Linux kernel.

scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

• Linux kernel

scsi: ufs: core: Keep internal commands dispatchable during error handling

• Linux kernel

perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

• Linux kernel

s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

• Linux kernel

s390/cmf: Fix virtual vs physical address confusion

• Linux kernel

s390/pci: Fix missing device lock in zpci_report_status()

• Linux kernel

s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config

• Linux kernel

KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV

• Linux kernel

KVM: SEV: Do cache maintenance on the source VM during intra-host migration

• Linux kernel

KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode

• Linux kernel

KVM: arm64: Fix AArch32 DBGBXVR<n> handling

• Linux kernel

KVM: arm64: Fix spurious warning for benign stage 2 teardown race

• Linux kernel

KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

• Linux kernel

KVM: arm64: Transfer the hyp stack pages out of the host stage-2

• Linux kernel

RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

• Linux kernel

RISC-V: KVM: Synchronize hrtimer callback during teardown

• Linux kernel

sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

• Linux kernel

Bluetooth: hci_conn: fix CIS hold ownership on reuse

• Linux kernel

Bluetooth: hci_sock: validate event length before filtering

• Linux kernel

Bluetooth: hci_sock: reject out-of-range OCF values

• Linux kernel

Bluetooth: ISO: balance the parent hold in hci_bind_bis()

• Linux kernel

Bluetooth: ISO: release unused CIS holds after channel attach

• Linux kernel

Bluetooth: L2CAP: validate frame length before control and FCS access

• Linux kernel

Bluetooth: mgmt: fix race in read_unconf_index_list()

• Linux kernel

Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

• Linux kernel

smb: client: fix create context out-of-bounds reads

• Linux kernel

smb: client: close handle after create-context parsing failure

• Linux kernel

smb: client: clean up failed cached directory opens

• Linux kernel

smb: client: use finish_no_open() for non-regular inodes

• Linux kernel

smb: client: close completed creates on compound wait errors

• Linux kernel

smb: client: delete compound mids on send failure before unlock

• Linux kernel

xfs: release orphanage dir inode if chown fails

• Linux kernel

xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots

• Linux kernel

xfs: don't let hidden_space go negative in xfs_metafile_resv_init

• Linux kernel

xfs: don't let memory failures leak blocks and kill repairs

• Linux kernel

xfs: drop dquot flush lock when we can't find a buffer to flush

• Linux kernel

xfs: fix cursor and pointer handling when recovering iunlink buckets

• Linux kernel

net/sched: act_ct: fix helper UAF due to extensions realloc

• Linux kernel

net/sched: act_ct: avoid modifying shared unconfirmed ct entry

• Linux kernel

KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction

• Linux kernel

smb/server: cancel async requests when closing connection

• Linux kernel

mptcp: options: fix uninit-value in mptcp_write_data_fin

• Linux kernel

media: qcom: iris: fix runtime PM reference leaks

• Linux kernel

accel/amdxdna: Disable device buffer exporting

• Linux kernel

EDAC/altera: Use parent device for devres in altr_portb_setup()

• Linux kernel

sysctl: Check range in proc_dointvec_ms_jiffies_minmax

• Linux kernel

KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure

• Linux kernel

ipv4: validate checksum_start before completing checksum

• Linux kernel
• CWE-20

ipv4: free inet_opt and ireq_opt after an RCU grace period

• Linux kernel

RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency

• Linux kernel

RDMA/efa: Keep admin queues alive while IRQ is registered

• Linux kernel

RDMA/efa: Keep EQ resources alive while IRQ is registered

• Linux kernel

ALSA: usb: 6fire: Avoid embedded URBs

• Linux kernel

net/sched: codel: bound the dropping loop per dequeue call

• Linux kernel

wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path

• Linux kernel

wifi: mac80211: don't warn when an IBSS has no channel to scan

• Linux kernel

wifi: cfg80211: undo netns switch if renaming the wiphy fails

• Linux kernel

wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

• Linux kernel

wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown

• Linux kernel

wifi: mac80211: require a peer station for TDLS setup confirm

• Linux kernel