Linux kernel.

drm/amdgpu: fix IP instance memory leak on kobject add failure

• Linux kernel

drm/amdgpu: fix ACP MFD device leak on init failure

• Linux kernel

binder: fix is_failure flag for superseded transaction cleanup

• Linux kernel

binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

• Linux kernel

binderfs: fix UAF write in binder_add_device

• Linux kernel

nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

• Linux kernel

rust_binder: cancel deferred work items in thread exit

• Linux kernel

USB: cdc-acm: skip URB restart in port_shutdown if disconnected

• Linux kernel

USB: serial: fix port tear down use-after-free

• Linux kernel

usb: storage: sierra_ms: reject short SWoC info transfers

• Linux kernel

usb: gadget: midi2: Fix the jack descriptor array sizes

• Linux kernel

usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd

• Linux kernel

usb: typec: anx7411 - stop the IRQ before destroying the workqueue

• Linux kernel

usb: dwc3: gadget: fix IRQ storm on invalid event buffer count

• Linux kernel

usb: gadget: aspeed-vhub: cancel wake work on device removal

• Linux kernel

USB: gadget: dummy-hcd: Fix wait for outstanding request completions

• Linux kernel

usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

• Linux kernel

usb: core: clear both ep_in and ep_out for non-ep0 control endpoints

• Linux kernel

USB: dwc2: shut down wakeup timer before freeing HCD state

• Linux kernel

usb: typec: tcpm: recover after failure to start the frs ams

• Linux kernel

usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

• Linux kernel

usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

• Linux kernel

usb: typec: ucsi: glink: fix use-after-free of ucsi on remove

• Linux kernel

usb: cdns3: fix use-after-free in cdns3_gadget_exit()

• Linux kernel

usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

• Linux kernel

tty: vcc: zero-initialize control packet in vcc_send_ctl()

• Linux kernel

tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

• Linux kernel

tty: tty_port: restore TTY_IO_ERROR on activation failure

• Linux kernel

tty: port: fix tty_port_tty_vhangup() race

• Linux kernel

tty: abort break signalling on hangup

• Linux kernel

tty: fix saved termios reset race

• Linux kernel

tty: serial: max3100: shut down timer before freeing port

• Linux kernel

serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

• Linux kernel

serial: core: fix NULL pointer dereference in serial_core_unregister_port()

• Linux kernel

serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()

• Linux kernel

arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems

• Linux kernel

ASoC: codecs: max98363: fix uninitialized stream_config->type

• Linux kernel

ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type

• Linux kernel

ALSA: seq: Serialize compat port-info ioctls

• Linux kernel

ALSA: ua101: reject mismatched capture/playback packet sizes

• Linux kernel

EDAC/altera: Drop __init from ECC setup paths for re-probe safety

• Linux kernel

Bluetooth: RFCOMM: Fix initial port reference race

• Linux kernel

Bluetooth: Serialize SMP remote OOB data access

• Linux kernel

Bluetooth: hci_sync: Fix inquiry cache use-after-free

• Linux kernel

Bluetooth: hci_conn: Lock parent access during enhanced SCO setup

• Linux kernel

Bluetooth: hci_core: Serialize ACL scheduling with channel deletion

• Linux kernel

Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown

• Linux kernel

Bluetooth: hci_core: Serialize fragmented ISO packet queueing

• Linux kernel

Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

• Linux kernel

Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

• Linux kernel

Bluetooth: btintel_pcie: reject oversized TX packets in send_frame()

• Linux kernel

x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h

• Linux kernel

tpm: fix off-by-four bounds check in tpm2_get_random()

• Linux kernel

nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

• Linux kernel

nvme-multipath: fix underflow in ANA log bounds checks

• Linux kernel

nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

• Linux kernel

nvmet: pci-epf: reject too-short SGL segments

• Linux kernel

nvmet: copy the hostid into the ctrl before creating PR pc_refs

• Linux kernel

mtd: block2mtd: Fix divide error when erase_size is zero

• Linux kernel

mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ

• Linux kernel