Linux kernel.

Bluetooth: MGMT: free the HCI command when it is cancelled

• Linux kernel

Bluetooth: MSFT: validate evt_prefix_len against the response length

• Linux kernel

bpf, cgroup: Fix storage null-ptr-deref after replacing prog

• Linux kernel

iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes

• Linux kernel

net/sched: cls_api: fix teardown of an adopted proto on insert-race loss

• Linux kernel

bpf: Fix mmap_lock leak in irq_work path

• Linux kernel

apparmor: fix integer overflow in verify_tags() bounds check

• Linux kernel

fbdev: kyro: Validate overlay viewport coordinates

• Linux kernel

iommu/dma: Restore locking around msi_page_list

• Linux kernel

iommu/vt-d: Clear Present bit before tearing down copied context entry

• Linux kernel

iommu/vt-d: Fix iopf_refcount leak on RID domain replacement

• Linux kernel

iommu/vt-d: Tear down scalable-mode context on probe failure

• Linux kernel

iommu/vt-d: Flush context cache with correct SID when tearing down aliases

• Linux kernel

media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()

• Linux kernel

media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path

• Linux kernel

netfilter: nft_ct: move custom expectation support to helper

• Linux kernel

NFSD: Release the export reference when reaping open stateids

• Linux kernel

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

• Linux kernel

NFS: Return a delegation the client fails to record

• Linux kernel

nvme-pci: release descriptor pools on probe failure

• Linux kernel

amt: Don't support cross-netns setup.

• Linux kernel

apparmor: fix unconfined user namespace restriction forced stack

• Linux kernel

nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()

• Linux kernel

nvme-apple: Destroy the admin queue on removal

• Linux kernel

nvmet: fix NULL pointer dereference in nvmet_execute_identify_ns_zns()

• Linux kernel

nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

• Linux kernel

nfc: llcp: avoid userspace overflow on invalid optlen

• Linux kernel

nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

• Linux kernel

nfc: nci: fix double completion race in nci_data_exchange_complete

• Linux kernel

nfc: llcp: bound SNL TLV parsing to the skb and add length checks

• Linux kernel

nfc: pn533: hold a reference to the request skb during send_frame

• Linux kernel

nfc: nci: fix use of uninitialized memory in CORE_INIT_RSP parsing

• Linux kernel

ALSA: seq: Don't leak the extension cell pointer in the bounce payload

• Linux kernel

RDMA/cxgb4: Free debugfs on registration failure

• Linux kernel

RDMA/cma: Fix WARNING in res_to_rt

• Linux kernel

bpf: Compare iterator types during state pruning

• Linux kernel

ubi: Fix rollback for explicit UBI device numbers

• Linux kernel

mtd: ubi: Release device reference on busy detach

• Linux kernel

ASoC: xilinx: formatter_pcm: fix stream_data leak on open error

• Linux kernel

firewire: core: fix memory leak in error path of build_tree()

• Linux kernel

arm64/efi: Avoid voluntary preemption with efi_mm installed

• Linux kernel

bpf, s390: Clear fetch destination on faulting arena atomic

• Linux kernel

bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure

• Linux kernel

s390/debug: Fix deadlock during unregister

• Linux kernel

clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type

• Linux kernel

ALSA: seq: midi: Serialize input teardown with event_input

• Linux kernel

nvmet: fix max_qid race between configfs and controller allocation

• Linux kernel

ocfs2: validate orphan slot during inode read

• Linux kernel

ocfs2: validate DIO orphan slot during inode read

• Linux kernel

Squashfs: check block offset is not negative

• Linux kernel

scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers

• Linux kernel

net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race

• Linux kernel

fs/ntfs3: fix integer overflow in MFT cluster validation

• Linux kernel

fs/ntfs3: reject out-of-range evcn in mi_enum_attr()

• Linux kernel

ALSA: core: Fix use-after-free in snd_card_do_free()

• Linux kernel

HID: haptic: don't write an uninitialized value to unhandled usages

• Linux kernel

ASoC: SOF: validate topology volume range before allocation

• Linux kernel

riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args

• Linux kernel

ACPI: scan: fix bus ID cleanup on device_add() failures

• Linux kernel

mailbox: qcom-cpucp: fix PREEMPT_RT self-deadlock in IRQ handler

• Linux kernel