Linux kernel.

iio: pressure: bmp280: fix out-of-bounds access in sampling frequency lookup

• Linux kernel

iio: pressure: rohm-bm1390: Return error when read fails

• Linux kernel

iio: proximity: aw96103: validate firmware data length

• Linux kernel

iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure

• Linux kernel

iio: trigger: cancel reenable_work before freeing trigger

• Linux kernel

perf: Require kernel access for text poke events

• Linux kernel

KVM: s390: Fix _gaccess_shadow_fault()

• Linux kernel

KVM: s390: Add missing srcu in kvm_s390_set_irq_state()

• Linux kernel

KVM: s390: Properly handle NULL pointer in dat_cond_set_storage_key()

• Linux kernel

KVM: s390: Fix potential races in dat skey functions

• Linux kernel

KVM: s390: Fix race in _destroy_pages_crste()

• Linux kernel

s390/uv: Prevent potential out-of-bounds read

• Linux kernel

bpf: Fix divide-by-zero in btf_struct_walk()

• Linux kernel

tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context

• Linux kernel

HID: winwing: fix use-after-free in force feedback teardown

• Linux kernel

bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

• Linux kernel

bpf: Fix out-of-bounds read of rtt_min in sock_ops

• Linux kernel

bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

• Linux kernel

bpf, arm64: set up the frame pointer for the exception callback

• Linux kernel

HID: amd_sfh: Validate PCI BAR size before mapping

• Linux kernel

KVM: riscv: Fix NACL hfence entry update order

• Linux kernel

KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

• Linux kernel

KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure

• Linux kernel

squashfs: Add dictionary size range check to prevent shift-out-of-bounds

• Linux kernel

scsi: block: Fix zones_cond out-of-bounds write on zone report

• Linux kernel

scsi: sd_zbc: Reject disks with too many zones

• Linux kernel

Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

• Linux kernel

Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

• Linux kernel

xsk: Use a 32-bit compare in xsk_map_gen_lookup

• Linux kernel

eth: fbnic: Fix payload page pool error cleanup

• Linux kernel

net/sched: cls_u32: fix manual hash table handle IDR aliasing

• Linux kernel

bpf: Make post-verification instruction rewrites killable

• Linux kernel

bpf: Preserve packet pointer class displacement in regsafe()

• Linux kernel

bpf: Restrict CO-RE poisoning to relocatable instructions

• Linux kernel

netfilter: flowtable: publish HW_DEAD after worker is done

• Linux kernel

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

• Linux kernel

drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

• Linux kernel

net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

• Linux kernel

net: gue: reject invalid REMCSUM offsets

• Linux kernel

net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure

• Linux kernel

net: ethtool: keep rtnl_lock for the ioctl self test

• Linux kernel

eth: fbnic: Handle maximum standalone channels

• Linux kernel

eth: fbnic: use the Rx queue napi pointer to find the napi vector

• Linux kernel

eth: fbnic: reset num_napi when the napi vectors are freed

• Linux kernel

eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox

• Linux kernel

sctp: avoid livelock while updating retransmit path

• Linux kernel

bpf: Bound ownership depth through local kptrs and graph roots

• Linux kernel

net: usb: catc: bound the RX packet length in catc_rx_done()

• Linux kernel

bpf: Check params size before reading reserved fields

• Linux kernel

net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

• Linux kernel

drm/virtio: fix object leak when drm_gem_handle_create() fails

• Linux kernel

drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

• Linux kernel

drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

• Linux kernel

drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

• Linux kernel

drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

• Linux kernel

ovpn: replace bind when learning local endpoint

• Linux kernel

ovpn: replace bind when clearing stale local source

• Linux kernel

Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

• Linux kernel

Bluetooth: btintel_pcie: validate device-supplied DMA indices

• Linux kernel

Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

• Linux kernel