Linux kernel.

bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

• Linux kernel

ipv6: Prevent rt6_insert_exception() for dying fib6_info.

• Linux kernel

net: usb: sr9700: include receive overhead in the length check

• Linux kernel

ipv6: Fix dst leak for uncached routes.

• Linux kernel

udp: remove a disconnected socket from the 4-tuple hash table

• Linux kernel

tg3: clean up PHYLIB resources on probe failure

• Linux kernel

s390/debug: Fix NULL pointer dereference in debug_info_copy()

• Linux kernel

net: spacemit: clear TX descriptor on fragment mapping failure

• Linux kernel

bpf: Fix bounds check for skb-backed dynptrs

• Linux kernel

bpf: Fix bpf_sock context code generation

• Linux kernel

bpf: Reject pkt arguments in mutating subprogs

• Linux kernel

bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

• Linux kernel

firewire: cdev: fix back-transition for iso_resource_auto client resource

• Linux kernel

sctp: hold asoc or transport before mod_timer() in timer handlers

• Linux kernel

eth: fbnic: Avoid rounding zero ring sizes

• Linux kernel

net/sched: fix potential stack infoleak in em_text_dump()

• Linux kernel

nfc: nfcmrvl: validate helper command length before pull

• Linux kernel

nfc: st21nfca: validate received frame size

• Linux kernel

nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm()

• Linux kernel

nfc: llcp: Fix race condition in accept_queue lifecycle

• Linux kernel

nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

• Linux kernel

nfc: st21nfca: validate ISO15693 inventory length

• Linux kernel

nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

• Linux kernel

nfc: llcp: fix slab-out-of-bounds reads when logging service names

• Linux kernel

nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

• Linux kernel

net: bcmgenet: stop Tx NAPI before disabling the queues

• Linux kernel

net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

• Linux kernel

bpf: Fix immediate JMP JEQ/JNE on MIPS32

• Linux kernel

net: stmmac: clear stale buf->page after recycling on skb build failure

• Linux kernel

net: ipv6: keep room for the mac header in dst_dev_overhead()

• Linux kernel

ip_gre: Reject enabling collect metadata through changelink

• Linux kernel

vxlan: use one headroom snapshot for neighbour replies

• Linux kernel

net: xps: reject an out of range traffic class

• Linux kernel

drm/imagination: clamp freelist reconstruction requests

• Linux kernel

net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

• Linux kernel

net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

• Linux kernel

net: phylink: record the PHY only once bringup cannot fail

• Linux kernel

net: libwx: fix races in Tx timestamp handling

• Linux kernel

nfp: hold IPsec RX state under the XArray lock

• Linux kernel

net/rds: size a connection's path set by the transport it ends up with

• Linux kernel

net/smc: fix UAF on lgr list traversal in smcr_port_err()

• Linux kernel

net: flush skb_defer_nodes in dev_cpu_dead()

• Linux kernel

gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO

• Linux kernel

gve: DQO: reject TSO packets with an out of range MSS

• Linux kernel

llc: fix skb UAF and leaks on llc_mac_hdr_init() failure

• Linux kernel

vlan: ensure sufficient headroom in vlan_dev_hard_header()

• Linux kernel

autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

• Linux kernel

perf/core: Fix a refcount leak in attach_perf_ctx_data()

• Linux kernel

perf/core: Fill branch entries with a single assignment

• Linux kernel

tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

• Linux kernel

tcp: prevent collapsing skbs across boundary in rtx queue

• Linux kernel

sctp: discard the rest of the packet on a stale-cookie error

• Linux kernel

af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

• Linux kernel

arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

• Linux kernel

ata: libata-scsi: bound the ATA passthru sense descriptor writes

• Linux kernel

bna: prevent IOC timer rearm during teardown

• Linux kernel

bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

• Linux kernel

cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

• Linux kernel

fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

• Linux kernel

fprobe: Terminate the fgraph_data list when the reservation is not filled

• Linux kernel