Linux kernel.

clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path

• Linux kernel

fs: fix user path of nested backing files

• Linux kernel

ovl: fix double end_creating() on the casefold-mismatch path

• Linux kernel

pidfd: hold exec_update_lock around namespace ioctl

• Linux kernel

timers/itimer: Zero-init old itimerval before copy to userspace

• Linux kernel

rust: devres: fix race between concurrent revokers

• Linux kernel

KEYS: trusted: Fix TPM teardown ordering

• Linux kernel

apparmor: fix cred UAF caused by begin_current_label_crit_section()

• Linux kernel

apparmor: fix out-of-bounds write when null terminating a label vec

• Linux kernel

mm, swap: don't free a hibernation slot that is in the swap cache

• Linux kernel

mm/kmemleak: avoid soft lockup when scanning task stacks

• Linux kernel

mm/mempolicy: skip non-present PMDs when queueing folios

• Linux kernel

mm/mglru: fix and remove redundant unevictable folio handling

• Linux kernel

mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()

• Linux kernel

mm/migrate_device: clear stale mapping after freeing swapcache

• Linux kernel

mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

• Linux kernel

mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec()

• Linux kernel

mm: memcg: stop reclaim when a limit update is superseded

• Linux kernel

x86/tdx: Fix off-by-one in port I/O handling

• Linux kernel

tracing/user_events: Clear copied tracing state before fork duplication

• Linux kernel

tracing: Fix crash passing ERR_PTR to kthread_stop()

• Linux kernel

tracing: Fix retry exhaustion in simple ring buffer reader swap

• Linux kernel

tracing: Fix use-after-free in trace_pipe read on sub-buffer order change

• Linux kernel

tracing: Fix use-after-free with same-name named triggers

• Linux kernel

debugfs: Fix lockdown check for mmap_prepare

• Linux kernel

device property: fix infinite loop in fwnode_for_each_child_node()

• Linux kernel

misc: nsm: bound the device-reported response length

• Linux kernel

rapidio: mport_cdev: fix use-after-free in dma_req_free()

• Linux kernel

Revert "media: v4l2-dev: fix error handling in __video_register_device()"

• Linux kernel

serial: imx: serialize imx_uart_ports[] lifetime

• Linux kernel

usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition

• Linux kernel

usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed

• Linux kernel

usb: typec: thunderbolt: Disable work before freeing tbt on remove

• Linux kernel

usb: gadget: u_audio: Fix use-after-free on sound card disconnect

• Linux kernel

usb: gadget: midi2: remove default configfs groups on teardown

• Linux kernel

usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init()

• Linux kernel

usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind()

• Linux kernel

usb: gadget: f_fs: Prevent deadlock during ep0 read loop

• Linux kernel

cxl/ras: Fix cxl_rch_get_aer_info() out-of-bounds AER register read

• Linux kernel

fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write

• Linux kernel

HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature

• Linux kernel

i3c: renesas: Fix out-of-bounds access for newdevs mask

• Linux kernel

KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID

• Linux kernel

lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

• Linux kernel

media: cec: stm32: prevent out-of-bounds write on RX overflow

• Linux kernel

media: vicodec: fix out-of-bounds write in FWHT encoder

• Linux kernel

nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation

• Linux kernel

PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()

• Linux kernel

phy: rockchip-samsung-dcphy: fix out-of-range max_register

• Linux kernel

ubifs: fix out-of-bounds read in signature length check

• Linux kernel

zram: fix out-of-bounds access in read_block_state()

• Linux kernel

zram: fix out-of-bounds access in writeback_store()

• Linux kernel

zram: set default primary compressor in zram_destroy_comps()

• Linux kernel

zram: validate deflate params

• Linux kernel

NFS/localio: fix ref leak on nfs_uuid_add_file failure

• Linux kernel

NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails

• Linux kernel

NFSD: check truncate permission under inode lock

• Linux kernel

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

• Linux kernel

NFSD: remove flawed WARN_ON_ONCE from nfsd_mode_check

• Linux kernel

NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path

• Linux kernel