CVE-2026-98372

xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk...

CVE-2026-98371

xfrm: iptfs: fix runt reassembly panic from short inner totlen...

CVE-2026-98369

xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject...

CVE-2026-98370

xfrm: fix compat ALLOCSPI request use-after-free...

CVE-2026-98368

esp: downgrade zerocopy managed frags before mutating skb frags...

CVE-2026-98367

RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept...

CVE-2026-98366

RDMA/rxe: validate access flags before swapping the MR's PD...

CVE-2026-98364

xfrm: hold netdevice reference under RCU in bundle creation...

CVE-2026-98365

RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access...

CVE-2026-98363

firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS...

CVE-2026-98362

clk: scpi: bound-check DVFS index in scpidvfsrecalcrate...

CVE-2026-98361

RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths...

CVE-2026-98360

RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds...

CVE-2026-98359

RDMA/core: Reject unregistering netdevs in ibgetethspeed...

CVE-2026-98358

IB/iser: reject a remote invalidation of an unregistered direction...

CVE-2026-98357

IB/isert: wait for deferred control PDU completions before releasing the connection...

CVE-2026-98356

RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup...

CVE-2026-98355

RDMA/rtrs: guard against null kobj name...

CVE-2026-98354

RDMA/mad: Fix receive buffer leak when PKey enforcement fails...

CVE-2026-98353

RDMA/erdma: Use IRQ-safe XArray helpers for QP and CQ tables...

CVE-2026-98352

RDMA/rtrs-clt: Fix CQ pool leak when connect is interrupted...

CVE-2026-98351

wifi: virtwifi: free skb when disconnected...

CVE-2026-98350

wifi: brcmfmac: cyw: pass PMKID to firmware if present...

CVE-2026-98349

wifi: libipw: reject too-short beacon and probe responses...

CVE-2026-98347

IB/IPoIB: Avoid restoring OPERUP after multicast flush...

CVE-2026-98348

wifi: libipw: reject too-short association responses...

CVE-2026-98346

wifi: cfg80211: don't get the radio mask for netdev-less wdevs...

CVE-2026-98345

wifi: cfg80211: check IP header size in cfg80211classify8021d...

CVE-2026-98344

dmaengine: Fix device kref underflow in dmachanput...

CVE-2026-98343

dmaengine: fix use-after-free in dmachanput and dmareleasechannel...

CVE-2026-98342

dmaengine: wait for RCU readers before releasing dmadevice...

CVE-2026-98341

wifi: cfg80211: don't free driver-owned scan requests...

CVE-2026-98340

wifi: cfg80211: only group hidden BSSes with beacon entries...

CVE-2026-98338

wifi: cfg80211: ibss: ref BSS entry for joined event...

CVE-2026-98339

wifi: cfg80211: don't filter by BSS type when removing stale entries...

CVE-2026-98337

wifi: mac80211: don't start a ROC while scanning...

CVE-2026-98336

wifi: mac80211: don't offload TC setup on APVLAN interfaces...

CVE-2026-98335

wifi: mac80211: abort chanswitch when leaving a mesh...

CVE-2026-98334

wifi: mac80211: reset state when starting AP fails...

CVE-2026-98333

wifi: mac80211: reset the LED state when ifup fails...

CVE-2026-98332

wifi: mac80211: only operate on TDLS peers in the TDLS code...

CVE-2026-98331

wifi: mac80211: unlist vifs when their netdev is unregistered...

CVE-2026-98330

wifi: cfg80211: get the wiphy out of a dying network namespace...

CVE-2026-98329

wifi: mac80211: don't allow injecting frames wider than the chanctx...

CVE-2026-98328

wifi: mac80211: add HE 6 GHz capability in the scan elems len...

CVE-2026-98327

wifi: mac80211: mesh: reset the CSA state when leaving...

CVE-2026-98326

wifi: mac80211: mesh: release the channel if start fails...

CVE-2026-98325

wifi: mac80211: set up the TX info early to fix failure paths...

CVE-2026-98323

RDMA/siw: Bound fragmented header copies by the remaining length...

CVE-2026-98324

dmaengine: pxa: fix double counting of the hw descriptors...