Linux kernel.

net: macb: fix NULL pointer dereference on unbind with fixed-link

• Linux kernel

bpf: Reject non-scalar bpf_loop iteration counts

• Linux kernel

ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev

• Linux kernel

erofs: delimit inode_share cache key components

• Linux kernel

iommu/riscv: Serialize command queue publishing

• Linux kernel

iommu/amd: Do not reallocate GA log buffers on resume

• Linux kernel

iommu/amd: Fix ineffective error check in nested domain allocation

• Linux kernel

hwmon: (ltc4282) Make sure clk_init_data is fully initialized

• Linux kernel

hwmon: Fix potential UAF in pec_store

• Linux kernel

netfilter: nfnetlink_log: cope with concurrent instance destruction

• Linux kernel

virtio_ring: fix stale descriptor flags after a failed packed add

• Linux kernel

virtio: fix use-after-free in unregister_virtio_device()

• Linux kernel

virtio_console: do not free control-out buffers on remove

• Linux kernel

vhost/vdpa: reject VRING_NUM larger than device max

• Linux kernel

vhost-vdpa: don't install the eventfd_ctx_fdget() error in config_ctx

• Linux kernel

vhost-vdpa: protect config_ctx from being freed under the config callback

• Linux kernel

vdpa_sim_blk: reject out-of-range sector starts

• Linux kernel

vdpa_sim_net: check TX pull result before RX copy

• Linux kernel

vduse: validate virtqueue alignment

• Linux kernel

vhost: invalidate vring access on IOTLB transitions

• Linux kernel

virtio_input: reset device if input_register_device() fails

• Linux kernel

virtio_input: stop callbacks before unregistering input device

• Linux kernel

af_unix: Update last skb marker in manage_oob().

• Linux kernel

net: ipv6: Fix UDP length overflow with PMTU discover and big MTU

• Linux kernel

vduse: return compat ioctl results directly

• Linux kernel

net: ethernet: cortina: Fix budget accounting

• Linux kernel

net: ethernet: cortina: Count dropped frames as NAPI work

• Linux kernel

s390/debug: Fix NULL pointer dereference in debug_set_level()

• Linux kernel

ice: add missing xa_destroy for sched_node_ids

• Linux kernel

eth: ice: don't dereference pointers from TP_printk()

• Linux kernel

Bluetooth: btusb: Fix UAF of btusb_data by rx_work

• Linux kernel

Bluetooth: btintel_pcie: validate packet_len before skb_put_data

• Linux kernel

Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()

• Linux kernel

ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()

• Linux kernel

net: macb: destroy the phylink instance on the probe error path

• Linux kernel

net: macb: put the "mdio" child node reference on success

• Linux kernel

nstree: check listing permission before taking a namespace reference

• Linux kernel

watchdog: msc313e: Avoid division by zero

• Linux kernel

watchdog: msc313e: Fix clock leak and spurious timer in settimeout()

• Linux kernel

hwmon: (corsair-cpro) Create debugfs entries after hwmon registration

• Linux kernel

hwmon: (corsair-cpro) Remove debugfs entries when probe fails

• Linux kernel

octeontx2-pf: reset HTB scheduler topology before freeing queues

• Linux kernel

vxlan: initialize _md in vxlan_xmit_one()

• Linux kernel

ppp_synctty: ensure a writeable skb header

• Linux kernel

net: stmmac: initialize ptp_lock at probe time

• Linux kernel

net/mlx5e: Move representor vnic reporter to eswitch devlink port

• Linux kernel

perf/core: Allow list_del during perf_event_overflow()

• Linux kernel

perf/x86/intel: Prevent drain_pebs() reentry

• Linux kernel

net/sched: cls_route: free emptied bucket on filter move

• Linux kernel

net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

• Linux kernel

net: hinic: fix mailbox segment buffer overflow

• Linux kernel

net: net_failover: Fix the deadlock in net_failover_slave_name_change()

• Linux kernel

net: mana: restore the XDP program pointer when pre-allocation fails

• Linux kernel

net/rds: fix tcp stream corruption with large pages

• Linux kernel

net: stmmac: fix TX descriptor availability check for TSO traffic

• Linux kernel

sunvdc: unmap LDC cookies when the descriptor send fails

• Linux kernel

scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

• Linux kernel

configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

• Linux kernel

configfs: unhash the dentry before dropping the item in rmdir

• Linux kernel

powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

• Linux kernel