diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc
index d27d764..8d98c61 100644
--- a/meta/recipes-kernel/linux/cve-exclusion.inc
+++ b/meta/recipes-kernel/linux/cve-exclusion.inc
@@ -192,3 +192,62 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18"
 # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3
 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906
 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3"
+
+# No kernel fix exists or is planned; this is a consequence of Linux's
+# default weak host model. Mitigation is firewall configuration only
+# (e.g. the strong-host-model rule wg-quick(8) installs); IPv4 rp_filter
+# does not cover IPv6. Ubuntu: deferred since 2019-12-13; Red Hat tracks
+# it against openvpn; Debian does not track it against the kernel.
+CVE_STATUS[CVE-2019-14899] = "upstream-wontfix: no kernel fix exists or is \
+planned; weak host model design issue, mitigated by firewall configuration"
+
+# Inherent design property of KSM, not fixable without removing dedup.
+# Red Hat https://bugzilla.redhat.com/show_bug.cgi?id=1931327 CLOSED WONTFIX;
+# Debian: "Inherent design limitation, can be avoided by not using KSM".
+# Only exploitable when ksmd is enabled at runtime (default off) and the
+# workload opts in via MADV_MERGEABLE or PR_SET_MEMORY_MERGE.
+CVE_STATUS[CVE-2021-3714] = "upstream-wontfix: KSM memory deduplication \
+side channel is an inherent design limitation, Red Hat WONTFIX, no \
+upstream fix planned"
+
+# Proposed fixes were rejected or abandoned without a merge
+# (https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/,
+# https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/)
+# and the flagged fs/exec.c logic is unchanged as of linux-next 20260727.
+# Exploitation requires a relative kernel.core_pattern; a piped or
+# absolute core_pattern (e.g. systemd-coredump) prevents the issue.
+CVE_STATUS[CVE-2021-3864] = "upstream-wontfix: no accepted mainline fix \
+after several attempts; requires relative kernel.core_pattern to exploit"
+
+# Never substantiated: Red Hat
+# https://bugzilla.redhat.com/show_bug.cgi?id=2044575 CLOSED NOTABUG,
+# SUSE bugzilla #1195329 RESOLVED INVALID, Debian: "non issue, no
+# security impact". No affected version or upstream commit was ever
+# identified.
+CVE_STATUS[CVE-2022-0400] = "disputed: net/smc out-of-bounds read was \
+never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian"
+
+# Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061
+# Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45
+# rose->neighbour->use converted to refcount_t, removing the unlocked
+# use++ in rose_connect() that the CVE describes; backported to 6.1.y,
+# 6.6.y, 6.12.y and 6.16.y. The rose/hamradio subsystem was then removed
+# entirely in v7.1 (dd8d4bc28ad7).
+CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17"
+
+# EntryBleed (KASLR bypass via prefetch timing under KPTI, Intel x86
+# only). Entry text is still mapped _PAGE_GLOBAL into user page tables
+# (arch/x86/mm/pti.c). Upstream and Debian position is that KASLR is not
+# a boundary against local attackers. Note: v6.2 97e3d26b5e5f randomizes
+# the separate cpu_entry_area (that is CVE-2023-3640) and does not fix
+# this.
+CVE_STATUS[CVE-2022-4543] = "upstream-wontfix: no fix planned; KASLR is \
+not considered a defense against local attackers"
+
+# Fix https://git.kernel.org/linus/eecd203ada43a4693ce6fdd3a58ae10c7819252c
+# The CVE text names usb_giveback_urb() which does not exist in the
+# kernel; the reporter's PoC actually exercises the unthrottled URB
+# resubmit loop in drivers/media/rc/imon.c (printk flood on -EPROTO,
+# requires physical device access). The commit above stops the resubmit
+# loop. Ubuntu triage: "There is no system lockup happening."
+CVE_STATUS[CVE-2023-4010] = "fixed-version: Fixed from version 6.18"