Gimp: gimp: heap out-of-bounds read/write in psd thumbnail loader (load_resource_1033)

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

Dpdk: dpdk: double offset bug in vhost log mapping calculation

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

Librsvg: use-after-free when xml includes have duplicated entities

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

Emacs: emacs: arbitrary code execution in flymake mode

Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)

Gimp: integer overflow when generating a thumbnail preview for a psd file

Crun: crun: rootful krun with passt executes container payload as host root

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

Emacs: emacs: command injection via crafted filenames in tramp

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Libvirt: swtpm privilege escalation via symlink following

Udisks2: udisks2: local privilege escalation via as-user option spoofing

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

accel/ivpu: Fix signed integer truncation in IPC receive

USB: serial: kl5kusb105: fix bulk-out buffer overflow

zram: fix use-after-free in zram_bvec_write_partial()

mm/list_lru: drain before clearing xarray entry on reparent

drm/gem: Try to fix change_handle ioctl, attempt 4

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

bpf: Fix linked reg delta tracking when src_reg == dst_reg

bpf: Fix ld_{abs,ind} failure path analysis in subprogs

bpf: fix mm lifecycle in open-coded task_vma iterator

bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars

dm log: fix out-of-bounds write due to region_count overflow

bpf, sockmap: Take state lock for af_unix iter

ice: fix double-free of tx_buf skb

netfilter: nat: use kfree_rcu to release ops

sched/psi: fix race between file release and pressure write

drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

futex: Drop CLONE_THREAD requirement for private default hash alloc

drm/xe/dma-buf: handle empty bo and UAF races

drm/xe/dma-buf: fix UAF with retry loop

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall