUS USB-BT540 for Realtek 8761CU"
    • [armhf] 9484/1: enable interrupts when unhandled user faults are triggered
    • [armhf] ensure interrupts are enabled in __do_user_fault()
    • EDAC/igen6: Fix interleave boundary condition
    • EDAC/igen6: Fix channel selection hash
    • EDAC/igen6: Fix channel address decode for non-hash mode
    • EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation (CVE-2026-98157)
    • drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
    • nvme-rdma: fix -EIO cleanup order in queue_rq (CVE-2026-98154)
    • net: icmp: avoid invalid transport header access in icmp_send tracepoint
    • net/sched: act_api: budget all shared attributes in notify skbs
    • net/sched: act_api: size the RTM_GETACTION reply from the actions
    • rtnl: add helper to send if skb is not null
    • net/sched: act_api: don't open code max()
    • net/sched: act_api: conditional notification of events
    • net/sched: act_api: fix skb sizing and action leak on reoffload delete
    • sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START (CVE-2026-98130)
    • scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add() (CVE-2026-98129)
    • scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add() (CVE-2026-98128)
    • smb/client: mark file sparse before emulating insert range
    • smb: client: transport: Fix debug printing in __release_mid()
    • sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration (CVE-2026-98123)
    • raw: annotate disconnect-side IPv4 match writers
    • net: amd-xgbe: discard rx packets with bad FCS
    • watchdog: msc313e: Fix NULL pointer dereference in PM callbacks (CVE-2026-98121)
    • OPP: of: Fix potential multiplication overflow when calculating freq
    • ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CVE-2026-98116)
    • ksmbd: rate limit unmapped SID errors (CVE-2026-98113)
    • Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan (CVE-2026-98108)
    • Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM
    • Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()
    • ASoC: ab8500: Reset the audio block before configuring it
    • ASoC: ab8500: Repair the DAPM capture graph
    • ASoC: ab8500: Correct digital interface format setup
    • ASoC: ab8500: Validate and program TDM slots correctly
    • net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted (CVE-2026-98104)
    • ppp: ppp_async: simplify tty disc_data access
    • ipv6: tunnels: use DEV_STATS_INC()
    • ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit
    • tipc: fix NULL deref in tipc_named_node_up() on empty publication list (CVE-2026-98098)
    • ipv6: sr: restore network header before routing and forwarding (CVE-2026-98096)
    • af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header(). (CVE-2026-98095)
    • staging: fbtft: make dirty_lock IRQ-safe (CVE-2026-98094)
    • [amd64] ASoC: amd: renoir: fix disable_pdm_interrupts() to clear mask bits
    • [amd64] ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close() (CVE-2026-98092)
    • btrfs: detach failed sprout device from transaction update list (CVE-2026-98091)
    • btrfs: restore active device pointers after failed sprout (CVE-2026-98090)
    • bonding: alb: fix uninitialized transport header access in alb_determine_nd() (CVE-2026-98089)
    • scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues() (CVE-2026-98088)
    • perf/core: Skip empty AUX records with only format flags
    • locking/lockdep: Introduce lock_sync()
    • locking/lockdep: Improve the deadlock scenario print for sync and read lock
    • lockdep: Add lock_set_cmp_fn() annotation
    • locking/lockdep: Invalidate stale class_cache entries for zapped classes
    • ASoC: ux500: Fix MSP stream lifecycle handling
    • ASoC: ux500: remove platform_data support
    • ASoC: ux500: Propagate MSP setup errors
    • ASoC: ux500: Correct MSP frame and bit clock setup
    • ASoC: ux500: Validate MSP DAI configuration
    • mfd: db8500-prcmu: Remove unused inline functions
    • mfd: db8500-prcmu: Remove needless return in three void APIs
    • arm: Handle KCOV __init vs inline mismatches
    • mfd: db8500-prcmu: Fold dbx500 header into db8500
    • ASoC: ux500: remove stedma40 references
    • ASoC: ux500: Request the MSP MMIO resource
    • ASoC: ux500: Program the MSP FIFO watermarks
    • btrfs: do not force reloc root creation during qgroup_account_snapshot() (CVE-2026-98080)
    • ipvs: fix reversed sequence option serialization (CVE-2026-98078)
    • netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() (CVE-2026-98077)
    • tracing/probes: Fix use-after-free on field name/type of events with multiple probes (CVE-2026-98076)
    • bpf: reject BPF_PSEUDO_FUNC reference to the main program (CVE-2026-98075)
    • bonding: do not clear curr_active_slave prematurely when releasing all slaves (CVE-2026-98074)
    • net/rds: use wq_has_sleeper() in release_in_xmit() (CVE-2026-98072)
    • net/rds: use clear_bit_unlock() in release_refill()
    • net/rds: clear cp_flags bits individually in rds_conn_path_reset() (CVE-2026-98071)
    • net/rds: tcp: don't force RDS_CONN_RESETTING over a concurrent shutdown
    • net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks() (CVE-2026-98070)
    • net/rds: acquire the fastpath locks in rds_conn_shutdown() (CVE-2026-98069)
    • net/rds: don't let rds_conn_shutdown() consume a concurrent drop (CVE-2026-98068)
    • net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset
    • ALSA: caiaq: Fix potential double-free at error path (CVE-2026-98066)
    • bpf: Fix NULL-ptr-deref when showing a void BTF type (CVE-2026-98064)
    • bpf: Fix NULL-ptr-deref in btf_var_show() (CVE-2026-98063)
    • ALSA/ASoC: hda: ext: add 'ext' prefix to snd_hdac_link_free_all
    • ASoC: Intel: avs: Clean up the bus when fetching ML caps fails (CVE-2026-98055)
    • bpf: Introduce might_sleep field in bpf_func_proto
    • bpf: Mark bpf_btf_find_by_name_kind() as sleepable (CVE-2026-98046)
    • nexthop: Initialize extack in remove_nh_grp_entry() (CVE-2026-98031)
    • bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()
    • net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size (CVE-2026-98030)
    • net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size (CVE-2026-98027)
    • octeontx2-af: mcs: Clear stale X2P calibration state before calibration
    • net: usb: cx82310_eth: drop URB after 0xffff reboot sentinel to prevent partial_data heap overflow (CVE-2026-98025)
    • vxlan: reject dynamic fdb entries that reference a nexthop id (CVE-2026-98023)
    • net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations (CVE-2026-98022)
    • [powerpc*] kexec_file: Use inclusive range checks in add_usable_mem()
    • net/sched: defer qdisc freeing after failed creation (CVE-2026-98017)
    • net/mlx5e: Fix setting RS FEC after remapping
    • net/mlx5e: Fix ETS zero BW reporting when one TC holds 100%
    • net/mlx5e: Fix use-after-free race in sample_restore_put() (CVE-2026-98016)
    • net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put (CVE-2026-98015)
    • net/mlx5: E-Switch, prevent mc_list repopulation during vport disable (CVE-2026-98014)
    • net_sched: sch_fq_pie: implement lockless fq_pie_dump()
    • net/sched: fq_pie: clamp quantum in change path (CVE-2026-98013)
    • net/sched: sfq: clamp quantum in change path (CVE-2026-98012)
    • net/sched: hhf: clamp quantum in change and init paths (CVE-2026-98011)
    • net/sched: pie: clamp psched_mtu in pie_drop_early
    • net/sched: drr: clamp quantum in change class (CVE-2026-98010)
    • net/sched: ets: clamp quantum in parse and fallback paths (CVE-2026-98009)
    • workqueue: Introduce from_work() helper for cleaner callback declarations
    • net: macb: rename bp->sgmii_phy field to bp->phy
    • net: macb: fix NULL pointer dereference on unbind with fixed-link (CVE-2026-98008)
    • ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev (CVE-2026-98006)
    • ASoC: bcm: bcm63xx: Publish the OF module aliases
    • [x86] ASoC: Intel: SST: Publish the PCI module aliases
    • netfilter: nfnetlink_log: cope with concurrent instance destruction (CVE-2026-97998)
    • netfilter: ip6_tables: set F_PROTO when proto value is nonzero
    • ASoC: mt6351: Publish the OF module alias
    • virtio-console: call scheduler when we free unused buffs
    • virtio_console: do not free control-out buffers on remove (CVE-2026-97995)
    • vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx (CVE-2026-97993)
    • vdpa_sim_blk: reject out-of-range sector starts (CVE-2026-97991)
    • virtio-pci: return IRQ_HANDLED after non-zero ISR
    • virtio_input: reset device if input_register_device() fails (CVE-2026-97987)
    • virtio_input: stop callbacks before unregistering input device (CVE-2026-97986)
    • net: ipv6: Clamp to IP6_MAX_MTU in ip6_dst_mtu_maybe_forward
    • net: ethernet: cortina: Fix budget accounting (CVE-2026-97982)
    • net: ethernet: cortina: Finish RX updates before NAPI completion
    • net: ethernet: cortina: Count dropped frames as NAPI work (CVE-2026-97981)
    • net: ethernet: cortina: No mapping is a dropped rx
    • net: ethernet: cortina: Count RX drops once per frame
    • net: ethernet: cortina: Count RX descriptors for freeq refill
    • drm/logicvc: Drop the select of the nonexistent CONFIG_DRM_KMS_DMA_HELPER
    • ALSA: hda: Introduce auto cleanup macros for PM
    • ALSA: hda/common: Use cleanup macros for PM controls
    • ALSA: hda/common: Use guard() for mutex locks
    • ALSA: hda: Report a change when only the channel status bytes move
    • ice: add missing xa_destroy for sched_node_ids (CVE-2026-97979)
    • Bluetooth: btusb: Fix UAF of btusb_data by rx_work (CVE-2026-97977)
    • net: macb: destroy the phylink instance on the probe error path (CVE-2026-97973)
    • watchdog: fix hrtimer start when pretimeout is zero
    • watchdog: msc313e: Avoid division by zero (CVE-2026-97970)
    • watchdog: msc313e: Fix clock leak and spurious timer in settimeout() (CVE-2026-97969)
    • watchdog: msc313e: Enable clock before accessing hardware registers
    • watchdog: msc313e: Fix spurious reset on suspend
    • watchdog: msc313e: Fix undefined behavior
    • watchdog: msc313e: Sync timeout value if WDT was running at boot
    • net/micrel: Fix typos in micrel driver code comments
    • net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down
    • hwmon: (gpio-fan) take fan_data->lock in gpio_fan_shutdown()
    • hwmon: (aspeed-pwm-tacho) Propagate reset deassert errors
    • ppp_synctty: ensure a writeable skb header (CVE-2026-97964)
    • net: stmmac: initialize ptp_lock at probe time (CVE-2026-97963)
    • net/sched: cls_route: free emptied bucket on filter move (CVE-2026-97959)
    • net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain(). (CVE-2026-97958)
    • net: sun4i-emac: fix missing of_node_put() for phy_node
    • net: hinic: fix mailbox segment buffer overflow (CVE-2026-97957)
    • octeontx2-af: fix PF/CGX debugfs PCI bus lookup
    • net/rds: fix tcp stream corruption with large pages (CVE-2026-97954)
    • openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()
    • sunvdc: unmap LDC cookies when the descriptor send fails (CVE-2026-97952)
    • drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
    • scsi: target: iscsi: Handle abort for WRITE_PENDING cmds
    • scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands (CVE-2026-97951)
    • ksmbd: prevent out-of-bounds reads in share config responses (CVE-2026-89792)
    • net: dst: add four helpers to annotate data-races around dst->dev
    • ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
    • net: dst: introduce dst->dev_rcu
    • ipv4: start using dst_dev_rcu() (CVE-2025-40074)
    • [powerpc*] eeh: Fix recursive locking on devices without EEH sensitive driver (CVE-2026-97948)
    • ipv6: fix fib6 walker UAF on seq stop (CVE-2026-97940)
    • ALSA: ctxfi: Fix CA20K2 S/PDIF passthrough
    • ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf (CVE-2026-97930)
    • dm/amdgpu: fix malformed link_settings debugfs output
    • watchdog: sunxi_wdt: preserve boot-enabled watchdog
    • ufs: create the root dentry after loading cylinder metadata (CVE-2026-97927)
    • ufs: validate cylinder group metadata before caching it (CVE-2026-97926)
    • tunnels: Drop stale dst when building an ICMP error for PMTUD (Closes: #1108860)
    • tick/broadcast: Plug clockevents replacement race (CVE-2026-97925)
    • tracing: Free histogram the var ref when its initialization fails (CVE-2026-97923)
    • tracing: Free histogram var refs regardless of how often they are referenced (CVE-2026-97922)
    • tracing: Free histogram the field rejected for a bad modifier (CVE-2026-97921)
    • tracing: Let histogram values keep the percent and graph modifiers
    • tracing: Keep the entry count when the histogram stats allocation fails (CVE-2026-97920)
    • ASoC: sprd: validate compress buffer sizes against fixed allocations (CVE-2026-97910)
    • ASoC: sti: initialize IRQ lock before requesting IRQ (CVE-2026-97909)
    • cpufreq: zero-initialize policy cpumask before sysfs publication (CVE-2026-97905)
    • cpufreq: initialize policy rwsem before sysfs publication (CVE-2026-97904)
    • exec: do_close_on_exec() before taking exec_update_lock
    • [x86] drm/i915: Fix memory leak in query_perf_config_list() (CVE-2026-97899)
    • ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
    • net: hso: fix TIOCMIWAIT race
    • net: mpls: clear inner_protocol when the last label is popped (CVE-2026-97612)
    • net: openvswitch: fix use-after-free of the flow table mask array (CVE-2026-97611)
    • netfilter: nf_log: unregister loggers before per-net teardown (CVE-2026-97608)
    • netfilter: report NLM_F_DUMP_FILTERED when all is filtered out
    • fbdev: vfb: defer cleanup until the last reference (CVE-2026-97604)
    • ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink (CVE-2026-97601)
    • ipv4: fib: bound automatic table ID allocation (CVE-2026-97598)
    • ipvs: reject invalid states in connection template sync records (CVE-2026-97596)
    • [powerpc*] KVM: PPC: Book3S HV: Set irqfd->producer only on success
    • hwmon: (applesmc) fix key backlight workqueue leak on register failure
    • hwmon: (gpio-fan) Fix use-after-free in alarm work (CVE-2026-97582)
    • hwmon: (pmbus) Clear generic status alarms with CLEAR_FAULTS
    • media: hevc: add bounded tile-count helpers
    • media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity (CVE-2026-97581)
    • media: v4l2-h264: Fix memcmp() size in B1 reference list comparison
    • media: v4l2-ctrls: validate HEVC tile counts (CVE-2026-97576)
    • bnxt_en: Only restore LRO if the device supports TPA
    • bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset() (CVE-2026-97573)
    • bnxt_en: Propagate RX ring init failures in bnxt_init_nic() (CVE-2026-97572)
    • mptcp: options: handle MPC data + csum reqd + no csum
    • mptcp: subflow: no need to copy thmac during ulp_clone
    • mptcp: syncookies: remember the request backup flag (CVE-2026-97568)
    • smb: client: reject userspace cifs.idmap descriptions (CVE-2026-97564)
    • smb: client: avoid leaking refcount in cifs_queue_oplock_break() (CVE-2026-97557)
    • smb: client: avoid leaking refcount when cifs_sb_tlink() fails (CVE-2026-97556)
    • bpftool: remove duplicate free_btf_vmlinux() definition
    • Revert "arm64: dts: qcom: sm8550: Fix the PCIe iommu-map entries"
    • Revert "arm64: dts: qcom: sm8450: Fix the PCIe iommu-map entries"
    • Revert "arm64: dts: qcom: sm8350: Fix the PCIe iommu-map entries"
    • Revert "arm64: dts: qcom: sm8250: Fix the PCIe iommu-map entries"
    • Revert "arm64: dts: qcom: sm8150: Fix the PCIe iommu-map entries"
    • Revert "arm64: dts: qcom: sdm845: Fix the PCIe iommu-map entries"
    • ipv6: mcast: extend RCU protection in igmp6_send() (CVE-2025-21759)
    • Revert "nvme-apple: Reset q->sq_tail during queue init"
    • Revert "nvme-apple: Prevent shared tags across queues on Apple A11"
    • Revert "nvme-apple: Drop the PRP null check chicken bit"
    • Revert "nvme: apple: Add Apple A11 support"
    • Revert "perf tests: Fix flakiness in BPF counters test on hybrid systems"
    • usb: xusbatm: don't rely on id table pointer arithmetic (CVE-2026-97539)
    • wifi: ath9k_htc: don't store usb_device_id (CVE-2026-97541)
    • usb: usbtmc: don't store usb_device_id
    • media: as102: do not rely on id table address comparison
    • net: usb: pegasus: don't rely on id table pointer arithmetic (CVE-2026-97540)
    • ALSA: us122l: Prevent write upgrades for read mappings (CVE-2026-97931)
    • i2c: smbus: reject oversized block transfers in the common path (CVE-2026-93287)
    • net: appletalk: fix NULL pointer dereference in aarp_send_ddp() (CVE-2026-93286)
    • fou: Fix use-after-free in fou_create() (CVE-2026-74496)
    • crypto: sun8i-ce - Remove crypto_rng interface (CVE-2026-80834)
    • crypto: sun8i-ss - Remove crypto_rng interface (CVE-2026-80833)
    • netfilter: nft_set_pipapo_avx2: add missing vzeroupper
    • mptcp: consolidate subflow cleanup
    • mptcp: avoid unneeded actions on subflow reset (CVE-2026-97524)
    • mptcp: close race between scheduler and state change (CVE-2026-97523)
    • landlock: Fix handling of disconnected directories (CVE-2025-68736)
    • net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (CVE-2024-49568)
    • sunvdc: fix -EIO issue due to lack of retries
    • Revert "perf cs-etm: Avoid truncating AUX buffer sizes to int"
    • Revert "perf cs-etm: Flush thread stacks after decoder reset"
    • media: video-i2c: fix buffer queue ordering
    • ipv6: Select best matching nexthop object in fib6_table_lookup()
    • ipv6: Honor oif when choosing nexthop for locally generated traffic
    • xfrm: avoid RCU warnings around the per-netns netlink socket
    • xfrm: fix compat ALLOCSPI request use-after-free
    • xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
    • esp: downgrade zerocopy managed frags before mutating skb frags
    • ARM: socfpga: select the PL310 erratum 753970 workaround
    • RDMA/siw: Introduce siw_cep_set_free_and_put
    • RDMA/siw: Cleanup siw_accept
    • RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept
    • [arm64] firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
    • clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
    • RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeeds
    • net: devlink: convert devlink port type-specific pointers to union
    • net: devlink: move port_type_warn_schedule() call to __devlink_port_type_set()
    • net: devlink: move port_type_netdev_checks() call to __devlink_port_type_set()
    • net: devlink: take RTNL in port_fill() function only if it is not held
    • net: convert dev->reg_state to u8
    • RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
    • IB/iser: reject a remote invalidation of an unregistered direction
    • IB/isert: wait for deferred control PDU completions before releasing the connection
    • RDMA/mad: Fix receive buffer leak when PKey enforcement fails
    • RDMA/irdma: Enforce local fence for IB_WR_REG_MR
    • RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted
    • dmaengine: sprd: Fix runtime PM reference leak in probe
    • wifi: virt_wifi: free skb when disconnected
    • wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path
    • wifi: libipw: reject too-short beacon and probe responses
    • wifi: libipw: reject too-short association responses
    • IB/IPoIB: Avoid restoring OPER_UP after multicast flush
    • wifi: cfg80211: check IP header size in cfg80211_classify8021d()
    • soundwire: cadence_master: wait and cancel cdns->work before clock stop
    • dma-coherent: Warn if OF reserved memory is beyond current coherent DMA mask
    • dma-coherent: report a failed reserved memory assignment
    • dmaengine: Fix device kref underflow in dma_chan_put()
    • dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()
    • dmaengine: wait for RCU readers before releasing dma_device
    • wifi: cfg80211: only group hidden BSSes with beacon entries
    • wifi: cfg80211: don't filter by BSS type when removing stale entries
    • wifi: mac80211: suppress chanctx warning for debugfs reset
    • wifi: mac80211: unlist vifs when their netdev is unregistered
    • wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping
    • wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown
    • wifi: cfg80211: trace: remove MAC_PR_{FMT,ARG}
    • wifi: cfg80211: make TDLS management link-aware
    • wifi: mac80211: handle TDLS negotiation with MLO
    • wifi: mac80211: require a peer station for TDLS setup confirm
    • wifi: mac80211: don't allow link changes when iface is down
    • wifi: mac80211: don't RCU-dereference the mesh CSA settings we just set
    • wifi: mac80211: don't access the TSF of a down interface
    • wifi: mac80211: add HE 6 GHz capability in the scan elems len
    • wifi: mac80211: mesh: release the channel if start fails
    • wifi: mac80211: rework ack_frame_id handling a bit
    • wifi: mac80211: set up the TX info early to fix failure paths
    • scsi: qla2xxx: Fix the ql2xfc2target parameter description
    • dmaengine: xilinx_dma: Fix hardware buffer descriptor reuse order
    • dmaengine: xilinx_dma: Fix hardware buffer descriptor chain after cyclic DMA
    • RDMA/efa: Keep admin queues alive while IRQ is registered
    • RDMA/efa: Keep EQ resources alive while IRQ is registered
    • RDMA/siw: Bound fragmented header copies by the remaining length
    • netfilter: nft_nat: fully initialise new_addr in netmap setup
    • netfilter: flowtable: hold reference on ct until flow is released
    • perf/arm-cmn: Fix wp_dev_sel2 setting for multi-DTM configurations
    • drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr
    • keys: fix lost wakeup when reaping a dead key type
    • ALSA: bcd2000: Fix race between rawmidi and disconnect
    • ALSA: pcm: set timer->private_data before registering the PCM timer
    • Input: trackpoint - fix the inertia attribute name in the ABI document
    • ALSA: 6fire: Clean ups with guard()
    • ALSA: usb: 6fire: Avoid embedded URBs
    • ALSA: 6fire: fix OOB write from device-reported iso length
    • wifi: virt_wifi: don't transfer operstate before register
    • drm/atomic-helper: Add atomic_enable plane-helper callback
    • drm/ast: Remove little-endianism from I/O helpers
    • drm/ast: Rework definition of I/O read and write helpers
    • ALSA: hda: trace PCM open only after assigning a stream
    • btrfs: tree-checker: print dev extent offset in error message
    • drm/msm/dsi: correct byte intf clock rate for 14nm DSI PHY
    • drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL
    • seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation
    • ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup
    • net: fddi: skfp: fix NULL deref when setting the MAC address while down
    • wifi: brcmfmac: fix lost 802.1x TX completion wakeup
    • net: bridge: mst: move switchdev call outside rcu
    • tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().
    • tcp: do not let tcp_rmem be set below 4096
    • dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()
    • Bluetooth: btmtksdio: Fix PM runtime reference leak in shutdown
    • Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup
    • pppoatm: ensure a writable skb header and linear data
    • drop_monitor: synchronize tracepoint unregistration on error path
    • drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
    • [powerpc*] KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()
    • [powerpc*] KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure
    • [powerpc*] iommu: Fix the overflow validation in iommu_tce_check_ioba
    • ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments
    • ASoC: hdmi-codec: Report a change when the channel status moves
    • net: netsec: fix device_node reference leak on phy_np
    • net: lock the socket in sock_gettstamp()
    • net: ethernet: cortina: Ack RX overrun interrupt correctly
    • net: macb: fix ordering around PTP timestamp read
    • net: mvpp2: prevent buffer overflow in page_pool allocation
    • accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release() (CVE-2023-53353)
    • sched/fair: Move is_core_idle() out of CONFIG_NUMA
    • sched/fair: Reject misfit pulls onto busy SMT siblings on asym-capacity
    • Input: xpad - add support for Victrix Pro BFG Controller
    • Input: xpad - add support for Azeron devices
    • Input: xpad - fix PDP Marvel Xbox 360 controller
    • ALSA: virtio: reset device before deleting virtqueues
    • ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY
    • rds: ib: use rds_conn_drop() on protocol version mismatch
    • tcp: exclude old ACKs from tcp fast path
    • RDMA/ucma: Serialize join and leave on copy_to_user failure
    • RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()
    • openvswitch: avoid reallocating confirmed conntrack labels
    • net: xfrm: reject unrepresentable espintcp transport headers
    • [arm64] hibernate: pass HVC_SET_VECTORS args to the resume hvc
    • [arm64] dts: renesas: r8a779f0: Set UFS lane count
    • [arm64] percpu: Fix this_cpu_write() casting
    • [arm64] percpu: Fix this_cpu_and() mask generation
    • Bluetooth: btusb: fix NXP IW610 composite device handling
    • Bluetooth: eir: validate service data length before reading UUID
    • Bluetooth: hci_codec: validate vendor codec count length
    • Bluetooth: hci_sync: Serialize local codec list cleanup
    • dmaengine: sun6i: fix non-atomic read of DMA position registers
    • dmaengine: sun6i: fix undefined behaviour in sun6i_dma_tx_status
    • dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()
    • ipv6: xfrm: use full sockets in local error paths
    • net: lan743x: fix RX checksum use-after-free
    • net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain
    • net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value
    • net/sched: hhf: cap hh_flows_limit at change time
    • net/packet: clear RX owner on VNET header error
    • net/packet: avoid truncating TPACKET_V3 private size
    • memstick: ms_block: destroy io_queue workqueue on removal
    • keys: translate request_key_auth pid for the reading procfs instance
    • KEYS: trusted: Fix tpm2_load_cmd() boundary check
    • i2c: at91: release DMA channels on remove and probe error
    • i2c: imx: release DMA channels on probe error
    • IB/mlx4: Fix use-after-free on pkey sysfs registration failure
    • selinux: always fill AVC decision in avc_has_perm_noaudit()
    • mmc: core: Cancel SDIO IRQ work before freeing host
    • mmc: core: Fix OF node reference leak on card add failure
    • mmc: mxcmmc: cancel data work and watchdog on remove
    • mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260
    • mmc: sdhci-of-aspeed: Remove children before releasing SDC resources
    • mmc: sdio_uart: fix xmit_fifo leak when the port table is full
    • mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt
    • mmc: spi: reset bytes_xfered before retrying CRC failures
    • mmc: sdhci_am654: Reset command and data lines on failed tuning
    • Input: adp5588-keys - cache GPIO state before registering the gpiochip
    • Input: atkbd - skip deactivate for Xiaomi Redmi Book Pro 16 2026
    • Input: evdev - zero absinfo before partial copy in EVIOCSABS
    • Input: i8042 - add quirk for Acer Aspire Go 15 AG15-42P
    • Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()
    • Input: soc_button_array - fix MS Surface Pro 11 probe failure
    • Input: soc_button_array - check btns_desc->package.count
    • Input: synaptics - disable InterTouch on ThinkPad T440p (board id 2722)
    • Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound
    • Input: zero ff_effect before compat copy in input_ff_effect_from_user
    • hwmon: (pmbus/core) increase number of phases and add new mask
    • hwmon: (pmbus/tps53679) Fix TPS53676 phase page decoding
    • hwmon: (pmbus/tps53679) Select page 0 for single-page TPS53676
    • hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove
    • hwmon: (w83793) release probe data through kref
    • watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog
    • watchdog: digicolor: Avoid division by zero
    • watchdog: msc313e: Fix premature reset during timeout update
    • watchdog: msc313e: Propagate error code in resume()
    • watchdog: sp5100_tco: Fix pci_dev reference leak in sp5100_tco_init()
    • wifi: brcmsmac: fix UAF in brcms_free_timer()
    • wifi: iwlegacy: fix broadcast stations deallocation
    • wifi: libertas_tf: fix UAF in lbtf_free_adapter()
    • wifi: rsi: fix heap OOB write on key removal
    • wifi: wlcore: release runtime PM ref on regdomain config failure
    • wifi: wilc1000: fix out-of-bounds read in P2P public action frames
    • wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()
    • wifi: p54: validate curve data length in the calibration curve converters
    • wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST
    • wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
    • wifi: mwifiex: validate scan response extents
    • wifi: mwifiex: validate action frame fixed fields
    • wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver
    • drm/gud: fix out-of-bounds write in gud_plane_atomic_check()
    • drm/msm/adreno: fix autosuspend cleanup during teardown
    • drm/msm/hdmi_phy: fix runtime PM cleanup on probe failure
    • smb: client: reject short Next offsets in parse_server_interfaces()
    • smb: client: fix smbd_connection leak on cifs_get_tcp_session() error
    • smb: client: fix next_buffer UAF and NextCommand bounds in compound PDUs
    • smb: client: fix potential OOB read in smb3_enum_snapshots()
    • smb: client: fix server->total_read for compound encrypted PDUs
    • smb: client: fix missing lower-bound check on DFS referral string offsets
    • ASoC: SOF: avoid a NULL dereference with unsupported widgets (CVE-2023-54233)
    • ASoC: SOF: ipc4-topology: Clarify bind failure caused by missing fw_module
    • HID: logitech-hidpp: fix race condition when accessing stale stack pointer
    • blk-mq: fix tags leak when shrink nr_hw_queues (CVE-2023-54227)
    • blk-mq: fix tags UAF when shrinking q->nr_hw_queues
    • Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync (CVE-2023-53762)
    • Bluetooth: hci_sync: always check if connection is alive before deleting
    • btrfs: don't check PageError in __extent_writepage (CVE-2023-53429)
    • io_uring/io-wq: Fix memory leak in io_wq_create() on success path
    • spi: spi-zynqmp-gqspi: stop the controller on shutdown
    • bpf: bpf_sk_storage: Fix invalid wait context lockdep report (CVE-2023-53857)
    • drm/msm/dp: Drop aux devices together with DP controller (CVE-2023-53851)
    • erofs: Fix detection of atomic context (CVE-2023-53231)
    • erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC
    • spi: zynqmp-gqspi: Use devm_spi_alloc_host()
    • bpf: bpf_sk_storage: Fix the missing uncharge in sk_omem_alloc
    • HID: hyperv: streamline driver probe to avoid devres issues (CVE-2024-56545)
    • start_kernel: Add __no_stack_protector function attribute (CVE-2023-53491)
    • media: ipu-bridge: Fix null pointer deref on SSDB/PLD parsing warnings (CVE-2023-53336)
    • net/mlx5e: TC, Fix internal port memory leak (CVE-2023-53999)
    • wifi: rtw88: delete timer and free skb queue when unloading (CVE-2023-53574)
    • btrfs: insert tree mod log move in push_node_left (CVE-2023-53538)
    • scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list (CVE-2023-53627)
    • bpf: Fix bpf_skb_change_tail wrt csum partial skbs
    • bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL
    • bpf: support access variable length array of integer type
    • bpf: Fix divide-by-zero in btf_struct_walk()
    • HID: elecom: fix bus type for M-XGL20DLBK
    • bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()
    • bpf: Fix out-of-bounds read of rtt_min in sock_ops
    • bpf, sockmap: Fix self-redirect copied_seq double-counting
    • pinctrl: meson: Fix typo in s4 group name
    • HID: amd_sfh: Validate PCI BAR size before mapping
    • squashfs: Add dictionary size range check to prevent shift-out-of-bounds
    • Bluetooth: SMP: reject Security Request over BR/EDR
    • Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel
    • scsi: megaraid_sas: Protect megasas_get_ctrl_info() in megasas_resume()
    • Documentation: s390: correct spelling
    • docs: s390/pci: Improve and update PCI documentation
    • xsk: Use a 32-bit compare in xsk_map_gen_lookup
    • bpf: Skip unsettled links in link iterator
    • net/sched: cls_u32: fix manual hash table handle IDR aliasing
    • bpf: Restrict CO-RE poisoning to relocatable instructions
    • libbpf: Reject truncated ldimm64 CO-RE relocations
    • netfilter: flowtable: publish HW_DEAD after worker is done
    • netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation
    • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
    • netfilter: nft_synproxy: use the family-aware checksum helper
    • ipvs: revalidate ihl before icmp_send
    • netfilter: ctnetlink: fix suspicious RCU usage in expect_iter_name
    • ocfs2: make ocfs2_calc_xattr_init() return void
    • drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update
    • drm/nouveau/clk: don't clobber reclock status when restoring volt/fan
    • net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
    • net: gue: reject invalid REMCSUM offsets
    • ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().
    • sctp: avoid livelock while updating retransmit path
    • net: usb: catc: bound the RX packet length in catc_rx_done()
    • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget
    • drm/virtio: fix object leak when drm_gem_handle_create() fails
    • drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()
    • drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()
    • drm/virtio: release the GEM object on virtio_gpu_vram_create() errors
    • Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough
    • Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()
    • net: usb: sr9700: include receive overhead in the length check
    • tg3: clean up PHYLIB resources on probe failure
    • net: ethernet: ti: netcp: fix pm_runtime usage counter leak on error
    • bpf: Fix bpf_sock context code generation
    • bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc
    • net/mlx5: Bridge, pass net device when linking vport to bridge
    • net/mlx5: Bridge, don't fail unlink of untracked/unsupported peer ports
    • sctp: hold asoc or transport before mod_timer() in timer handlers
    • net: stmmac: selftests: Support running selftests on DSA conduits
    • net: stmmac: selftests: Check the dev->features for S-TAG offload testing
    • net: stmmac: selftests: Capture all packets for vlan checks
    • net: stmmac: dwmac4: Use the correct bufzise when the len is exactly 8K
    • nfc: nfcmrvl: validate helper command length before pull
    • nfc: st21nfca: validate received frame size
    • nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()
    • nfc: llcp: Fix race condition in accept_queue lifecycle
    • nfc: virtual_ncidev: Add missing ioctl compat handler
    • nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure
    • nfc: st21nfca: validate ISO15693 inventory length
    • nfc: llcp: fix -ENOMEM on connect with zero-length service name
    • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()
    • nfc: llcp: fix slab-out-of-bounds reads when logging service names
    • nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()
    • net/sched: act_gate: budget the per-entry list in get_fill_size
    • veth: manage XDP program pointers during channel resize
    • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()
    • vrf: Stop corrupting skb->csum when capturing CHECKSUM_COMPLETE packets
    • bpf: Fix immediate JMP JEQ/JNE on MIPS32
    • bpf: Fix BSWAP 32 and 16 on MIPS64
    • driver core: Better advertise dev_err_probe()
    • driver core: Make dev_err_probe() silent for -ENOMEM
    • driver core: Add device probe log helper dev_warn_probe()
    • tg3: use random MAC address when tg3_get_device_address fails
    • net: bcmgenet: fix 64-bit RTNL stats reading in ethtool on 32-bit systems
    • net: bcmgenet: initialize u64 stats seq counter for all queues
    • net: bcmgenet: move bcmgenet_power_up into resume_noirq
    • net: bcmgenet: allow return of power up status
    • net: bcmgenet: do not skip WoL power up on GENET V1
    • net: bcmgenet: validate Ethernet address in bcmgenet_set_mac_addr
    • net: bcmgenet: mask DMA_TIMEOUT_MASK when reading DMA_RING0_TIMEOUT
    • ip_gre: Reject enabling collect metadata through changelink
    • net: xps: reject an out of range traffic class
    • tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
    • net/smc: fix UAF on lgr list traversal in smcr_port_err()
    • tipc: Fix a data race on mon->peer_cnt in mon_timeout()
    • net: ethernet: stmmac: dwmac-rk: fix bulk clock leak when the PHY clock fails
    • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure
    • bridge: check llc_mac_hdr_init() return value in br_send_bpdu()
    • net/sched: sch_teql: fix shadowed err in __teql_resolve()
    • vlan: ensure sufficient headroom in vlan_dev_hard_header()
    • autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
    • [x86] perf/x86/intel: Ensure KVM guest PEBS path doesn't set unwanted PERF_GLOBAL_CTRL bits
    • [x86] perf/x86/intel: Don't write PEBS_ENABLED on host<=>guest xfers if CPU has PEBS isolation, to fix stuck PEBS_ENABLED
    • mptcp: return sk_wait_data() errors from recvmsg()
    • rculist: add list_splice_rcu() for private lists
    • netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (CVE-2026-52988)
    • af_unix: Drop all SCM attributes for SOCKMAP. (CVE-2026-53005)
    • net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()
    • [x86] PCI: Disable enhanced atomics on AMD NBIO 7.7 and 7.11
    • tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow
    • sctp: discard the rest of the packet on a stale-cookie error
    • af_packet: fix integer overflow in prb_calc_retire_blk_tmo()
    • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT
    • writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes
    • workqueue: Fix NULL current_pwq deref in flush dependency check
    • writeback: report a Tasks-RCU quiescent state per cgwb drain pass
    • fsl/fman: Fix clk reference leak in read_dts_node()
    • ipv6: do not let ipv6_find_hdr() return an offset past the packet end
    • ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST
    • gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
    • gpio: zynq: fix runtime PM leak on request error path
    • llc: reserve device headroom for allocated frames
    • rds: ib: Clear the sg list when mapping an MR fails
    • [x86] drm/i915: fix incorrect RCU teardown order
    • drm/amdgpu: Fix last_update fence leak in amdgpu_vm_init()
    • drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
    • drm/amdgpu: Fix vmid_wait fence leak in amdgpu_ring_init()
    • drm/nouveau: fix autosuspend cleanup during teardown
    • drm/nouveau: Fix bridge reference leak in nv1a_ram_new()
    • drm/nouveau: fix double-free in nvif_vmm_dtor
    • drm/nouveau: Fix gem reference leak in validate_init()
    • drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
    • HID: alps: fix use-after-free on input2 registration failure
    • HID: quirks: add ALWAYS_POLL quirk for SDINNOVATION gaming keyboard
    • HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
    • net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
    • net/sched: reject IDR error pointers when deleting actions
    • net: arp: terminate device name before lookup
    • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
    • net: hisilicon: hns_dsaf_mac: fix mdio device leak in hns_mac_register_phy()
    • net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
    • net: atl1c: fix soft lockup on out-of-range tpd_cons read
    • net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
    • net: usb: cdc_mbim: add MeiG Smart SRM821 to ZLP whitelist
    • net: usb: lan78xx: Fix URB reference leak in lan78xx_submit_deferred_urbs()
    • netfilter: ip6t_rpfilter: reject routes without inet6_dev
    • netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read
    • nfc: fix use-after-free in nfc_get_local_general_bytes
    • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()
    • nfc: port100: reject frames whose declared length exceeds the received data
    • scsi: libiscsi_tcp: Check the data direction of a Data-In PDU
    • pinctrl: single: free the IRQ on domain creation failure
    • Bluetooth: hci_sock: validate event length before filtering
    • Bluetooth: hci_sock: reject out-of-range OCF values
    • Bluetooth: L2CAP: validate frame length before control and FCS access
    • Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO
    • smb: client: validate POSIX create context length
    • xfs: fix blockgc group quota scanning when usrquota isn't enforced
    • net: tls: fix silent data drop under pipe back-pressure
    • perf test: Change all remaining #!/bin/sh to #!/bin/bash
    • tools/thermal/tmon: Fix compilation warning for wrong format
    • lan78xx: Enable 125 MHz CLK configuration for LAN7801 if NO EEPROM is detected
    • lan78xx: Enable Auto Speed and Auto Duplex configuration for LAN7801 if NO EEPROM is detected
    • drm/amdgpu/atom: Check kcalloc() for WS buffer in amdgpu_atom_execute_table_locked() (CVE-2025-68190)
    • ALSA: hda: Fix missing pointer check in hda_component_manager_init function (CVE-2025-40097) https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.190
    • netfilter: nfnetlink_queue: unbreak SCTP traffic
    • ipv4: validate checksum_start before completing checksum (CVE-2026-99999)
    • ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) . [ Salvatore Bonaccorso ]
  • exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260) Checksums-Sha1: d2dbfa45742e0763b097c69d9c835cd3c8fcd0b4 399396 linux_6.1.190-1.dsc 7b9cb107c4d79c3e2045b76d0d195c628d8e0883 138088908 linux_6.1.190.orig.tar.xz 55b2e45f0aabd4ee12672345da5106c8aa097e07 1940480 linux_6.1.190-1.debian.tar.xz 5a1bde9bf827f5c8fc99a9b51ea7eec2e0406e30 5949 linux_6.1.190-1_source.buildinfo Checksums-Sha256: 30c921025c1c3f26a102e1d52c9ef23516a8362803d0bdfe738c7a841081ca82 399396 linux_6.1.190-1.dsc 710755123060832bb0b58d64d49c2c54e370ec671ec5b0cd0586780a5dee53e7 138088908 linux_6.1.190.orig.tar.xz 4923f2b60c4417b08c498fa1dfc529ff827a75dfd49f81153efb38243d9c53d5 1940480 linux_6.1.190-1.debian.tar.xz f2460c6ec326fb77e9298d5957ea0fe6c5963c6679b0a35228c0e866f8379a41 5949 linux_6.1.190-1_source.buildinfo Files: 45165a2cf4505643b0342fba0da4ae92 399396 kernel optional linux_6.1.190-1.dsc dbf3891fde3acbb0488007d3ae9063e9 138088908 kernel optional linux_6.1.190.orig.tar.xz b2c505a1742682acdf5d1c0b58ff01f4 1940480 kernel optional linux_6.1.190-1.debian.tar.xz 29d892946d7f10baafbfc97df7f6a64a 5949 kernel optional linux_6.1.190-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQKmBAEBCgCQFiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmrSm+pfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQSHGNhcm5pbEBk ZWJpYW4ub3JnAAoJEAVMuPMTQ89EYegP+wckQR2cteTNDblI/xE9nliIV6h/mJj7 bpPFFj37z58nfmjapiWTY7MhWSLcDIrQIP3ssm4LMUlU9UhCRGE2dQjAFWO0GEFV awe55DrW6k79omHabuQyU+KRavt3vMaEDFsrwId09+1wWxrwy43WdRMihy2umUP+ SGi1cOpwwSBpVbHP4lejSanS7a0660CNi9QlKMGDX79kBSeRtJae6Eg0S99Rk9uK UD3yWflCohG7173e98EoE1o7WP7eDpIuMvB2Qqnbd5bPWPalsOlEtf6pr0XtUX43 l+la229mjM4TBR7v3ilKZtE3HPvg+5HQ87ZizLluHJaNOhJkiALVUF8ZF7d5k4sH kuvspdMFDwX6yafJfePk8Vq+xlAnAuIt5E0tSftb5ifnDTWzVCmNymrIs/xnvkDa KlOF9/rTQTAyfbTyS10h+8YDyYtsfIeJDKYMDxLFSErToxe19u2ezMVZ4eNi61i0 91G8SbBVsKPeC+mMfhigxPKv39PhRgvhXVpjrT3x6DDxorsZiz4XVomSiwmbnXT/ b5Qw4dECvy1vZeDVYZf6XblMtfdPKN0L9Qj1vlmwL5HhkMKFU3s0pJi71Bv0W24d GWznfYSj7i7tOH+PNZ2EbK2QyaQu/eVOQ3Z2iooWgDi8nDys7+0dWftyHcCLeoPg fmnK4f647isl =7MCe -----END PGP SIGNATURE-----

Verknuepfte CVEs

CVE-ID Severity (Quelle) CVSS (Quelle) Severity (CVE.org) CVSS (CVE.org) EPSS EPSS-Pctl Veroeffentlicht (CVE.org)

CVE-2023-52676

CRITICAL

9.8

HIGH

7.8

2024-05-17

CVE-2023-53231

CRITICAL

9.8

MEDIUM

5.5

2025-09-15

CVE-2023-53336

CRITICAL

9.8

MEDIUM

5.5

2025-09-17

CVE-2023-53353

CRITICAL

9.8

MEDIUM

5.5

2025-09-17

CVE-2023-53429

CRITICAL

9.8

HIGH

7.8

2025-09-18

CVE-2023-53491

CRITICAL

9.8

HIGH

7.5

2025-10-01

CVE-2023-53538

CRITICAL

9.8

2025-10-04

CVE-2023-53574

CRITICAL

9.8

2025-10-04

CVE-2023-53627

CRITICAL

9.8

HIGH

7.8

2025-10-07

CVE-2023-53762

CRITICAL

9.8

HIGH

8.8

2025-12-08

CVE-2023-53851

CRITICAL

9.8

HIGH

8.4

2025-12-09

CVE-2023-53857

CRITICAL

9.8

2025-12-09

CVE-2023-53999

CRITICAL

9.8

2025-12-24

CVE-2023-54227

CRITICAL

9.8

HIGH

7.5

2025-12-30

CVE-2023-54233

CRITICAL

9.8

2025-12-30

CVE-2024-35887

CRITICAL

9.8

HIGH

8.8

2024-05-19

CVE-2024-49568

CRITICAL

9.8

CRITICAL

9.8

2025-01-11

CVE-2024-50017

CRITICAL

9.8

2024-10-21

CVE-2024-50029

CRITICAL

9.8

HIGH

8.8

2024-10-21

CVE-2024-56545

CRITICAL

9.8

2024-12-27

CVE-2024-58097

CRITICAL

9.8

MEDIUM

5.5

2025-04-16

CVE-2025-21649

CRITICAL

9.8

MEDIUM

5.5

2025-01-19

CVE-2025-21651

CRITICAL

9.8

2025-01-19

CVE-2025-21759

CRITICAL

9.8

HIGH

7.8

2025-02-27

CVE-2025-22039

CRITICAL

9.8

HIGH

8.8

2025-04-16

CVE-2025-22103

CRITICAL

9.8

CVE-2025-23129

CRITICAL

9.8

CVE-2025-37833

CRITICAL

9.8

CVE-2025-40074

CRITICAL

9.8

CRITICAL

9.8

2025-10-28

CVE-2025-40097

CRITICAL

9.8

2025-10-30

CVE-2025-68190

CRITICAL

9.8

CVE-2025-68736

CRITICAL

9.8

CVE-2026-23191

CRITICAL

9.8

HIGH

7.8

2026-02-14

CVE-2026-23447

CRITICAL

9.8

CVE-2026-23448

CRITICAL

9.8

CVE-2026-31420

CRITICAL

9.8

2026-04-13

CVE-2026-43088

CRITICAL

9.8

2026-05-06

CVE-2026-43198

CRITICAL

9.8

CRITICAL

9.8

2026-05-06

CVE-2026-43288

CRITICAL

9.8

2026-05-08

CVE-2026-45897

CRITICAL

9.8

2026-05-27

CVE-2026-46090

CRITICAL

9.8

CVE-2026-52944

CRITICAL

9.8

2026-06-24

CVE-2026-52988

CRITICAL

9.8

HIGH

7.1

2026-06-24

CVE-2026-53005

CRITICAL

9.8

HIGH

7.8

2026-06-24

CVE-2026-53078

CRITICAL

9.8

HIGH

7.8

2026-06-24

CVE-2026-64210

CRITICAL

9.8

HIGH

7.5

2026-07-24

CVE-2026-68097

CRITICAL

9.8

HIGH

8.8

2026-08-10

CVE-2026-68161

CRITICAL

9.8

CVE-2026-68236

CRITICAL

9.8

CVE-2026-68286

CRITICAL

9.8

CVE-2026-68287

CRITICAL

9.8

CVE-2026-68288

CRITICAL

9.8

CVE-2026-68289

CRITICAL

9.8

CVE-2026-68391

CRITICAL

9.8

CVE-2026-72131

CRITICAL

9.8

CVE-2026-72334

CRITICAL

9.8

CVE-2026-72402

CRITICAL

9.8

CVE-2026-72413

CRITICAL

9.8

CVE-2026-74268

CRITICAL

9.8

CVE-2026-74289

CRITICAL

9.8

CVE-2026-74294

CRITICAL

9.8

CVE-2026-74334

CRITICAL

9.8

CVE-2026-74474

CRITICAL

9.8

CVE-2026-74496

CRITICAL

9.8

CVE-2026-74521

CRITICAL

9.8

CVE-2026-74565

CRITICAL

9.8

HIGH

7.8

2026-08-15

CVE-2026-80521

CRITICAL

9.8

HIGH

7.8

2026-08-26

CVE-2026-80671

CRITICAL

9.8

CVE-2026-80689

CRITICAL

9.8

CVE-2026-80833

CRITICAL

9.8

2026-09-04

CVE-2026-80834

CRITICAL

9.8

2026-09-04

CVE-2026-80912

CRITICAL

9.8

CVE-2026-80914

CRITICAL

9.8

HIGH

8.8

2026-09-09

CVE-2026-80928

CRITICAL

9.8

HIGH

7.8

2026-09-11

CVE-2026-80930

CRITICAL

9.8

2026-09-11

CVE-2026-80931

CRITICAL

9.8

HIGH

7.8

2026-09-11

CVE-2026-80932

CRITICAL

9.8

HIGH

8.4

2026-09-11

CVE-2026-80938

CRITICAL

9.8

2026-09-11

CVE-2026-80941

CRITICAL

9.8

2026-09-11

CVE-2026-80944

CRITICAL

9.8

HIGH

7.8

2026-09-11

CVE-2026-80949

CRITICAL

9.8

2026-09-11

CVE-2026-80951

CRITICAL

9.8

CVE-2026-80952

CRITICAL

9.8

CVE-2026-80963

CRITICAL

9.8

CVE-2026-80964

CRITICAL

9.8

CVE-2026-80965

CRITICAL

9.8

CVE-2026-80966

CRITICAL

9.8

CVE-2026-80967

CRITICAL

9.8

CVE-2026-80968

CRITICAL

9.8

CVE-2026-80969

CRITICAL

9.8

CVE-2026-80971

CRITICAL

9.8

CVE-2026-80972

CRITICAL

9.8

CVE-2026-80973

CRITICAL

9.8

CVE-2026-80976

CRITICAL

9.8

CVE-2026-80977

CRITICAL

9.8

CVE-2026-80978

CRITICAL

9.8

CVE-2026-80982

CRITICAL

9.8

CVE-2026-80983

CRITICAL

9.8

CVE-2026-80987

CRITICAL

9.8

CVE-2026-80988

CRITICAL

9.8

CVE-2026-80992

CRITICAL

9.8

CVE-2026-80994

CRITICAL

9.8

HIGH

7.8

2026-09-11

CVE-2026-81000

CRITICAL

9.8

CVE-2026-81001

CRITICAL

9.8

CVE-2026-81002

CRITICAL

9.8

CVE-2026-81003

CRITICAL

9.8

CVE-2026-81005

CRITICAL

9.8

CVE-2026-81007

CRITICAL

9.8

CVE-2026-81008

CRITICAL

9.8

CVE-2026-81017

CRITICAL

9.8

CVE-2026-89440

CRITICAL

9.8

CVE-2026-89444

CRITICAL

9.8

CVE-2026-89461

CRITICAL

9.8

CVE-2026-89463

CRITICAL

9.8

CVE-2026-89464

CRITICAL

9.8

CVE-2026-89469

CRITICAL

9.8

CVE-2026-89470

CRITICAL

9.8

CVE-2026-89471

CRITICAL

9.8

CVE-2026-89474

CRITICAL

9.8

CVE-2026-89475

CRITICAL

9.8

CVE-2026-89476

CRITICAL

9.8

CVE-2026-89477

CRITICAL

9.8

CVE-2026-89478

CRITICAL

9.8

CVE-2026-89479

CRITICAL

9.8

CVE-2026-89480

CRITICAL

9.8

CVE-2026-89481

CRITICAL

9.8

CVE-2026-89482

CRITICAL

9.8

CVE-2026-89483

CRITICAL

9.8

CVE-2026-89485

CRITICAL

9.8

CVE-2026-89487

CRITICAL

9.8

CVE-2026-89488

CRITICAL

9.8

CVE-2026-89490

CRITICAL

9.8

CVE-2026-89491

CRITICAL

9.8

CVE-2026-89493

CRITICAL

9.8

CVE-2026-89494

CRITICAL

9.8

CVE-2026-89495

CRITICAL

9.8

CVE-2026-89496

CRITICAL

9.8

CVE-2026-89497

CRITICAL

9.8

CVE-2026-89498

CRITICAL

9.8

CVE-2026-89504

CRITICAL

9.8

CVE-2026-89508

CRITICAL

9.8

CVE-2026-89510

CRITICAL

9.8

CVE-2026-89511

CRITICAL

9.8

CVE-2026-89512

CRITICAL

9.8

CVE-2026-89515

CRITICAL

9.8

CVE-2026-89524

CRITICAL

9.8

CVE-2026-89525

CRITICAL

9.8

CVE-2026-89532

CRITICAL

9.8

CVE-2026-89533

CRITICAL

9.8

CVE-2026-89538

CRITICAL

9.8

CVE-2026-89540

CRITICAL

9.8

CVE-2026-89541

CRITICAL

9.8

CVE-2026-89542

CRITICAL

9.8

CVE-2026-89548

CRITICAL

9.8

CVE-2026-89549

CRITICAL

9.8

CVE-2026-89551

CRITICAL

9.8

CVE-2026-89554

CRITICAL

9.8

CVE-2026-89555

CRITICAL

9.8

CVE-2026-89557

CRITICAL

9.8

CVE-2026-89559

CRITICAL

9.8

CVE-2026-89560

CRITICAL

9.8

CVE-2026-89562

CRITICAL

9.8

CVE-2026-89563

CRITICAL

9.8

CVE-2026-89565

CRITICAL

9.8

CVE-2026-89569

CRITICAL

9.8

CVE-2026-89573

CRITICAL

9.8

CVE-2026-89575

CRITICAL

9.8

CVE-2026-89576

CRITICAL

9.8

CVE-2026-89579

CRITICAL

9.8

CVE-2026-89582

CRITICAL

9.8

CVE-2026-89583

CRITICAL

9.8

CVE-2026-89585

CRITICAL

9.8

CVE-2026-89586

CRITICAL

9.8

CVE-2026-89587

CRITICAL

9.8

CVE-2026-89594

CRITICAL

9.8

CVE-2026-89595

CRITICAL

9.8

CVE-2026-89596

CRITICAL

9.8

CVE-2026-89597

CRITICAL

9.8

CVE-2026-89599

CRITICAL

9.8

CVE-2026-89603

CRITICAL

9.8

CVE-2026-89604

CRITICAL

9.8

CVE-2026-89605

CRITICAL

9.8

CVE-2026-89606

CRITICAL

9.8

CVE-2026-89607

CRITICAL

9.8

CVE-2026-89608

CRITICAL

9.8

CVE-2026-89609

CRITICAL

9.8

CVE-2026-89621

CRITICAL

9.8

CVE-2026-89626

CRITICAL

9.8

CVE-2026-89627

CRITICAL

9.8

CVE-2026-89628

CRITICAL

9.8

CVE-2026-89634

CRITICAL

9.8

CVE-2026-89636

CRITICAL

9.8

CVE-2026-89640

CRITICAL

9.8

CVE-2026-89643

CRITICAL

9.8

CVE-2026-89649

CRITICAL

9.8

CVE-2026-89650

CRITICAL

9.8

CVE-2026-89653

CRITICAL

9.8

CVE-2026-89655

CRITICAL

9.8

CVE-2026-89656

CRITICAL

9.8

CVE-2026-89662

CRITICAL

9.8

CVE-2026-89663

CRITICAL

9.8

CVE-2026-89665

CRITICAL

9.8

CVE-2026-89669

CRITICAL

9.8

CVE-2026-89674

CRITICAL

9.8

CVE-2026-89684

CRITICAL

9.8

CVE-2026-89694

CRITICAL

9.8

CVE-2026-89696

CRITICAL

9.8

CVE-2026-89697

CRITICAL

9.8

CVE-2026-89699

CRITICAL

9.8

CVE-2026-89704

CRITICAL

9.8

CVE-2026-89706

CRITICAL

9.8

CVE-2026-89710

CRITICAL

9.8

CVE-2026-89711

CRITICAL

9.8

CVE-2026-89712

CRITICAL

9.8

CVE-2026-89720

CRITICAL

9.8

CVE-2026-89723

CRITICAL

9.8

CVE-2026-89724

CRITICAL

9.8

CVE-2026-89725

CRITICAL

9.8

CVE-2026-89726

CRITICAL

9.8

CVE-2026-89729

CRITICAL

9.8

CVE-2026-89730

CRITICAL

9.8

CVE-2026-89732

CRITICAL

9.8

CVE-2026-89733

CRITICAL

9.8

CVE-2026-89736

CRITICAL

9.8

CVE-2026-89741

CRITICAL

9.8

CVE-2026-89742

CRITICAL

9.8

CVE-2026-89744

CRITICAL

9.8

CVE-2026-89746

CRITICAL

9.8

CVE-2026-89749

CRITICAL

9.8

CVE-2026-89751

CRITICAL

9.8

CVE-2026-89752

CRITICAL

9.8

CVE-2026-89753

CRITICAL

9.8

CVE-2026-89756

CRITICAL

9.8

CVE-2026-89765

CRITICAL

9.8

CVE-2026-89776

CRITICAL

9.8

2026-09-16

CVE-2026-89777

CRITICAL

9.8

HIGH

8.8

2026-09-16

CVE-2026-89778

CRITICAL

9.8

CRITICAL

9.8

2026-09-16

CVE-2026-89780

CRITICAL

9.8

2026-09-16

CVE-2026-89783

CRITICAL

9.8

CRITICAL

9.8

2026-09-16

CVE-2026-89784

CRITICAL

9.8

2026-09-16

CVE-2026-89786

CRITICAL

9.8

CRITICAL

9.1

2026-09-16

CVE-2026-89787

CRITICAL

9.8

2026-09-16

CVE-2026-89789

CRITICAL

9.8

HIGH

7.8

2026-09-16

CVE-2026-89792

CRITICAL

9.8

HIGH

7.1

2026-09-16

CVE-2026-89796

CRITICAL

9.8

2026-09-16

CVE-2026-89816

CRITICAL

9.8

2026-09-16

CVE-2026-89817

CRITICAL

9.8

2026-09-16

CVE-2026-89818

CRITICAL

9.8

CVE-2026-89821

CRITICAL

9.8

CVE-2026-89822

CRITICAL

9.8

CVE-2026-89823

CRITICAL

9.8

CVE-2026-89824

CRITICAL

9.8

CVE-2026-89843

CRITICAL

9.8

CVE-2026-89845

CRITICAL

9.8

CVE-2026-89846

CRITICAL

9.8

CVE-2026-89847

CRITICAL

9.8

CVE-2026-89849

CRITICAL

9.8

CVE-2026-89850

CRITICAL

9.8

CVE-2026-89851

CRITICAL

9.8

CVE-2026-89852

CRITICAL

9.8

CVE-2026-89853

CRITICAL

9.8

CVE-2026-89854

CRITICAL

9.8

CVE-2026-89855

CRITICAL

9.8

CVE-2026-89856

CRITICAL

9.8

CVE-2026-89858

CRITICAL

9.8

CVE-2026-89861

CRITICAL

9.8

CVE-2026-89863

CRITICAL

9.8

CVE-2026-89864

CRITICAL

9.8

CVE-2026-89865

CRITICAL

9.8

CVE-2026-89870

CRITICAL

9.8

CVE-2026-89871

CRITICAL

9.8

CVE-2026-89872

CRITICAL

9.8

CVE-2026-89876

CRITICAL

9.8

CVE-2026-89877

CRITICAL

9.8

CVE-2026-89878

CRITICAL

9.8

CVE-2026-89879

CRITICAL

9.8

CVE-2026-89880

CRITICAL

9.8

CVE-2026-89881

CRITICAL

9.8

CVE-2026-89883

CRITICAL

9.8

CVE-2026-89887

CRITICAL

9.8

CVE-2026-89888

CRITICAL

9.8

CVE-2026-89890

CRITICAL

9.8

CVE-2026-89891

CRITICAL

9.8

CVE-2026-89892

CRITICAL

9.8

CVE-2026-89893

CRITICAL

9.8

CVE-2026-89894

CRITICAL

9.8

CVE-2026-89895

CRITICAL

9.8

CVE-2026-89896

CRITICAL

9.8

CVE-2026-89897

CRITICAL

9.8

CVE-2026-89901

CRITICAL

9.8

CVE-2026-89927

CRITICAL

9.8

CVE-2026-89930

CRITICAL

9.8

CVE-2026-89932

CRITICAL

9.8

CVE-2026-89936

CRITICAL

9.8

CVE-2026-89937

CRITICAL

9.8

CVE-2026-89939

CRITICAL

9.8

CVE-2026-89945

CRITICAL

9.8

CVE-2026-89946

CRITICAL

9.8

CVE-2026-89947

CRITICAL

9.8

CVE-2026-89948

CRITICAL

9.8

CVE-2026-89949

CRITICAL

9.8

CVE-2026-89951

CRITICAL

9.8

CVE-2026-89952

CRITICAL

9.8

CVE-2026-89953

CRITICAL

9.8

CVE-2026-89954

CRITICAL

9.8

CVE-2026-89965

CRITICAL

9.8

CVE-2026-89968

CRITICAL

9.8

CVE-2026-89969

CRITICAL

9.8

CVE-2026-89970

CRITICAL

9.8

CVE-2026-89973

CRITICAL

9.8

CVE-2026-89979

CRITICAL

9.8

CVE-2026-89980

CRITICAL

9.8

CVE-2026-89982

CRITICAL

9.8

CVE-2026-89983

CRITICAL

9.8

CVE-2026-89984

CRITICAL

9.8

CVE-2026-89988

CRITICAL

9.8

CVE-2026-89989

CRITICAL

9.8

CVE-2026-89992

CRITICAL

9.8

CVE-2026-89993

CRITICAL

9.8

CVE-2026-89997

CRITICAL

9.8

CVE-2026-89998

CRITICAL

9.8

CVE-2026-89999

CRITICAL

9.8

CVE-2026-90000

CRITICAL

9.8

CVE-2026-90003

CRITICAL

9.8

CVE-2026-90007

CRITICAL

9.8

CVE-2026-90011

CRITICAL

9.8

CVE-2026-90015

CRITICAL

9.8

CVE-2026-90017

CRITICAL

9.8

CVE-2026-90018

CRITICAL

9.8

CVE-2026-90019

CRITICAL

9.8

CVE-2026-90020

CRITICAL

9.8

CVE-2026-90025

CRITICAL

9.8

CVE-2026-90031

CRITICAL

9.8

CVE-2026-90032

CRITICAL

9.8

CVE-2026-90033

CRITICAL

9.8

CVE-2026-90034

CRITICAL

9.8

CVE-2026-90049

CRITICAL

9.8

CVE-2026-90053

CRITICAL

9.8

2026-09-17

CVE-2026-90054

CRITICAL

9.8

2026-09-17

CVE-2026-90055

CRITICAL

9.8

2026-09-17

CVE-2026-90056

CRITICAL

9.8

2026-09-17

CVE-2026-90057

CRITICAL

9.8

HIGH

7.8

2026-09-17

CVE-2026-90058

CRITICAL

9.8

2026-09-17

CVE-2026-90060

CRITICAL

9.8

2026-09-17

CVE-2026-90062

CRITICAL

9.8

HIGH

7.1

2026-09-17

CVE-2026-90063

CRITICAL

9.8

2026-09-17

CVE-2026-90067

CRITICAL

9.8

HIGH

7.5

2026-09-17

CVE-2026-90068

CRITICAL

9.8

2026-09-17

CVE-2026-90070

CRITICAL

9.8

2026-09-17

CVE-2026-90071

CRITICAL

9.8

HIGH

7.8

2026-09-17

CVE-2026-90072

CRITICAL

9.8

2026-09-17

CVE-2026-90073

CRITICAL

9.8

2026-09-17

CVE-2026-90074

CRITICAL

9.8

2026-09-17

CVE-2026-90075

CRITICAL

9.8

CVE-2026-90078

CRITICAL

9.8

CVE-2026-90081

CRITICAL

9.8

CVE-2026-90088

CRITICAL

9.8

CVE-2026-90090

CRITICAL

9.8

CVE-2026-90091

CRITICAL

9.8

CVE-2026-90092

CRITICAL

9.8

CVE-2026-90102

CRITICAL

9.8

CVE-2026-90103

CRITICAL

9.8

CVE-2026-90107

CRITICAL

9.8

CVE-2026-90108

CRITICAL

9.8

CVE-2026-90110

CRITICAL

9.8

CVE-2026-90114

CRITICAL

9.8

CVE-2026-90122

CRITICAL

9.8

CVE-2026-90124

CRITICAL

9.8

CVE-2026-90126

CRITICAL

9.8

CVE-2026-90128

CRITICAL

9.8

CVE-2026-90140

CRITICAL

9.8

CVE-2026-90141

CRITICAL

9.8

CVE-2026-90143

CRITICAL

9.8

CVE-2026-90151

CRITICAL

9.8

CVE-2026-90157

CRITICAL

9.8

CVE-2026-90160

CRITICAL

9.8

CVE-2026-90176

CRITICAL

9.8

CVE-2026-90180

CRITICAL

9.8

CVE-2026-90184

CRITICAL

9.8

CVE-2026-90185

CRITICAL

9.8

CVE-2026-90186

CRITICAL

9.8

CVE-2026-90188

CRITICAL

9.8

CVE-2026-90189

CRITICAL

9.8

CVE-2026-90190

CRITICAL

9.8

CVE-2026-90194

CRITICAL

9.8

CVE-2026-90196

CRITICAL

9.8

CVE-2026-90198

CRITICAL

9.8

CVE-2026-90202

CRITICAL

9.8

CVE-2026-90203

CRITICAL

9.8

CVE-2026-90207

CRITICAL

9.8

CVE-2026-90214

CRITICAL

9.8

CVE-2026-90216

CRITICAL

9.8

CVE-2026-90218

CRITICAL

9.8

CVE-2026-90219

CRITICAL

9.8

CVE-2026-90221

CRITICAL

9.8

CVE-2026-90222

CRITICAL

9.8

CVE-2026-90223

CRITICAL

9.8

CVE-2026-90224

CRITICAL

9.8

CVE-2026-90225

CRITICAL

9.8

CVE-2026-90226

CRITICAL

9.8

CVE-2026-90228

CRITICAL

9.8

CVE-2026-90245

CRITICAL

9.8

CVE-2026-90248

CRITICAL

9.8

CVE-2026-90249

CRITICAL

9.8

CVE-2026-90251

CRITICAL

9.8

CVE-2026-90253

CRITICAL

9.8

CVE-2026-90254

CRITICAL

9.8

CVE-2026-90255

CRITICAL

9.8

CVE-2026-90257

CRITICAL

9.8

CVE-2026-90274

CRITICAL

9.8

CVE-2026-90281

CRITICAL

9.8

CVE-2026-90283

CRITICAL

9.8

CVE-2026-90284

CRITICAL

9.8

CVE-2026-90285

CRITICAL

9.8

CVE-2026-90286

CRITICAL

9.8

CVE-2026-90287

CRITICAL

9.8

CVE-2026-90290

CRITICAL

9.8

CVE-2026-90292

CRITICAL

9.8

CVE-2026-90293

CRITICAL

9.8

CVE-2026-90294

CRITICAL

9.8

CVE-2026-90295

CRITICAL

9.8

CVE-2026-90296

CRITICAL

9.8

CVE-2026-90297

CRITICAL

9.8

CVE-2026-90298

CRITICAL

9.8

CVE-2026-90302

CRITICAL

9.8

CVE-2026-90303

CRITICAL

9.8

CVE-2026-90307

CRITICAL

9.8

CVE-2026-90309

CRITICAL

9.8

CVE-2026-90314

CRITICAL

9.8

CVE-2026-90316

CRITICAL

9.8

CVE-2026-90318

CRITICAL

9.8

CVE-2026-90319

CRITICAL

9.8

CVE-2026-90327

CRITICAL

9.8

CVE-2026-90329

CRITICAL

9.8

CVE-2026-90334

CRITICAL

9.8

CVE-2026-90341

CRITICAL

9.8

CVE-2026-90348

CRITICAL

9.8

CVE-2026-90352

CRITICAL

9.8

CVE-2026-90353

CRITICAL

9.8

CVE-2026-90354

CRITICAL

9.8

CVE-2026-90357

CRITICAL

9.8

CVE-2026-90360

CRITICAL

9.8

CVE-2026-90361

CRITICAL

9.8

CVE-2026-90362

CRITICAL

9.8

CVE-2026-90372

CRITICAL

9.8

CVE-2026-90378

CRITICAL

9.8

CVE-2026-90382

CRITICAL

9.8

CVE-2026-90386

CRITICAL

9.8

CVE-2026-90388

CRITICAL

9.8

CVE-2026-90391

CRITICAL

9.8

CVE-2026-90393

CRITICAL

9.8

CVE-2026-90394

CRITICAL

9.8

CVE-2026-90395

CRITICAL

9.8

CVE-2026-90403

CRITICAL

9.8

CVE-2026-90411

CRITICAL

9.8

CVE-2026-90413

CRITICAL

9.8

CVE-2026-90414

CRITICAL

9.8

CVE-2026-90415

CRITICAL

9.8

CVE-2026-90416

CRITICAL

9.8

CVE-2026-90419

CRITICAL

9.8

CVE-2026-90420

CRITICAL

9.8

CVE-2026-90431

CRITICAL

9.8

CVE-2026-90434

CRITICAL

9.8

CVE-2026-90435

CRITICAL

9.8

CVE-2026-92476

CRITICAL

9.8

CVE-2026-92477

CRITICAL

9.8

CVE-2026-92481

CRITICAL

9.8

CVE-2026-92494

CRITICAL

9.8

CVE-2026-92496

CRITICAL

9.8

CVE-2026-92498

CRITICAL

9.8

CVE-2026-92501

CRITICAL

9.8

CVE-2026-92504

CRITICAL

9.8

CVE-2026-92507

CRITICAL

9.8

CVE-2026-92508

CRITICAL

9.8

CVE-2026-92509

CRITICAL

9.8

CVE-2026-92510

CRITICAL

9.8

CVE-2026-92511

CRITICAL

9.8

CVE-2026-92512

CRITICAL

9.8

CVE-2026-92514

CRITICAL

9.8

CVE-2026-92521

CRITICAL

9.8

CVE-2026-92522

CRITICAL

9.8

CVE-2026-92523

CRITICAL

9.8

CVE-2026-92524

CRITICAL

9.8

CVE-2026-92525

CRITICAL

9.8

CVE-2026-93037

CRITICAL

9.8

CVE-2026-93039

CRITICAL

9.8

CVE-2026-93040

CRITICAL

9.8

CVE-2026-93041

CRITICAL

9.8

CVE-2026-93046

CRITICAL

9.8

CVE-2026-93048

CRITICAL

9.8

CVE-2026-93049

CRITICAL

9.8

CVE-2026-93050

CRITICAL

9.8

CVE-2026-93051

CRITICAL

9.8

CVE-2026-93052

CRITICAL

9.8

CVE-2026-93053

CRITICAL

9.8

CVE-2026-93054

CRITICAL

9.8

CVE-2026-93055

CRITICAL

9.8

CVE-2026-93056

CRITICAL

9.8

CVE-2026-93061

CRITICAL

9.8

CVE-2026-93063

CRITICAL

9.8

CVE-2026-93064

CRITICAL

9.8

CVE-2026-93067

CRITICAL

9.8

CVE-2026-93073

CRITICAL

9.8

CVE-2026-93095

CRITICAL

9.8

CVE-2026-93098

CRITICAL

9.8

CVE-2026-93102

CRITICAL

9.8

CVE-2026-93103

CRITICAL

9.8

CVE-2026-93108

CRITICAL

9.8

CVE-2026-93109

CRITICAL

9.8

CVE-2026-93110

CRITICAL

9.8

CVE-2026-93114

CRITICAL

9.8

CVE-2026-93115

CRITICAL

9.8

CVE-2026-93117

CRITICAL

9.8

CVE-2026-93118

CRITICAL

9.8

CVE-2026-93120

CRITICAL

9.8

CVE-2026-93130

CRITICAL

9.8

CVE-2026-93131

CRITICAL

9.8

CVE-2026-93136

CRITICAL

9.8

CVE-2026-93137

CRITICAL

9.8

CVE-2026-93138

CRITICAL

9.8

CVE-2026-93140

CRITICAL

9.8

CVE-2026-93141

CRITICAL

9.8

CVE-2026-93142

CRITICAL

9.8

CVE-2026-93145

CRITICAL

9.8

CVE-2026-93149

CRITICAL

9.8

CVE-2026-93151

CRITICAL

9.8

CVE-2026-93152

CRITICAL

9.8

CVE-2026-93158

CRITICAL

9.8

CVE-2026-93159

CRITICAL

9.8

CVE-2026-93160

CRITICAL

9.8

CVE-2026-93161

CRITICAL

9.8

CVE-2026-93165

CRITICAL

9.8

CVE-2026-93167

CRITICAL

9.8

CVE-2026-93170

CRITICAL

9.8

CVE-2026-93177

CRITICAL

9.8

CVE-2026-93178

CRITICAL

9.8

CVE-2026-93182

CRITICAL

9.8

CVE-2026-93183

CRITICAL

9.8

CVE-2026-93185

CRITICAL

9.8

CVE-2026-93188

CRITICAL

9.8

CVE-2026-93189

CRITICAL

9.8

CVE-2026-93190

CRITICAL

9.8

CVE-2026-93191

CRITICAL

9.8

CVE-2026-93203

CRITICAL

9.8

CVE-2026-93204

CRITICAL

9.8

CVE-2026-93286

CRITICAL

9.8

CVE-2026-93287

CRITICAL

9.8

CVE-2026-93288

CRITICAL

9.8

CVE-2026-93781

CRITICAL

9.8

CVE-2026-93782

CRITICAL

9.8

CVE-2026-93783

CRITICAL

9.8

CVE-2026-93784

CRITICAL

9.8

CVE-2026-93785

CRITICAL

9.8

CVE-2026-93787

CRITICAL

9.8

CVE-2026-93788

CRITICAL

9.8

CVE-2026-93789

CRITICAL

9.8

CVE-2026-93795

CRITICAL

9.8

CVE-2026-93797

CRITICAL

9.8

CVE-2026-93798

CRITICAL

9.8

CVE-2026-93800

CRITICAL

9.8

CVE-2026-93802

CRITICAL

9.8

CVE-2026-93803

CRITICAL

9.8

CVE-2026-93805

CRITICAL

9.8

CVE-2026-93806

CRITICAL

9.8

CVE-2026-93807

CRITICAL

9.8

CVE-2026-93808

CRITICAL

9.8

CVE-2026-93810

CRITICAL

9.8

CVE-2026-93811

CRITICAL

9.8

CVE-2026-93812

CRITICAL

9.8

CVE-2026-93813

CRITICAL

9.8

CVE-2026-93814

CRITICAL

9.8

CVE-2026-93815

CRITICAL

9.8

CVE-2026-93816

CRITICAL

9.8

CVE-2026-93819

CRITICAL

9.8

CVE-2026-93820

CRITICAL

9.8

CVE-2026-93821

CRITICAL

9.8

CVE-2026-93822

CRITICAL

9.8

CVE-2026-93824

CRITICAL

9.8

CVE-2026-93825

CRITICAL

9.8

CVE-2026-93826

CRITICAL

9.8

CVE-2026-93830

CRITICAL

9.8

CVE-2026-97407

CRITICAL

9.8

CVE-2026-97408

CRITICAL

9.8

CVE-2026-97411

CRITICAL

9.8

CVE-2026-97413

CRITICAL

9.8

CVE-2026-97415

CRITICAL

9.8

CVE-2026-97416

CRITICAL

9.8

CVE-2026-97417

CRITICAL

9.8

CVE-2026-97418

CRITICAL

9.8

CVE-2026-97419

CRITICAL

9.8

CVE-2026-97420

CRITICAL

9.8

CVE-2026-97421

CRITICAL

9.8

CVE-2026-97427

CRITICAL

9.8

CVE-2026-97430

CRITICAL

9.8

CVE-2026-97434

CRITICAL

9.8

CVE-2026-97435

CRITICAL

9.8

CVE-2026-97436

CRITICAL

9.8

CVE-2026-97437

CRITICAL

9.8

CVE-2026-97438

CRITICAL

9.8

CVE-2026-97439

CRITICAL

9.8

CVE-2026-97440

CRITICAL

9.8

CVE-2026-97441

CRITICAL

9.8

CVE-2026-97442

CRITICAL

9.8

CVE-2026-97444

CRITICAL

9.8

CVE-2026-97445

CRITICAL

9.8

CVE-2026-97446

CRITICAL

9.8

CVE-2026-97448

CRITICAL

9.8

CVE-2026-97449

CRITICAL

9.8

CVE-2026-97450

CRITICAL

9.8

CVE-2026-97451

CRITICAL

9.8

CVE-2026-97452

CRITICAL

9.8

CVE-2026-97453

CRITICAL

9.8

CVE-2026-97454

CRITICAL

9.8

CVE-2026-97455

CRITICAL

9.8

CVE-2026-97456

CRITICAL

9.8

CVE-2026-97472

CRITICAL

9.8

CVE-2026-97475

CRITICAL

9.8

CVE-2026-97476

CRITICAL

9.8

CVE-2026-97481

CRITICAL

9.8

CVE-2026-97482

CRITICAL

9.8

CVE-2026-97483

CRITICAL

9.8

CVE-2026-97484

CRITICAL

9.8

CVE-2026-97485

CRITICAL

9.8

CVE-2026-97486

CRITICAL

9.8

CVE-2026-97487

CRITICAL

9.8

CVE-2026-97488

CRITICAL

9.8

CVE-2026-97489

CRITICAL

9.8

CVE-2026-97490

CRITICAL

9.8

CVE-2026-97491

CRITICAL

9.8

CVE-2026-97492

CRITICAL

9.8

CVE-2026-97495

CRITICAL

9.8

CVE-2026-97497

CRITICAL

9.8

CVE-2026-97502

CRITICAL

9.8

CVE-2026-97506

CRITICAL

9.8

CVE-2026-97507

CRITICAL

9.8

CVE-2026-97508

CRITICAL

9.8

CVE-2026-97509

CRITICAL

9.8

CVE-2026-97510

CRITICAL

9.8

CVE-2026-97516

CRITICAL

9.8

CVE-2026-97517

CRITICAL

9.8

CVE-2026-97523

CRITICAL

9.8

HIGH

7.5

2026-09-25

CVE-2026-97524

CRITICAL

9.8

HIGH

7.5

2026-09-25

CVE-2026-97539

CRITICAL

9.8

CVE-2026-97540

CRITICAL

9.8

CVE-2026-97541

CRITICAL

9.8

CVE-2026-97556

CRITICAL

9.8

CVE-2026-97557

CRITICAL

9.8

CVE-2026-97564

CRITICAL

9.8

CVE-2026-97568

CRITICAL

9.8

CVE-2026-97572

CRITICAL

9.8

CVE-2026-97573

CRITICAL

9.8

CVE-2026-97576

CRITICAL

9.8

CVE-2026-97581

CRITICAL

9.8

CVE-2026-97582

CRITICAL

9.8

CVE-2026-97596

CRITICAL

9.8

CVE-2026-97598

CRITICAL

9.8

CVE-2026-97601

CRITICAL

9.8

CVE-2026-97604

CRITICAL

9.8

CVE-2026-97608

CRITICAL

9.8

CVE-2026-97611

CRITICAL

9.8

CVE-2026-97612

CRITICAL

9.8

CVE-2026-97899

CRITICAL

9.8

CVE-2026-97904

CRITICAL

9.8

CVE-2026-97905

CRITICAL

9.8

CVE-2026-97909

CRITICAL

9.8

CVE-2026-97910

CRITICAL

9.8

CVE-2026-97920

CRITICAL

9.8

CVE-2026-97921

CRITICAL

9.8

CVE-2026-97922

CRITICAL

9.8

CVE-2026-97923

CRITICAL

9.8

CVE-2026-97925

CRITICAL

9.8

CVE-2026-97926

CRITICAL

9.8

CVE-2026-97927

CRITICAL

9.8

CVE-2026-97930

CRITICAL

9.8

CVE-2026-97931

CRITICAL

9.8

CVE-2026-97940

CRITICAL

9.8

CVE-2026-97948

CRITICAL

9.8

CVE-2026-97951

CRITICAL

9.8

CVE-2026-97952

CRITICAL

9.8

CVE-2026-97954

CRITICAL

9.8

CVE-2026-97957

CRITICAL

9.8

CVE-2026-97958

CRITICAL

9.8

CVE-2026-97959

CRITICAL

9.8

CVE-2026-97963

CRITICAL

9.8

CVE-2026-97964

CRITICAL

9.8

CVE-2026-97969

CRITICAL

9.8

CVE-2026-97970

CRITICAL

9.8

CVE-2026-97973

CRITICAL

9.8

CVE-2026-97977

CRITICAL

9.8

CVE-2026-97979

CRITICAL

9.8

CVE-2026-97981

CRITICAL

9.8

CVE-2026-97982

CRITICAL

9.8

CVE-2026-97986

CRITICAL

9.8

CVE-2026-97987

CRITICAL

9.8

CVE-2026-97991

CRITICAL

9.8

CVE-2026-97993

CRITICAL

9.8

CVE-2026-97995

CRITICAL

9.8

CVE-2026-97998

CRITICAL

9.8

CVE-2026-98006

CRITICAL

9.8

CVE-2026-98008

CRITICAL

9.8

CVE-2026-98009

CRITICAL

9.8

CVE-2026-98010

CRITICAL

9.8

CVE-2026-98011

CRITICAL

9.8

CVE-2026-98012

CRITICAL

9.8

CVE-2026-98013

CRITICAL

9.8

CVE-2026-98014

CRITICAL

9.8

CVE-2026-98015

CRITICAL

9.8

CVE-2026-98016

CRITICAL

9.8

CVE-2026-98017

CRITICAL

9.8

CVE-2026-98022

CRITICAL

9.8

CVE-2026-98023

CRITICAL

9.8

CVE-2026-98025

CRITICAL

9.8

CVE-2026-98027

CRITICAL

9.8

CVE-2026-98030

CRITICAL

9.8

CVE-2026-98031

CRITICAL

9.8

CVE-2026-98046

CRITICAL

9.8

CVE-2026-98055

CRITICAL

9.8

CVE-2026-98063

CRITICAL

9.8

CVE-2026-98064

CRITICAL

9.8

CVE-2026-98066

CRITICAL

9.8

CVE-2026-98068

CRITICAL

9.8

CVE-2026-98069

CRITICAL

9.8

CVE-2026-98070

CRITICAL

9.8

CVE-2026-98071

CRITICAL

9.8

CVE-2026-98072

CRITICAL

9.8

CVE-2026-98074

CRITICAL

9.8

CVE-2026-98075

CRITICAL

9.8

CVE-2026-98076

CRITICAL

9.8

CVE-2026-98077

CRITICAL

9.8

CVE-2026-98078

CRITICAL

9.8

CVE-2026-98080

CRITICAL

9.8

CVE-2026-98088

CRITICAL

9.8

CVE-2026-98089

CRITICAL

9.8

CVE-2026-98090

CRITICAL

9.8

CVE-2026-98091

CRITICAL

9.8

CVE-2026-98092

CRITICAL

9.8

CVE-2026-98094

CRITICAL

9.8

CVE-2026-98095

CRITICAL

9.8

CVE-2026-98096

CRITICAL

9.8

CVE-2026-98098

CRITICAL

9.8

CVE-2026-98104

CRITICAL

9.8

CVE-2026-98108

CRITICAL

9.8

CVE-2026-98113

CRITICAL

9.8

CVE-2026-98116

CRITICAL

9.8

CVE-2026-98121

CRITICAL

9.8

CVE-2026-98123

CRITICAL

9.8

CVE-2026-98128

CRITICAL

9.8

CVE-2026-98129

CRITICAL

9.8

CVE-2026-98130

CRITICAL

9.8

CVE-2026-98154

CRITICAL

9.8

CVE-2026-98157

CRITICAL

9.8

CVE-2026-98158

CRITICAL

9.8

CVE-2026-98159

CRITICAL

9.8

CVE-2026-98260

CRITICAL

9.8

CVE-2026-98432

CRITICAL

9.8

2026-10-15

CVE-2026-99999

CRITICAL

9.8

CRITICAL

9.3

2026-10-15

Quellen-Details

Bezeichnung Name Kategorie Tags Zielgruppe Sprache Feed-URL
Debian PTS — linux (Quellpaket)

debian_pts_linux

 package_tracker debian, linux, kernel - de https://tracker.debian.org/pkg/linux/rss
Zurueck zur Eintrags-Liste