Linux kernel.

netfilter: cttimeout: prevent UAF during module unload

• Linux kernel

netfilter: nf_log: unregister loggers before per-net teardown

• Linux kernel

vdpa: ifcvf: Put device on unsupported feature error

• Linux kernel

fs: autofs: fix memory leak in autofs_fill_super()

• Linux kernel

erofs: preserve LZMA decoders on resize failure

• Linux kernel

fbdev: vfb: defer cleanup until the last reference

• Linux kernel

idpf: disable DIM work before freeing q_vectors

• Linux kernel

inet: frags: invalidate queues before flushing them

• Linux kernel

ieee802154: 6lowpan: fix NULL dereference in lowpan_newlink

• Linux kernel

ieee802154: cc2520: fix FIFOP work use-after-free

• Linux kernel

ieee802154: hwsim: serialize pib updates to fix double-free

• Linux kernel

ipv4: fib: bound automatic table ID allocation

• Linux kernel

ipv6: flowlabel: cap duplicate leases per socket

• Linux kernel

ipvs: reject invalid states in connection template sync records

• Linux kernel

mac802154: fix use-after-free of sdata via queued RX frames

• Linux kernel

landlock: Fix use-after-free of the source's parent directory

• Linux kernel

iommu/s390: Fix NULL dereference in iova_to_phys() with ZPCI_TABLE_TYPE_RFX

• Linux kernel

s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

• Linux kernel

s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine

• Linux kernel

s390/crypto: Fix missing scrub of temp buffers with PAES algorithm

• Linux kernel

s390/crypto: Fix wrong return code to engine in asynch callbacks

• Linux kernel

s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly

• Linux kernel

perf: RISC-V: store available counter mask as bitmap

• Linux kernel

afs: Fix missing kunmap in afs_dir_search_bucket()

• Linux kernel

afs: Fix double-unmap of directory block

• Linux kernel

afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

• Linux kernel

afs: Clear stale peer app data after address list changes

• Linux kernel

hwmon: (gpio-fan) Fix use-after-free in alarm work

• Linux kernel

media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity

• Linux kernel

media: rkvdec: bound HEVC tile loops and PPS id to the array capacity

• Linux kernel

media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity

• Linux kernel

media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer

• Linux kernel

media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity

• Linux kernel

media: v4l2-ctrls: validate HEVC tile counts

• Linux kernel

media: v4l2-ctrls: validate AV1 tile counts

• Linux kernel

bnxt_en: Don't free the live ring's TPA state on queue restart failure

• Linux kernel

bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

• Linux kernel

bnxt_en: Propagate RX ring init failures in bnxt_init_nic()

• Linux kernel

bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

• Linux kernel

bnxt_en: Bound SW TPA IDs to prevent crashes

• Linux kernel

bnxt_en: Prevent queue stop with deferred completions

• Linux kernel

mptcp: syncookies: remember the request backup flag

• Linux kernel

mptcp: prevent race between disconnect() and rtx

• Linux kernel

mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

• Linux kernel

smb: client: reject short READ responses in CIFSSMBRead()

• Linux kernel

smb: client: reject userspace cifs.idmap descriptions

• Linux kernel

smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()

• Linux kernel

smb: client: pin DFS superblock in iterator callback

• Linux kernel

smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid

• Linux kernel

smb: client: fix one-byte OOB read in smb2_parse_native_symlink()

• Linux kernel

smb: client: fail DACL rewrite when the new DACL exceeds 64K

• Linux kernel

smb: client: fix cifsFileInfo reference leak in deferred close

• Linux kernel

smb: client: avoid leaking refcount in cifs_queue_oplock_break()

• Linux kernel

smb: client: avoid leaking refcount when cifs_sb_tlink() fails

• Linux kernel

smb: client: fix heap overflow in DACL owner/group rewrite

• Linux kernel

smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()

• Linux kernel

xfs: lock the healthmon when inserting unmount event

• Linux kernel

xfs: initialise error in xfs_defer_finish_one()

• Linux kernel

xfs: initialise args->total for parent pointer updates

• Linux kernel

xfs: fix unit conversions in per_binval computation

• Linux kernel