Linux kernel.

ACPI: APEI: GHES: fix ARM section length accounting after header

• Linux kernel

ACPI: pfr_update: fix stack buffer overflow in query_capability()

• Linux kernel

ata: libata-scsi: fix DSM TRIM for sector sizes larger than 2048 bytes

• Linux kernel

auxdisplay: charlcd: cancel backlight work on registration failure

• Linux kernel

block: validate user space vectors during extraction

• Linux kernel

Bluetooth: eir: Fix OOB read in eir_get_service_data()

• Linux kernel

bnx2x: fix double free in bnx2x_init_firmware() error path

• Linux kernel

bpf, x86: Fix per-CPU address resolution into an extended register

• Linux kernel

bpf: Disable preemption in __bpf_get_stack

• Linux kernel

bpf: Harden bloom filter sizing and indexing on 32-bit kernels

• Linux kernel

dm-io: clone the source bio instead of copying its biovec

• Linux kernel

dm-io: report non-retryable errors separatedly

• Linux kernel

dm-era: fix shadowed superblock leak on take-snap failure

• Linux kernel

dm raid1: reserve space for NUL-terminator in build_constructor_string()

• Linux kernel

dm array: validate array block headers on read

• Linux kernel

dm array: reject an array block whose value size is not the caller's

• Linux kernel

cpufreq: apple-soc: Fix OPP table cleanup

• Linux kernel

cxl/features: bound fwctl command payload to the input buffer

• Linux kernel

cxl/mce: Make the MCE notifier per-region

• Linux kernel

Bluetooth: RFCOMM: serialize security confirmation handling

• Linux kernel

kho: fix size calculation in kho_preserved_memory_reserve()

• Linux kernel

jbd2: bound shrinker scans by examined checkpoint buffers

• Linux kernel

jbd2: check need_resched() when skipping busy checkpoint buffers

• Linux kernel

ipip: fix skb leak in collect_md mode when metadata_dst allocation fails

• Linux kernel

ip: orphan prefetched skbs before multicast forwarding

• Linux kernel

ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

• Linux kernel

ip6_gre: fix hardware header length for NBMA tunnels

• Linux kernel

ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv()

• Linux kernel

landlock: Require LANDLOCK_ACCESS_FS_MAKE_REG for whiteout creation

• Linux kernel

libnvdimm/labels: Prevent integer overflow in __nd_label_validate()

• Linux kernel

md/raid10: fix still_degraded being inverted in raid10_sync_request()

• Linux kernel

md: do overflow check for sb->bblog_shift in super_1_load()

• Linux kernel

module: validate string table section types

• Linux kernel

mpls: reload header after pskb_may_pull()

• Linux kernel

mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

• Linux kernel

nouveau/gem: reserve the bo in the info ioctl around the vma lookup

• Linux kernel

params: fix charp corruption on allocation failure

• Linux kernel

SUNRPC: xdr_buf_trim: clamp buf->len to avoid underflow

• Linux kernel

SUNRPC: svcauth_gss: enforce krb5 token minimum length

• Linux kernel

sunrpc: route to a populated pool in svc_pool_for_cpu()

• Linux kernel

SUNRPC: always drain cache_cleaner before destroying a cache_detail

• Linux kernel

SUNRPC: Check svc pool percpu counter allocation

• Linux kernel

SUNRPC: close backchannel before destroying callback service

• Linux kernel

sunrpc: defer rq_argp and rq_resp free until after RCU grace period

• Linux kernel

SUNRPC: fix gssx_dec_option_array error path bugs

• Linux kernel

sunrpc: fix use-after-free in __rpc_clnt_handle_event and __rpc_clnt_remove_pipedir

• Linux kernel

SUNRPC: harden gss_krb5_unwrap_v2 against short tokens

• Linux kernel

SUNRPC: harden gss_unwrap_resp_priv length checks

• Linux kernel

sunrpc: init gssp_lock before publishing proc entry

• Linux kernel

SUNRPC: reject duplicate CREDS_VALUE options

• Linux kernel

SUNRPC: Reject krb5 v2 wrap tokens with oversized ec field

• Linux kernel

SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2

• Linux kernel

SUNRPC: wait for in-flight client TLS handshake callback

• Linux kernel

svcrdma: Reorder rpcrdma_rn_unregister before rdma_destroy_id

• Linux kernel

svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails

• Linux kernel

svcrdma: Fix offset arithmetic in read_chunk_range

• Linux kernel

svcrdma: Fix pcl_for_each_segment for empty chunks

• Linux kernel

svcrdma: Reject connection when transport allocation fails

• Linux kernel

svcrdma: Reject inline replies that overflow the pull-up buffer

• Linux kernel

svcrdma: Reject oversized Read segments at decode time

• Linux kernel