Linux kernel.

svcrdma: Reject Read lists that exceed the page budget

• Linux kernel

svcrdma: Use svc_xprt_put to free listener on create failure

• Linux kernel

svcrdma: Validate Read chunk positions before reconstruction

• Linux kernel

udf: reject VAT indexes equal to the entry count

• Linux kernel

wifi: ath6kl: clamp assoc request/response lengths before subtracting IE offsets

• Linux kernel

wifi: mt76: mt7925: cancel pending mlo_pm_work

• Linux kernel

media: staging/ipu7: fix async notifier UAF on probe error path

• Linux kernel

sched/core: Handle pick_task() releasing the rq lock

• Linux kernel

sched/core: Make core-sched flips wait for in-flight selections

• Linux kernel

sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return

• Linux kernel

sched_ext: Fix this_rq() assumptions in dispatch kfuncs

• Linux kernel

sched_ext: Fix rq->core_pick corruption under core scheduling

• Linux kernel

sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users

• Linux kernel

scsi: core: Fill in DMA padding bytes in scsi_alloc_sgtables()

• Linux kernel

scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock

• Linux kernel

RISC-V: KVM: Fix PMU event info array size overflow

• Linux kernel

remoteproc: scp: Fix device reference leak on failed lookup

• Linux kernel

qede: Fix NULL pointer dereference in TPA fragment processing

• Linux kernel

RDMA/cxgb4: Cancel reg_work before freeing device on remove

• Linux kernel

RDMA/ionic: Embed counter driver data in rdma_counter allocation

• Linux kernel

RDMA/ucma: Lock the handler in ucma_set_ib_path()

• Linux kernel

RDMA/ucma: Lock the handler in ucma_write_cm_event()

• Linux kernel

RDMA/uverbs: Add UVERBS_ATTR_UHW to UVERBS_METHOD_REG_MR

• Linux kernel

RDMA/uverbs: Guard legacy bundles without method_elm

• Linux kernel

regulator: as3722_get_regulator_dt_data: fix premature of_node_put leaving dangling of_node pointer

• Linux kernel

ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page()

• Linux kernel

ring-buffer: Free cpu_buffer::free_page with subbuf_order

• Linux kernel

ring-buffer: Hold cpu_buffer::lock when resizing a subbuf

• Linux kernel

ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page

• Linux kernel

ring-buffer: Stop remote reader update when page swap fails

• Linux kernel

orangefs: fix double-free of trailer_buf on readdir copy failure

• Linux kernel

orangefs: skip leading spaces before parsing client debug masks

• Linux kernel

ocfs2: always run deallocs on copy-on-write completion

• Linux kernel

ocfs2: bound namelen in dlm_migrate_request_handler

• Linux kernel

ocfs2: validate lengths in dlm_mig_lockres_handler

• Linux kernel

ocfs2: validate rl_used against rl_count in refcount block validator

• Linux kernel

ocfs2: validate directory-index entry counts when reading metadata

• Linux kernel

ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

• Linux kernel

ocfs2: fix readdir position truncation on 32-bit kernels

• Linux kernel

openrisc: fix arbitrary kernel memory access via or1k_atomic syscall

• Linux kernel

openvswitch: Fix CT limit teardown use-after-free

• Linux kernel

openvswitch: only skb_tx_error() a packet we are about to drop

• Linux kernel

ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

• Linux kernel

lockd: pin next file across nlm_inspect_file lock-drop

• Linux kernel

lockd: fix NULL dereference on lockowner allocation failure

• Linux kernel

nvme: zero the discard fallback page

• Linux kernel

nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone

• Linux kernel

nvme-tcp: fix host memory disclosure on R2T for a read command

• Linux kernel

nvme-tcp: reject a read that transferred too few bytes

• Linux kernel

sctp: stop processing a packet once its association is deleted

• Linux kernel

sctp: drop a chunk if its transport was removed

• Linux kernel

sctp: fix NULL deref on untransmitted RECONF completion

• Linux kernel

sctp: fix stream->outcnt underflow on duplicate RECONF responses

• Linux kernel

power: supply: bq24257: fix use-after-free on remove

• Linux kernel

power: supply: bq256xx: drain usb_work before freeing the charger

• Linux kernel

power: supply: bq25890: Fix power_supply reference leak

• Linux kernel

power: supply: charger-manager: register regulators before exposing sysfs

• Linux kernel

power: supply: cros_usbpd-charger: bound the EC-reported port count

• Linux kernel

power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

• Linux kernel

power: supply: lp8727: fix use-after-free in lp8727_release_irq()

• Linux kernel