- crypto: algif_aead - Fix minimum RX size check for decryption - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: scatterwalk - Backport memcpy_sglist() - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998} - xfrm: add NULL check in xfrm_update_ae_params {CVE-2023-3772} - sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296} - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327} - ext4: fix uninititialized value in 'ext4_evict_inode' {CVE-2022-50546} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149} - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577} - net: add dst_dev_rcu() helper for safe dst->dev access {CVE-2025-40135} - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} - net: add skb_header_pointer_careful() helper - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623} - ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559} - e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898} - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751} - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380} - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207} - ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() {CVE-2022-50698} - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() {CVE-2022-50699} - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() {CVE-2023-54014} - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085} - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089} - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193} - drm/i915/gvt: fix gvt debugfs destroy {CVE-2023-54098} - nfsd: provide locking for v4_end_grace {CVE-2026-22980} - dm flakey: don't corrupt the zero page {CVE-2023-54317} - drm/amdkfd: Fix double release compute pasid {CVE-2022-50303} - RDMA/srpt: Fix a use-after-free {CVE-2022-50129} - RDMA/srpt: Introduce a reference count in struct srpt_device - RDMA/srpt: Duplicate port name members - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885} - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796} - mmc: core: use scnprintf() instead of sprintf() in sysfs show functions {CVE-2022-49267} - rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744} - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375} - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254} - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286} - RDMA/rxe: Fix mr->map double free {CVE-2022-50543} - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881} - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865} - NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945} - perf/aux: Fix AUX buffer serialization {CVE-2024-46713} - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882} - usb: xhci: Complete 'error mid TD' transfers when handling Missed Service - usb: xhci: remove 'handling_skipped_tds' from handle_tx_event() - xhci: simplify event ring dequeue tracking for transfer events - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728} - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563} - i40e: add validation for ring_len param {CVE-2025-39973} - i40e: increase max descriptors for XL710 - RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539} - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103} - HID: hyperv: Correctly access fields declared as __le16 {CVE-2025-38103} - ASoC: topology: Fix references to freed memory {CVE-2024-41069} - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596} - ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673} - net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538} - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271} - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class