Linux kernel.

ksmbd: follow SMB2 session expiration semantics

• Linux kernel

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

• Linux kernel

sched/core: Avoid false migration warning for proxy donors

• Linux kernel

net: xfrm: reject unrepresentable espintcp transport headers

• Linux kernel

dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

• Linux kernel

soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

• Linux kernel

memcg: avoid charging the root memcg from obj_cgroup_charge_pages()

• Linux kernel

selinux: always fill AVC decision in avc_has_perm_noaudit()

• Linux kernel

power: sequencing: fix NULL-pointer dereference in pwrseq_unit_new()

• Linux kernel

power: sequencing: fix NULL-pointer dereference in pwrseq_device_register()

• Linux kernel

watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog

• Linux kernel

watchdog: rtd119x: Avoid division by zero

• Linux kernel

watchdog: rzv2h: Avoid division by zero

• Linux kernel

wifi: rsi: fix heap OOB write on key removal

• Linux kernel

wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

• Linux kernel

smb: client: fix missing iov bounds check in parse_posix_sids()

• Linux kernel

drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

• Linux kernel

s390/boot: Avoid IPL parameter append past command line

• Linux kernel

net: icmp: avoid invalid transport header access in icmp_send tracepoint

• Linux kernel

net: iptunnel: fix stale transport header during tunnel decapsulation

• Linux kernel

s390/ipl: Fix NULL deref in kdump without re-IPL parm block

• Linux kernel

s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

• Linux kernel

locking/lockdep: Invalidate stale class_cache entries for zapped classes

• Linux kernel

platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

• Linux kernel

powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

• Linux kernel

powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit

• Linux kernel

af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

• Linux kernel

net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

• Linux kernel

Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one

• Linux kernel

drm/xe: Guard page-fault worker with runtime PM check

• Linux kernel

x86/amd_node: Avoid divide by zero on virtualized systems

• Linux kernel

drm/amdgpu: skip gfx switch_power_profile during GPU reset

• Linux kernel

exec: do_close_on_exec() before taking exec_update_lock

• Linux kernel

s390/crypto: Fix skcipher_walk return code handling in aes_s390

• Linux kernel

scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot

• Linux kernel

sched/cache: Decouple sched_cache_group from mm to fix UAF

• Linux kernel

bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

• Linux kernel

bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

• Linux kernel

bpf: Reject dev-bound-only programs on other devices

• Linux kernel

veth: manage XDP program pointers during channel resize

• Linux kernel

net/sched: reject IDR error pointers when deleting actions

• Linux kernel

netfilter: ip6t_rpfilter: reject routes without inet6_dev

• Linux kernel

bpf: Skip unsettled links in link iterator

• Linux kernel

vlan: require the MAC header to be present in __vlan_insert_inner_tag()

• Linux kernel

bpf: Use array_map_meta_equal for percpu array inner map replacement

• Linux kernel

xen/netfront: drop RX packets with a short Ethernet header

• Linux kernel

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

• Linux kernel

mm/hugetlb: preserve mremap address delta when skipping page tables

• Linux kernel

xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

• Linux kernel

xfrm: iptfs: fix runt reassembly panic from short inner tot_len

• Linux kernel

xfrm: fix compat ALLOCSPI request use-after-free

• Linux kernel

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

• Linux kernel

esp: downgrade zerocopy managed frags before mutating skb frags

• Linux kernel

RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

• Linux kernel

RDMA/rxe: validate access flags before swapping the MR's PD

• Linux kernel

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

• Linux kernel

xfrm: hold net_device reference under RCU in bundle creation

• Linux kernel

firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

• Linux kernel

clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

• Linux kernel

RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths

• Linux kernel