Linux kernel.

ipv6: use RCU iterator to dump route exceptions

• Linux kernel

phy: fsl-imx8mq-usb: fix typec switch leak on probe error path

• Linux kernel

svcrdma: Fix unmatched rn_unregister on failed accept

• Linux kernel

staging: media: tegra-video: fix of_node_put() on VIP parse errors

• Linux kernel

signal: avoid shared siginfo namespace rewrites

• Linux kernel

nfsd: convert nfsd_net boolean flags to unsigned long flags word

• Linux kernel

sched_ext: Keep kick_sync waiting on the rq's own CPU

• Linux kernel

clocksource/drivers/timer-sun4i: Advertise a real minimum delta

• Linux kernel

mm/huge_memory: skip device-private PMDs in madvise_free_huge_pmd

• Linux kernel

mm/madvise: skip device-private PMDs in cold and pageout walks

• Linux kernel

mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()

• Linux kernel

cdx: Fix double free when sysfs file creation fails

• Linux kernel

usb: gadget: f_tcm: fix deadlock in usbg_make_tpg()

• Linux kernel

of: fix out-of-bounds read in of_alias_scan() stem parser

• Linux kernel

nfsd: guard nfsd_serv deref in nfsd_file_net_dispose

• Linux kernel

nfsd: initialize DRC hash table before registering shrinker

• Linux kernel

smb: client: harden DFS cache against invalid target hints

• Linux kernel

Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb

• Linux kernel

kasan: fix cache shrink race with CPU hotplug

• Linux kernel

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

• Linux kernel

PCI/proc: Use file_ns_capable() when checking config space read access

• Linux kernel

iommu/arm-smmu-v3: Manage teardown with devm

• Linux kernel

batman-adv: dat: atomically update mac addresses

• Linux kernel

batman-adv: bla: avoid CRC corruption due to parallel claim add

• Linux kernel

i3c: master: Fix recursive locking during device registration

• Linux kernel

dm-pcache: validate seg_id fields from persistent memory

• Linux kernel

i3c: master: Fix use-after-free of master->this

• Linux kernel

i3c: master: Do not treat master device as a duplicate target

• Linux kernel

dm-pcache: validate the persisted dirty_tail chain at load

• Linux kernel

memcg: move LRU size accounting on reparenting instead of copying it

• Linux kernel

nvdimm: virtio_pmem: refcount requests for token lifetime

• Linux kernel

drm/bridge: synopsys: dw-dp: Support unregistering the AUX channel

• Linux kernel

drm/rockchip: dw_dp: Release core resources

• Linux kernel

drm/rockchip: analogix_dp: Fix OF node reference leak via auto cleanup

• Linux kernel

drm/v3d: Clear queue->active_job when v3d_fence_create() fails

• Linux kernel

smack: fix incorrect task context in smack_msg_queue_msgrcv

• Linux kernel

platform/chrome: cros_ec_typec: Reject out-of-bounds PD cap count

• Linux kernel

HID: core: quiesce input in hid_hw_stop() to prevent use-after-free

• Linux kernel

HID: roccat: bound device-supplied profile index

• Linux kernel

ASoC: SOF: ipc4-topology: Return error for invalid number of formats

• Linux kernel

cxl/mbox: Clamp mailbox output allocation to the payload size

• Linux kernel

ASoC: rt700-sdw: always drain jack work on remove

• Linux kernel

ASoC: fsl_audmix: rework runtime PM handling in probe

• Linux kernel

drm/lima: call drm_mm_init() with a valid allocation range

• Linux kernel

sched/fair: Fix overflow in update_tg_cfs_runnable()

• Linux kernel

perf/x86/intel/uncore: Fix uncore_box ref/unref ordering

• Linux kernel

drm/panthor: Fix NPD issue on partial unmap of an evicted BO

• Linux kernel

drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read

• Linux kernel

drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

• Linux kernel

drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup

• Linux kernel

drm/amd/display: Fix dangling pointer in plane reset function

• Linux kernel

drm/amd/display: Fix dangling pointer in CRTC reset function

• Linux kernel

bpf: Copy per-CPU map value padding in copy_map_value_long()

• Linux kernel

bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

• Linux kernel

mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug

• Linux kernel

leds: lp5860: Fix a potential double-unlock

• Linux kernel

dmaengine: xilinx_dma: Fix channel idle state management in AXIDMA and MCDMA interrupt handlers

• Linux kernel

dmaengine: zynqmp_dma: fix race between runtime PM and device removal

• Linux kernel

dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout

• Linux kernel

csky: Fix a4/a5 restoration in syscall trace path

• Linux kernel