Chromium: CVE-2026-2316 Insufficient policy enforcement in Frames

mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()

btrfs: do not strictly require dirty metadata threshold for metadata writepages

net: fix segmentation of forwarding fraglist GRO

Chromium: CVE-2026-2314 Heap buffer overflow in Codecs

btrfs: send: check for inline extents in range_is_hole_in_parent()

Chromium: CVE-2026-2313 Use after free in CSS

tracing: Add recursion protection in kernel stack trace recording

of: unittest: Fix memory leak in unittest_data_add()

netdevsim: fix a race issue related to the operation on bpf_bound_progs list

rxrpc: Fix data-race warning and potential load/store tearing

io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop

scsi: core: Wake up the error handler when final completions race against each other

mm/hugetlb: fix hugetlb_pmd_shared()

tracing: Fix crash on synthetic stacktrace field usage

vsock/virtio: cap TX credit to local buffer size

vsock/virtio: fix potential underflow in virtio_transport_get_credit()

spi: spi-sprd-adi: Fix double free in probe error path

rxrpc: Fix recvmsg() unconditional requeue

dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()