Linux kernel.

xfs: fix under-reservation of blocks when repairing sf directories

• Linux kernel

xfs: fix the rtrmap and rtrefcount _maxlevels_ondisk functions

• Linux kernel

xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

• Linux kernel

xfs: don't spin forever on zero-length dirents when salvaging them

• Linux kernel

xfs: don't leak new_bp if xfs_btree_bload_drop_buf fails

• Linux kernel

xfs: don't leak dqacct if rhashtable insertion fails

• Linux kernel

xfs: destroy seen inode bitmap when we fail to add a dirpath

• Linux kernel

xfs: bail out on bitmap errors in xrep_agfl_fill

• Linux kernel

wifi: ath9k_htc: don't store usb_device_id

• Linux kernel

net: usb: pegasus: don't rely on id table pointer arithmetic

• Linux kernel

usb: xusbatm: don't rely on id table pointer arithmetic

• Linux kernel

hwmon: (asus_rog_ryujin) Validate HID report lengths

• Linux kernel

scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

• Linux kernel

scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown

• Linux kernel

scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size

• Linux kernel

f2fs: accurately adjust free_sections during free_segment_range

• Linux kernel

x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF

• Linux kernel

scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path

• Linux kernel

scsi: qla2xxx: Skip vport under deletion in report ID acquisition

• Linux kernel

scsi: qla2xxx: Fix soft lockup polling continuation IOCB signature

• Linux kernel

scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]

• Linux kernel

scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error

• Linux kernel

scsi: qla2xxx: Serialize NVMe unsol ctx list with a per-fcport lock

• Linux kernel

s390/pai: Support CPU hotplug for PMU PAI

• Linux kernel

x86/mm/pat: Allocate split page tables as kernel page tables

• Linux kernel

mptcp: avoid unneeded actions on subflow reset

• Linux kernel

mptcp: close race between scheduler and state change

• Linux kernel

mptcp: fix bad accounting in __mptcp_subflow_push_pending()

• Linux kernel

gfs2: fix quota init duplicate scan

• Linux kernel

gfs2: move quota_init qc iterator increment

• Linux kernel

drm/xe: Fix null pointer dereference in devcoredump cleanup

• Linux kernel

wifi: cfg80211: reject duplicate wiphy cipher suite entries

• Linux kernel

wifi: nl80211: reject beacons with bad HE operation

• Linux kernel

wifi: rtw88: Add NULL check for chip->edcca_th in rtw_fw_adaptivity_result()

• Linux kernel

i3c: master: svc: Prevent IRQ storm from false SLVSTART on NPCM845

• Linux kernel

media: chips-media: wave5: Fix Reports from Kernel Lock Validator

• Linux kernel

media: chips-media: wave5: Release m2m_ctx after Instance Removed from List

• Linux kernel

spi: spi-qcom-qspi: Fix incomplete error handling in runtime PM

• Linux kernel

wifi: mac80211: avoid out-of-bounds access in monitor

• Linux kernel

thunderbolt: Release request if tb_cfg_request() fails in __tb_xdomain_response()

• Linux kernel

thunderbolt: Keep XDomain reference during the lifetime of a service

• Linux kernel

thunderbolt: Set tb->root_switch to NULL when domain is stopped

• Linux kernel

media: dm1105: fix missing error check for dma_alloc_coherent

• Linux kernel

crypto: ixp4xx - fix buffer chain unwind on allocation failure

• Linux kernel

PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()

• Linux kernel

watchdog: lenovo_se10_wdt: Fix use-after-free and resource leak risk

• Linux kernel

genirq/proc: Size interrupt directory names for 10-digit interrupt numbers

• Linux kernel

mmc: davinci: avoid NULL deref of host->data in IRQ handler

• Linux kernel

pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction

• Linux kernel

wifi: rtw89: phy: check length before parsing PHY status IE

• Linux kernel

coresight: perf: Retrieve path and source from event data

• Linux kernel

drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction

• Linux kernel

drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

• Linux kernel

drm/amdkfd: Fix OOB memory exposure in get_wave_state()

• Linux kernel

drm/amdkfd: Check bounds on allocate_doorbell

• Linux kernel

drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

• Linux kernel

drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

• Linux kernel

wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed

• Linux kernel

net/rds: Don't sleep inside rds_ib_conn_path_shutdown

• Linux kernel

affs: handle set_blocksize failures

• Linux kernel