netem: fix return value if duplicate enqueue fails

sch/netem: fix use after free in netem_dequeue

exec: Fix ToCToU between perm check and set-uid/gid usage

RDMA/iwcm: Fix a use-after-free related to destroying CM IDs

dev/parport: fix the array out-of-bounds risk

net: microchip: vcap: Fix use-after-free error in kunit test

ext4: no need to continue when the number of entries is 1

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans

hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer

netfilter: ipset: add missing range check in bitmap_ip_uadt

net: sched: fix ordering of qlen adjustment

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

ocfs2: add bounds checking to ocfs2_xattr_find_entry()

bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()

scsi: sd: Fix off-by-one error in sd_read_block_characteristics()

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error

drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error

ext4: return error on ext4_find_inline_entry

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

fbdev: sisfb: Fix strbuf array overflow

net: explicitly clear the sk pointer, when pf->create fails

btrfs: fix uninitialized pointer free in add_inode_ref()

tcp: fix mptcp DSS corruption due to large pmtu xmit

xsk: fix OOB map writes when deleting elements

wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()

Out of scope: SuperH architecture isn't supported for current kernel

btrfs: fix use-after-free in btrfs_encoded_read_endio()

drm/xe/vm: move xa_alloc to prevent UAF

driver core: bus: Fix double free in driver API bus_register()

smb: client: fix UAF in async decryption

smb: client: fix NULL ptr deref in crypto_aead_setkey()

Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync

net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule_test()

parport: Proper fix for array out-of-bounds access

tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition

ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition

ice: Fix increasing MSI-X on VF

net: do not delay dst_entries_add() in dst_release()

ppp: fix ppp_async_encode() illegal access

slip: make slhc_remember() more robust against malicious packets

mm/mremap: fix move_normal_pmd/retract_page_tables race

Out of scope: patch for x86_32 arch

wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one

wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one

ksmbd: unset the binding mark of a reused connection

ksmbd: fix user-after-free from session log off

ksmbd: fix user-after-free from session log off

jfs: array-index-out-of-bounds fix in dtReadFirst

jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree

HID: core: zero-initialize the report buffer

net: defer final 'struct net' free in netns dismantle

net: defer final 'struct net' free in netns dismantle

drm/dp_mst: Skip CSN if topology probing is not done yet (dependency)

drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()

blk-cgroup: Fix UAF in blkcg_unpin_online()

media: dvbdev: prevent the risk of out of memory access

uprobe: avoid out-of-bounds memory access of fetching args

tracing: Consider the NULL character when validating the event length

net: sched: fix use-after-free in taprio_change()

net: sched: use RCU read-side critical section in taprio_dump()

Bluetooth: SCO: Fix UAF on sco_sock_timeout

Bluetooth: ISO: Fix UAF on iso_sock_timeout

nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net

spi: mpc52xx: Add cancel_work_sync before module remove

RDMA/bnxt_re: Add a check for memory allocation

firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()

RDMA/bnxt_re: Fix out of bound check

netdevsim: use cond_resched() in nsim_dev_trap_report_work()

tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().

tcp: Fix use-after-free of nreq in reqsk_timer_handler().

smb: client: fix OOBs when building SMB2_IOCTL request

udf: fix uninit-value use in udf_get_fileshortad

Out of scope: ARM64 architecture issue

nvmet-auth: assign dh_key to NULL after kfree_sensitive

macsec: Fix use-after-free while sending the offloading packet

bpf: Fix out-of-bounds write in trie_get_next_key()

netfilter: Fix use-after-free in get_info()

fs/ntfs3: Add rough attr alloc_size check

fs/ntfs3: Additional check in ntfs_file_release

wifi: cfg80211: clear wdev->cqm_config pointer on free

iov_iter: fix copy_page_from_iter_atomic() if KMAP_LOCAL_FORCE_MAP

nilfs2: fix kernel bug due to missing clearing of checked flag

wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()

media: s5p-jpeg: prevent buffer overflows

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp

drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read()

dm cache: fix flushing uninitialized delayed_work on cache_ctr error

net: vertexcom: mse102x: Fix possible double free of TX skb

usb: musb: sunxi: Fix accessing an released usb phy

USB: serial: io_edgeport: fix use after free in debug printk

iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()

ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read

wifi: iwlegacy: Clear stale interrupts before resuming device

security/keys: fix slab-out-of-bounds in key_task_permission

virtio_net: Add hash_key_length check

dm cache: fix out-of-bounds access to the dirty bitset when resizing

arm64/sve: Discard stale CPU state when handling SVE traps

media: mgb4: protect driver against spectre

bpf: Check validity of link->type in bpf_link_show_fdinfo()

drm/amd/display: Adjust VSDB parser for replay feature

crypto: qat/qat_4xxx - fix off by one in uof_get_name()

ocfs2: fix uninitialized value in ocfs2_file_read_iter()

x86/CPU/AMD: Terminate the erratum_1386_microcode array

netfilter: x_tables: fix LED ID check in led_tg_check()