2026

In the Linux kernel, the following vulnerability has been resolved: forcedeth: fix UAF of txrx_stats in nv_remove nv_r

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: validate offshift to prevent sh

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: clear iso_data always when detachin

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix UAF in l2cap_le_connect_rsp

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_sock_getname Access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in iso_connect_ind Accessi

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: hold sk properly in iso_conn_ready

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in iso_sock_timeout

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix refcounting of iso_conn iso_co

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix race of kfree vs kref_get_unles

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: hold conn reference in abort_c

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_big_s

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_connect_pa_sy

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hold conn in hci_past_sync() c

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Block VFs from clobbering special CGX

In the Linux kernel, the following vulnerability has been resolved: qede: sync udp_tunnel ports outside qede_lock in th

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __close_file_table_ids

In the Linux kernel, the following vulnerability has been resolved: iommu/iommufd: Fix IOPF group ownership UAF iopf_g

In the Linux kernel, the following vulnerability has been resolved: pinctrl: devicetree: don't free uninitialized dev_n

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix list corruption in allocate_file_re

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is i

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmb_node in loopback at

In the Linux kernel, the following vulnerability has been resolved: audit: fix potential use-after-free in audit_del_ru

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellati

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix advertising data UAFs hci

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transactio

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads

In the Linux kernel, the following vulnerability has been resolved: afs: Fix UAF when sending a message In afs_make_ca

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the c

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedb

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kerne

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dump

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix tid_tx use-after-free on BA ses

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: use the subframe length when parsing

In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: reject a flag character as the field d

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: unlock i_mmap_rwsem before releasin

In the Linux kernel, the following vulnerability has been resolved: mm/page_reporting: use system_freezable_wq to fix U

In the Linux kernel, the following vulnerability has been resolved: net: pktgen: fix proc entry use-after-free pktgen_

In the Linux kernel, the following vulnerability has been resolved: tracing: Check return value of __register_event() i

In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix REPORT ZONES alloc_len underf

In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_a

In the Linux kernel, the following vulnerability has been resolved: s390/qeth: Check CAP_NET_ADMIN for private ioctls

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix potential UAF on meter attach

In the Linux kernel, the following vulnerability has been resolved: i2c: imx: Cancel hrtimer before clearing slave poin

In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: peak_usb_start(): fix double free of

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Supply the overflow slot size in BPOS, not

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Zero the tile state data array before each

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversize