Linux kernel.

scsi: bsg: Fix TOCTOU in io_uring passthrough command setup

• Linux kernel

scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame

• Linux kernel

scsi: pm8001: Use rollback index when freeing MSI-X vectors

• Linux kernel

samples/damon/mtier: handle damon_stop() failure

• Linux kernel

samples/damon/wsse: handle damon_start() failure

• Linux kernel

mm/damon/core: handle region split failure in apply_min_nr_regions()

• Linux kernel

futex: Prevent rcuwait use-after-free during requeue PI

• Linux kernel

ftrace: Take trace_array reference before accessing its ftrace_ops

• Linux kernel

HID: bpf: serialize device reference release in struct_ops destroy path

• Linux kernel

HID: rmi: fix OOB access with undersized RMI reports

• Linux kernel

HID: wacom: validate report length in wacom_intuos_pro2_bt_irq

• Linux kernel

dm: fix race when loading and unloading a table

• Linux kernel

dm: fix resume-vs-remove race

• Linux kernel

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

• Linux kernel

dma-direct: return struct page from dma_direct_alloc_from_pool()

• Linux kernel

dmaengine: fsl-edma: tracing: no ptr dereference during log output

• Linux kernel

dmaengine: dw-edma: Initialize IRQ data before requesting IRQs

• Linux kernel

cpuidle: dt_idle_genpd: kfree() the original name allocation

• Linux kernel

bpf: Fix infinite loop in pcpu_freelist push with one possible CPU

• Linux kernel

ceph: lock mutex in ceph_mds_check_access()

• Linux kernel

ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()

• Linux kernel

kprobes: Protect kprobe_blacklist with RCU

• Linux kernel

mm/huge_memory: transfer the pmd dirty bit to the folio on zap

• Linux kernel

mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()

• Linux kernel

memcg: keep folio's objcg same as its node

• Linux kernel

perf/x86/intel: Fix kernel address leakages in LBR stack

• Linux kernel

i2c: core: fix debugfs UAF on adapter removal

• Linux kernel

i2c: mux: Fix channel node leak on adapter add failure

• Linux kernel

arm64: Don't read GMID_EL1 when MTE is disabled

• Linux kernel

ALSA: harmony: initialize locks before requesting IRQ

• Linux kernel

ALSA: pcm: Fix race between non-atomic ops and trigger-start

• Linux kernel

accel/amdxdna: return early from a zero-length flush

• Linux kernel

accel/ethosu: check MMIO mapping errors in probe

• Linux kernel

accel/ethosu: fix job completion fence cleanup

• Linux kernel

nvme-fabrics: fix DHCHAP secret leak on parse failure

• Linux kernel

nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails

• Linux kernel

nvme-tcp: check the data direction of a C2HData PDU

• Linux kernel

nvme: add missing SRCU grace period in error path

• Linux kernel

nvme: skip the zoned limits update if the zone info query failed

• Linux kernel

nvmet-auth: Synchronize timeout work during SQ teardown

• Linux kernel

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

• Linux kernel

nvmet-tcp: reject unsolicited H2CData PDUs

• Linux kernel

mm/migrate_device: avoid out-of-bounds writes for compound folios

• Linux kernel

mm/hugetlb_cma: fix null nodemask dereference in hugetlb_cma_alloc_frozen_folio

• Linux kernel

nvdimm/btt: reject an arena whose nfree is below the lane count

• Linux kernel

parisc: eisa: Fix infinite loop when parsing invalid IRQ value

• Linux kernel

powerpc/kexec_file: Fix null-ptr-def in extra size calculation

• Linux kernel

powerpc/kexec_file: Prevent kexec range truncation

• Linux kernel

powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population

• Linux kernel

s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()

• Linux kernel

s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove

• Linux kernel

s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL

• Linux kernel

s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed

• Linux kernel

s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects

• Linux kernel

s390/vfio-ap: Fix NULL deref in status_show() during queue probe

• Linux kernel

mtd: afs: validate v2 image info bounds

• Linux kernel

mtd: mtdoops: free page bitmap when the backing MTD is removed

• Linux kernel

mtd: rawnand: validate ONFI extended parameter page sections

• Linux kernel

batman-adv: fix stale receive device on merged fragments

• Linux kernel

batman-adv: mcast: linearize skbuff for packet generation

• Linux kernel