Linux kernel.

ntfs: bound the attribute-list entry in ntfs_read_inode_mount()

• Linux kernel

ntfs3: Allocate iomap inline_data using alloc_page

• Linux kernel

alpha/PCI: Add security_locked_down() check to pci_mmap_resource()

• Linux kernel

tipc: avoid busy looping in tipc_exit_net()

• Linux kernel

bpf: Add missing access_ok call to copy_user_syms

• Linux kernel

RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp

• Linux kernel

RDMA/rxe: Fix OOB in free_rd_atomic_resources()

• Linux kernel

nvme-tcp: fix usage of page_frag_cache

• Linux kernel

usb: xhci: bail out of setup if the controller is inaccessible

• Linux kernel

fuse: fix race between interrupt and resend

• Linux kernel

fuse: fix missing barrier when checking io-uring readiness

• Linux kernel

fuse: publish io-uring queues with release semantics

• Linux kernel

fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free

• Linux kernel

fuse: fix invalidate lock leak on setattr writeback failure

• Linux kernel

fuse: fix invalidate lock leak on open O_TRUNC DAX failure

• Linux kernel

usb: gadget: f_tcm: keep port count until LUN teardown completes

• Linux kernel

KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts

• Linux kernel

tls: device: fix out-of-bounds write in tls_append_frag()

• Linux kernel

gtp: serialize PDP context updates

• Linux kernel

tcp: fix AO info use-after-free in tcp_ao_connect_init()

• Linux kernel

net/tcp-ao: fix use-after-free of current_key on reconnect to another peer

• Linux kernel

xfrm: espintcp: fix UAF during close

• Linux kernel

tcp: clamp route advmss to TCP_MIN_MSS

• Linux kernel

xfrm: drop ESP-in-TCP packets with no ingress device

• Linux kernel

xfrm: avoid lock inversion in nat keepalive work

• Linux kernel

xfrm: ah6: validate routing header segments_left

• Linux kernel

xfrm: fix xfrm_state_construct() auth-trunc leak

• Linux kernel

net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

• Linux kernel

net/packet: defer vmalloc TX_RING free until skbs finish

• Linux kernel

ipv6: seg6: clear IPv4 control block on IPIP decapsulation

• Linux kernel

batman-adv: reject unrepresentable multicast TVLV offsets

• Linux kernel

vxlan: keep the last remote linked during FDB flush

• Linux kernel

netfilter: nf_tables: don't queue packet path object notifications

• Linux kernel

crypto: virtio - bound the akcipher result length

• Linux kernel

crypto: qcom-rng - Remove crypto_rng interface

• Linux kernel

crypto: sun8i-ce - Remove crypto_rng interface

• Linux kernel

crypto: sun8i-ss - Remove crypto_rng interface

• Linux kernel

crypto: qce - fix CCM AAD buffer underallocation

• Linux kernel

crypto: mxs-dcp - fix source scatterlist length access

• Linux kernel

usb: core: Add lock to usb_wakeup_notification()

• Linux kernel

ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

• Linux kernel

ALSA: usb-audio: Complete cleanup after system-resume errors

• Linux kernel

USB: serial: option: fix slab OOB read in interrupt URB callback

• Linux kernel

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

• Linux kernel

wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb

• Linux kernel

usb: usbfs: fix use-after-free of usb_device in usbdev_release()

• Linux kernel

nfc: st21nfca: validate ATR_REQ length against the received frame

• Linux kernel

mailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()

• Linux kernel

nvmet: pci-epf: put CQ ref on create_cq mapping failure

• Linux kernel

xfs: don't livelock in scrub on a circular unlinked list

• Linux kernel

Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept

• Linux kernel

iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown

• Linux kernel

iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages

• Linux kernel

ALSA: FCP: Use a private URB for the notification endpoint

• Linux kernel

ALSA: scarlett2: Use a private URB for the notification endpoint

• Linux kernel

rndis_host: add overflow check in rndis_rx_fixup()

• Linux kernel

nvmet: fix NULL pointer dereference in nvmet_execute_identify_nslist()

• Linux kernel

ALSA: dummy: Check card index validity at probe

• Linux kernel

io_uring/rsrc: fix folio size overflow in io_vec_fill_bvec()

• Linux kernel

ocfs2: fix missing metadata reservation for large xattrs

• Linux kernel