Linux kernel.

vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

• Linux kernel

vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

• Linux kernel

vt: skip screen update for DEC alignment test on backgroup consoles

• Linux kernel

ALSA: caiaq: unregister the input device when probe fails

• Linux kernel

ALSA: line6: reject oversized playback packets

• Linux kernel

iio: accel: kionix-kx022a: Fix array boundary check

• Linux kernel

mtd: core: avoid double-free of OTP NVMEM device

• Linux kernel

mtd: core: call _get_device() with the master MTD

• Linux kernel

blk-cgroup: save IRQ state in blkg_tryget_closest()

• Linux kernel

of/overlay: don't leak fragment references when changeset init fails

• Linux kernel

wifi: wfx: validate MIB read length before copying to caller

• Linux kernel

wifi: mac80211: drop oversized fragments to avoid extra_len overflow

• Linux kernel

wifi: ath9k: reject short WMI command responses

• Linux kernel

wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

• Linux kernel

rtc: ac100: Fix clock provider use-after-free on probe failure

• Linux kernel

rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

• Linux kernel

wifi: mac80211: validate TX status rate metadata

• Linux kernel

wifi: cfg80211: preserve hidden-group beacon IE ownership

• Linux kernel

wifi: mac80211: prevent AP VLAN tx from other interfaces

• Linux kernel

block: reject polled dio with user integrity metadata

• Linux kernel

blk-mq: set RQF_USE_SCHED when the operation is known

• Linux kernel

Bluetooth: btintel: validate DDC record lengths

• Linux kernel

mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

• Linux kernel

ASoC: SDCA: Add better pm_runtime error handling in func probe

• Linux kernel

bpf: Fix overflow of jump offset in constant blinding

• Linux kernel

nvme: fix cdev lifetime

• Linux kernel

nvme: fix command effects log lifetime for multipath heads

• Linux kernel

bpf: Hold map BTF for the memory allocator destructor record

• Linux kernel

net/mctp: publish the mctp_dev only after it is initialised

• Linux kernel

net/sched: cls_api: reclaim an empty proto on the error path

• Linux kernel

wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

• Linux kernel

Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

• Linux kernel

net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

• Linux kernel

net/mlx5: Fix slab-out-of-bounds when handling team device events

• Linux kernel

octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

• Linux kernel

tipc: prevent GCM nonce reuse on peer key changes

• Linux kernel

net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

• Linux kernel

net: stmmac: fix rx Scatter-Gather support

• Linux kernel

seg6: ensure packet data is writable before modifying SRH and IPv6 DA

• Linux kernel

net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

• Linux kernel

bpf: Wait for an RCU tasks grace period before freeing trampoline progs

• Linux kernel

bpf: Skip detached progs in trampoline images that are still in use

• Linux kernel

net: bcmgenet: fix NULL dereference in set_coalesce before first open

• Linux kernel

net: cap skb->queue_mapping when the tx queue is picked

• Linux kernel

net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

• Linux kernel

net: sparx5: skip ptp deinit if init was skipped

• Linux kernel

ipvs: filter some flags received in the backup server

• Linux kernel

netfilter: bpf: reject invalid NAT manipulation types

• Linux kernel

netfilter: flowtable: generalize pending status bit

• Linux kernel

net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

• Linux kernel

perf: Fix race between perf_event_exit_task() and perf_pending_task()

• Linux kernel

bpf: Fix objects stuck in free_by_rcu_ttrace

• Linux kernel

futex: Fix private hash use-after-free on resize

• Linux kernel

bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

• Linux kernel

drm/amd/display: guard dc_sink dereferences in MST mode validation

• Linux kernel

drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

• Linux kernel

drm/amdgpu/gfx6: fix firmware leak on teardown

• Linux kernel

drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

• Linux kernel

drm/mediatek: Fix ovl adaptor platform device leak

• Linux kernel

drm/mediatek: Fix pdev reference leak in mtk_drm_bind()

• Linux kernel