Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

Libvirt: swtpm privilege escalation via symlink following

Udisks2: udisks2: local privilege escalation via as-user option spoofing

Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection

Criu: criu: container escape via rseq critical section hijack during checkpoint/restore

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

accel/ivpu: Fix signed integer truncation in IPC receive

USB: serial: kl5kusb105: fix bulk-out buffer overflow

zram: fix use-after-free in zram_bvec_write_partial()

mm/list_lru: drain before clearing xarray entry on reparent

drm/gem: Try to fix change_handle ioctl, attempt 4

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

bpf: Fix linked reg delta tracking when src_reg == dst_reg

bpf: Fix ld_{abs,ind} failure path analysis in subprogs

bpf: fix mm lifecycle in open-coded task_vma iterator

bpf: Enforce regsafe base id consistency for BPF_ADD_CONST scalars

dm log: fix out-of-bounds write due to region_count overflow

bpf, sockmap: Take state lock for af_unix iter

ice: fix double-free of tx_buf skb

netfilter: nat: use kfree_rcu to release ops

sched/psi: fix race between file release and pressure write

drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

futex: Drop CLONE_THREAD requirement for private default hash alloc

drm/xe/dma-buf: handle empty bo and UAF races

drm/xe/dma-buf: fix UAF with retry loop

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

net/sched: fix pedit partial COW leading to page cache corruption

net: gro: don't merge zcopy skbs

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

RDMA/mana: Validate rx_hash_key_len

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

rxrpc: Fix potential UAF after skb_unshare() failure

gfs2: Fix use-after-free in iomap inline data write path