Linux kernel.

fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

• Linux kernel

writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

• Linux kernel

workqueue: Fix NULL current_pwq deref in flush dependency check

• Linux kernel

writeback: report a Tasks-RCU quiescent state per cgwb drain pass

• Linux kernel

fsl/fman: Fix clk reference leak in read_dts_node()

• Linux kernel

ipe: fix use-after-free when auditing a newly loaded policy

• Linux kernel

ipe: protect the dm-verity root hash with RCU

• Linux kernel

ipv6: do not let ipv6_find_hdr() return an offset past the packet end

• Linux kernel

ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

• Linux kernel

kprobes: Fix permanent hang when flushing the kprobe optimizer

• Linux kernel

gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()

• Linux kernel

gpio: cdev: fix kernel stack leak to user-space in error path

• Linux kernel

gpio: zynq: fix runtime PM leak on request error path

• Linux kernel

llc: reserve device headroom for allocated frames

• Linux kernel

mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

• Linux kernel

rds: ib: Clear the sg list when mapping an MR fails

• Linux kernel

drm/client: fix restore of partially initialized client

• Linux kernel

drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

• Linux kernel

drm/i915: fix incorrect RCU teardown order

• Linux kernel

drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping

• Linux kernel

drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()

• Linux kernel

drm/nouveau/dmem: pin VRAM for the whole registered range

• Linux kernel

drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM

• Linux kernel

drm/nouveau: Fix bridge reference leak in nv1a_ram_new()

• Linux kernel

drm/nouveau: fix double-free in nvif_vmm_dtor

• Linux kernel

drm/nouveau: Fix gem reference leak in validate_init()

• Linux kernel

drm/nouveau: Fix runtime PM leak in nouveau_connector_detect()

• Linux kernel

drm/nouveau: RCU-free the scheduler-containing nouveau_sched

• Linux kernel

drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()

• Linux kernel

drm/xe/vm: nuke PTs only after unlinking contested VMAs

• Linux kernel

drm/virtio: fix memory leak of fence event on execbuffer failure

• Linux kernel

drm/virtio: fix NULL pointer dereference on fence allocation failure

• Linux kernel

mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

• Linux kernel

mm/hugetlb: do not dissolve gigantic pages without runtime support

• Linux kernel

mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()

• Linux kernel

PCI: of_property: Omit bus properties without a subordinate bus

• Linux kernel

packet: use ubuf_info completion for TX_RING packets

• Linux kernel

HID: alps: unregister DualPoint Stick input device on remove

• Linux kernel

HID: alps: fix use-after-free on input2 registration failure

• Linux kernel

HID: hid-oxp: use cancel_delayed_work_sync() in remove

• Linux kernel

HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

• Linux kernel

net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

• Linux kernel

net/mlx5e: fix swapped IPv6 IPsec policy masks

• Linux kernel

net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

• Linux kernel

net: arp: terminate device name before lookup

• Linux kernel

net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

• Linux kernel

net: ipconfig: bound DHCP option construction

• Linux kernel

net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

• Linux kernel

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

• Linux kernel

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

• Linux kernel

net: atl1c: fix soft lockup on out-of-range tpd_cons read

• Linux kernel

net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

• Linux kernel

net: bridge: mdb: restart port group walk after deletion

• Linux kernel

net: ena: fix MMIO read buffer leak on probe failure

• Linux kernel

netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

• Linux kernel

netfilter: nf_tables: skip expired catchall elements on insert and delete

• Linux kernel

nfc: fix use-after-free in nfc_get_local_general_bytes

• Linux kernel

nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc()

• Linux kernel

nfc: port100: reject frames whose declared length exceeds the received data

• Linux kernel

nfc: trf7970a: power down on startup RX gain failure

• Linux kernel