Linux kernel.

crash_dump: release keyring reference at the correct time

• Linux kernel

esp: do not unref managed frag pages in esp_ssg_unref()

• Linux kernel

RDMA/rvt: Return NULL after port allocation failure

• Linux kernel

RDMA/hfi1: Preserve unit 0 on allocation failure

• Linux kernel

RDMA/hfi1: Free RX data on late probe failure

• Linux kernel

media: v4l2-async: Unregister sub-device if asc_list is empty

• Linux kernel

fs/resctrl: Prevent use-after-free in rdtgroup_kn_put()

• Linux kernel

fs/resctrl: Fix UAF from worker threads when domains are removed

• Linux kernel

rpmsg: glink: fix deadlock in endpoint destroy during driver detach

• Linux kernel

cxl/mbox: Break poison list loop on an empty payload

• Linux kernel

cxl/features: Serialize multi-part Get/Set Feature transfers

• Linux kernel

hfsplus: validate thread record before delete key rebuild

• Linux kernel

wifi: ath12k: fix dp_link_peer dangling references on AP vdev rollback

• Linux kernel

firmware: arm_scmi: Publish channel state before callbacks

• Linux kernel

firmware: arm_scmi: Unregister device notifier before IDR teardown

• Linux kernel

firmware: arm_scmi: Quiesce notifications before teardown

• Linux kernel

firmware: arm_scmi: Clean up channels on setup failure

• Linux kernel

firmware: arm_scmi: Free transport channel on IDR failure

• Linux kernel

firmware: arm_scmi: Avoid IDR updates while cleaning channels

• Linux kernel

firmware: arm_scmi: Reject out of range DT protocol IDs

• Linux kernel

firmware: arm_scmi: Drop handle on protocol bind failures

• Linux kernel

firmware: arm_scmi: Unwind TX receiver mailbox setup failure

• Linux kernel

firmware: arm_scmi: Unwind P2A receiver mailbox setup failure

• Linux kernel

firmware: arm_scmi: Fix SCMI device destroy lifetimes

• Linux kernel

firmware: arm_scmi: Fix transport device teardown lookup

• Linux kernel

cxl/features: Reject Get Feature count larger than the output buffer

• Linux kernel

cxl/features: Reject Set Features output buffer smaller than the header

• Linux kernel

cxl/features: Clamp Get Feature output size to the remaining buffer

• Linux kernel

dax/fsdev: clear vmemmap_shift when binding static pgmap

• Linux kernel

dax/fsdev: clear pgmap ops and owner on unbind

• Linux kernel

dax/fsdev: use __va(phys) for kaddr in direct_access

• Linux kernel

dax: read holder_ops once in dax_holder_notify_failure()

• Linux kernel

irqchip/renesas-irqc: Fix generic interrupt chip leak on remove

• Linux kernel

media: bcm2835-unicam: Fix asc leaked in error/remove path

• Linux kernel

media: ipu6: Do not free aux device pdata after init

• Linux kernel

OPP: Fix cleanup ordering

• Linux kernel

drm/amd/display: Fix DM I2C teardown race

• Linux kernel

drm/bridge: tc358767: clamp the reported AUX read size to the request

• Linux kernel

x86/mm/pat: Take cpa_lock around large-page collapse

• Linux kernel

wifi: iwlwifi: fix counter type in iwl_fwrt_dump_error_logs

• Linux kernel

wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser

• Linux kernel

wifi: iwlwifi: mei: check SAP message length before reading it

• Linux kernel

wifi: iwlwifi: guard against division by zero in iwl_dbg_tlv_alloc_fragments

• Linux kernel

gpu: host1x: Avoid stack over-read in debug output helpers

• Linux kernel

drm/msm/adreno: fix use after free on error path in a6xx_gpu_init()

• Linux kernel

drm/msm: Fix task_struct reference leak in recover_worker

• Linux kernel

drm/msm: Only fini scheduler after successful init

• Linux kernel

scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context

• Linux kernel

usb: gadget: f_uac1_legacy: remove broken string configfs attributes

• Linux kernel

UDF symlink pathComponent header OOB read

• Linux kernel

uio: Fix stale info pointer in failed registration path

• Linux kernel

speakup: keyhelp: guard letter_offsets possible out-of-range indexing

• Linux kernel

misc: bcm-vk: Use acquire/release for msgq_inited

• Linux kernel

misc: ad525x_dpot: use driver core groups for sysfs files

• Linux kernel

ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove

• Linux kernel

mtd: mtdswap: Avoid freeing registered blktrans device twice

• Linux kernel

mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()

• Linux kernel

drm/v3d: Associate BOs with every job that accesses them

• Linux kernel

software node: Fix software_node_get_reference_args() with index -1

• Linux kernel

bpf: Reject arena frees below the arena base

• Linux kernel