Linux kernel.

tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().

• Linux kernel

tcp: do not let tcp_rmem be set below 4096

• Linux kernel

dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

• Linux kernel

Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained

• Linux kernel

Bluetooth: btintel_pcie: validate TX skb length in send_sync

• Linux kernel

Bluetooth: coredump: Quiesce dump work on unregister

• Linux kernel

Bluetooth: hci_qca: Do not write to the serial port after it is closed

• Linux kernel

Bluetooth: ISO: Fix parent socket leak in iso_conn_ready()

• Linux kernel

Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

• Linux kernel

Bluetooth: btintel_pcie: fix off-by-one bounds check in RX submit

• Linux kernel

Bluetooth: RFCOMM: avoid socket lock inversion in listener cleanup

• Linux kernel

af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().

• Linux kernel

net: stmmac: fix TSO header length truncation

• Linux kernel

pppoatm: ensure a writable skb header and linear data

• Linux kernel

drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

• Linux kernel

net: bridge: vlan: fix bugs caused by switchdev deletion errors

• Linux kernel

netlink: do not free nlk->groups while lockless readers can use it

• Linux kernel

KVM: PPC: Book3S HV: fix use-after-free in kvmhv_emulate_tlbie_all_lpid()

• Linux kernel

powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

• Linux kernel

futex: Also allocate private hash on vfork()

• Linux kernel

drm/xe/i2c: Disable IRQ on unbind

• Linux kernel

btrfs: handle lack of space when cleaning up verity items

• Linux kernel

net: remove WARN_ON_ONCE() from the dev_fill_forward_path() loop check

• Linux kernel

eth: fbnic: ring the doorbell if a burst ends in a drop

• Linux kernel

net: lock the socket in sock_gettstamp()

• Linux kernel

net: ethernet: cortina: Ack RX overrun interrupt correctly

• Linux kernel

net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

• Linux kernel

x86/kprobes: Fix crash when probing CS CALL instructions

• Linux kernel

net: mvpp2: prevent buffer overflow in page_pool allocation

• Linux kernel

net: skbuff: do not leave stale header offsets after pskb_carve()

• Linux kernel

drm/amdgpu: check ras and obj before dereference

• Linux kernel

btrfs: abort transaction on failure to update inode for hole punching and reflinking

• Linux kernel

perf: Fix null pointer access in is_include_guest_event()

• Linux kernel

9p: Fix v9fs_issue_write() to update i_size and remote_i_size

• Linux kernel

ALSA: core: Fix potential UAF after asynchronous card release

• Linux kernel

ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

• Linux kernel

ALSA: virtio: reset device before deleting virtqueues

• Linux kernel

ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type

• Linux kernel

ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY

• Linux kernel

cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

• Linux kernel

exec: Cleanup POSIX timers right after de_thread()

• Linux kernel

fs/dax: check zero or empty entry before converting xarray entry

• Linux kernel

posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

• Linux kernel

rds: ib: use rds_conn_drop() on protocol version mismatch

• Linux kernel

signal: Prevent exec() race

• Linux kernel

tcp: exclude old ACKs from tcp fast path

• Linux kernel

swiotlb: use the adjusted address for the highmem page lookup

• Linux kernel

RDMA/ucma: Serialize join and leave on copy_to_user failure

• Linux kernel

RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

• Linux kernel

openvswitch: avoid reallocating confirmed conntrack labels

• Linux kernel

nfsd: fix handling of NFSEXP_PNFS in the netlink codepath

• Linux kernel

arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

• Linux kernel

arm64: percpu: Fix LSE operations on {8,16}-bit types

• Linux kernel

Bluetooth: hci_codec: validate vendor codec count length

• Linux kernel

Bluetooth: hci_sync: Serialize local codec list cleanup

• Linux kernel

btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

• Linux kernel

btrfs: clear free space tree creation state on rebuild failure

• Linux kernel

dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3

• Linux kernel

dma-buf: Fix silent overflow for phys vec to sgt

• Linux kernel

ipv6: xfrm: use full sockets in local error paths

• Linux kernel