Linux kernel.

scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

• Linux kernel

scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

• Linux kernel

smb/client: validate new EOF for insert range

• Linux kernel

smb/client: validate new EOF for zero range

• Linux kernel

smb/client: fix stale page cache in insert/collapse range

• Linux kernel

smb/client: invalidate fscache for fallocate range operations

• Linux kernel

sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

• Linux kernel

vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

• Linux kernel

watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

• Linux kernel

netfs: Fix subreq ref leak

• Linux kernel

netfs: break unbuffered write when netfs_alloc_subrequest() fails

• Linux kernel

netfs: Fix readahead synchronisation issues by loading all folios upfront

• Linux kernel

cachefiles: Fix potential UAF/KASAN warning

• Linux kernel

ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

• Linux kernel

ksmbd: safely drain sessions during logoff

• Linux kernel

ksmbd: propagate DACL parsing errors

• Linux kernel

ksmbd: rate limit unmapped SID errors

• Linux kernel

ksmbd: fix listener task lifetime on netdev events

• Linux kernel

Bluetooth: btintel: validate version TLV value lengths

• Linux kernel

Bluetooth: btintel: bound firmware ID by TLV length

• Linux kernel

Bluetooth: hci_core: Fix race condition during device registration

• Linux kernel

Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

• Linux kernel

Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect

• Linux kernel

drm/pagemap: Prevent double migration of device pages

• Linux kernel

net: ethernet: oa_tc6: Improve the error recovery

• Linux kernel

net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

• Linux kernel

igmp: convert struct ip_sf_list to RCU

• Linux kernel

ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

• Linux kernel

ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

• Linux kernel

ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

• Linux kernel

tipc: fix NULL deref in tipc_named_node_up() on empty publication list

• Linux kernel

tipc: Dont send random pad bytes in RESET/ACTIVATE messages

• Linux kernel

ipv6: sr: restore network header before routing and forwarding

• Linux kernel

af_packet: Don't cast tpacket_hdr.tp_len to int in tpacket_parse_header().

• Linux kernel

staging: fbtft: make dirty_lock IRQ-safe

• Linux kernel

ASoC: fsl_micfil: balance mclk enable/disable

• Linux kernel

ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()

• Linux kernel

btrfs: detach failed sprout device from transaction update list

• Linux kernel

btrfs: restore active device pointers after failed sprout

• Linux kernel

bonding: alb: fix uninitialized transport header access in alb_determine_nd()

• Linux kernel

scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

• Linux kernel

sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate

• Linux kernel

ALSA: ump: do not touch legacy_rmidi before it exists

• Linux kernel

bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

• Linux kernel

bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks

• Linux kernel

btrfs: fix transaction use-after-free in raid stripe insertion

• Linux kernel

btrfs: fix the possible bioc_list memory leak during error

• Linux kernel

btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

• Linux kernel

btrfs: do not force reloc root creation during qgroup_account_snapshot()

• Linux kernel

btrfs: zstd: fix lost wakeup when waiting for a workspace

• Linux kernel

ipvs: fix reversed sequence option serialization

• Linux kernel

netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

• Linux kernel

tracing/probes: Fix use-after-free on field name/type of events with multiple probes

• Linux kernel

bpf: reject BPF_PSEUDO_FUNC reference to the main program

• Linux kernel

bonding: do not clear curr_active_slave prematurely when releasing all slaves

• Linux kernel

net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().

• Linux kernel

net/rds: use wq_has_sleeper() in release_in_xmit()

• Linux kernel

net/rds: clear cp_flags bits individually in rds_conn_path_reset()

• Linux kernel

net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

• Linux kernel

net/rds: acquire the fastpath locks in rds_conn_shutdown()

• Linux kernel