- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present - xfrm: esp: avoid in-place decrypt on shared skb frags - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701} - gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898} - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315} - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447} - Squashfs: check metadata block offset is within range {CVE-2026-23388} - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397} - ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587} - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082} - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2024-21803} - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612} - firmware_loader: Block path traversal {CVE-2024-47742} - EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708} - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689} - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068} - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg {CVE-2024-56633} - bpf: Fix array bounds error with may_goto {CVE-2025-22087} - wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb {CVE-2024-56609} - loop: Fix use-after-free issues {CVE-2023-53111} - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265} - net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308} - udf: Do not bother merging very long extents {CVE-2023-53506} - ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668} - binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497} - virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515} - tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560} - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619} - gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622} - net/mlx5: Fix ECVF vports unload on shutdown flow {CVE-2025-38109} - RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133} - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093} - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078} - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099} - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}