Linux kernel.

net: ip_tunnel: initialize `options_len` before referencing options

• Linux kernel

net: lan743x: fix RX checksum use-after-free

• Linux kernel

net: wwan: t7xx: validate the netif index in t7xx_ccmni_recv_skb()

• Linux kernel

net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain

• Linux kernel

net: wwan: mhi_wwan_mbim: check skb_copy_bits() return value

• Linux kernel

net/sched: act_api: release tail references on DELACTION failure

• Linux kernel

net/sched: hhf: cap hh_flows_limit at change time

• Linux kernel

net/packet: clear RX owner on VNET header error

• Linux kernel

scsi: core: Validate MODE SENSE lengths in scsi_cdl_enable()

• Linux kernel

xfrm: serialize state GC with device state flush

• Linux kernel

xfrm: use hlist_del_init_rcu for state_cache and state_cache_input

• Linux kernel

xfrm: save input state data before secpath resets

• Linux kernel

mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

• Linux kernel

memstick: ms_block: destroy io_queue workqueue on removal

• Linux kernel

mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count

• Linux kernel

mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem

• Linux kernel

mm/vma: correctly unaccount on mmap_prepare() failure

• Linux kernel

mm: filemap: retain mapped dropbehind folios

• Linux kernel

KEYS: encrypted: fix integer overflow of datablob_len

• Linux kernel

KEYS: trusted: Fix tpm2_load_cmd() boundary check

• Linux kernel

sched_ext: Fix NULL sched deref in kfunc sub-sched error paths

• Linux kernel

sched_ext: Close the pre-enable ops error claim window

• Linux kernel

i2c: atr: fix dangling adapter pointer on add failure

• Linux kernel

IB/mlx4: Fix use-after-free on pkey sysfs registration failure

• Linux kernel

IB/hfi1: Fix the PIO_CRED credit-return mmap

• Linux kernel

selinux: preserve user SID across nested backing files

• Linux kernel

selinux: recheck intermediate backing files on mprotect()

• Linux kernel

mmc: core: Cancel SDIO IRQ work before freeing host

• Linux kernel

mmc: hsq: Fix use-after-free in retry work

• Linux kernel

mmc: mmci: Fix use-after-free in busy-timeout work

• Linux kernel

mmc: mxcmmc: cancel data work and watchdog on remove

• Linux kernel

mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

• Linux kernel

mmc: sdio_uart: fix xmit_fifo leak when the port table is full

• Linux kernel

mmc: spi: reset bytes_xfered before retrying CRC failures

• Linux kernel

Input: cyttsp5 - clamp the HID report size before memcpy

• Linux kernel

Input: evdev - zero absinfo before partial copy in EVIOCSABS

• Linux kernel

Input: rmi_smbus - fix out-of-bounds read in rmi_smb_write_block()

• Linux kernel

Input: soc_button_array - check btns_desc->package.count

• Linux kernel

Input: synaptics-rmi4 - fix GPF in suspend and resume when unbound

• Linux kernel

Input: zero ff_effect before compat copy in input_ff_effect_from_user

• Linux kernel

hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show()

• Linux kernel

hwmon: (pmbus/core) increase number of phases and add new mask

• Linux kernel

hwmon: (pwm-fan) Stop RPM timer before freeing tach data

• Linux kernel

hwmon: (w83791d) remove fan/pwm 4-5 sysfs group on remove

• Linux kernel

wifi: brcmsmac: fix UAF in brcms_free_timer()

• Linux kernel

wifi: iwlegacy: fix broadcast stations deallocation

• Linux kernel

wifi: libertas_tf: fix UAF in lbtf_free_adapter()

• Linux kernel

wifi: libipw: reject TKIP frames without a full MIC

• Linux kernel

wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

• Linux kernel

wifi: wlcore: release runtime PM ref on regdomain config failure

• Linux kernel

wifi: wilc1000: fix out-of-bounds read in P2P public action frames

• Linux kernel

wifi: wilc1000: fix RX buffer OOB-write in wilc_wlan_handle_isr_ext()

• Linux kernel

wifi: p54: validate curve data length in the calibration curve converters

• Linux kernel

wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

• Linux kernel

wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length

• Linux kernel

wifi: mwifiex: validate scan response extents

• Linux kernel

wifi: mwifiex: prevent authentication frame length truncation

• Linux kernel

wifi: mac80211: avoid out-of-bounds read for empty PREQ elements

• Linux kernel

wifi: mac80211: refuse to make a monitor active when it has no queue

• Linux kernel

drm/gud: fix out-of-bounds write in gud_plane_atomic_check()

• Linux kernel