0e735a4c6137 wifi: rtw88: always wait for both firmware loading attempts
e0d3b845a1b1 crypto: iaa - Fix potential use after free bug
56310ddb50b1 wifi: rtw89: remove unused C2H event ID RTW89_MAC_C2H_FUNC_READ_WOW_CAM to prevent out-of-bounds reading
47d40d93292d RISC-V: KVM: Don't zero-out PMU snapshot area before freeing data
89a906dfa8c3 ARM: 9410/1: vfp: Use asm volatile in fmrx/fmxr macros
a3dd920977dc drivers/perf: Fix ali_drw_pmu driver interrupt status clearing
a949075d4bbf wifi: iwlwifi: mvm: set the cipher for secured NDP ranging
862bf7cbd772 wifi: mt76: mt7915: fix oops on non-dbdc mt7986
f98c3de92bb0 wifi: mt76: mt7996: use hweight16 to get correct tx antenna
9c9368440104 x86/sgx: Fix deadlock in SGX NUMA node search
c5f5b813e546 crypto: hisilicon/qm - inject error before stopping queue
9d301de12da6 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
6d7c6ae1efb1 wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
5aa57d9f2d53 af_unix: Don't return OOB skb in manage_oob().
b1339be951ad sock_map: Add a cond_resched() in sock_hash_free()
94b0818fa635 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
157f29152b61 netkit: Assign missing bpf_net_context
04ccecfa959d ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
c9ea57c91f03 nbd: fix race between timeout and normal completion
18ad4df091dd block, bfq: fix possible UAF for bfqq->bic with merge chain
9e2f9d34dd12 erofs: handle overlapped pclusters out of crafted images properly
1ba0403ac644 block, bfq: fix uaf for accessing waker_bfqq after splitting
26e197b7f924 block: fix potential invalid pointer dereference in blk_add_partition
e98dba934b2f firmware: arm_scmi: Fix double free in OPTEE transport
3a8990b8a778 iommu/arm-smmu-qcom: hide last LPASS SMMU context bank from linux
57cf228cac89 drm/stm: ltdc: check memory returned by devm_kzalloc()
0beca868cde8 drm/amd/display: Check link_res->hpo_dp_link_enc before using it
08ae395ea22f drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func
852856e3b6f6 drm/xe: Use reserved copy engine for user binds on faulting devices
2e4b02fad094 scsi: elx: libefc: Fix potential use after free in efc_nport_vport_del()
e63866a47556 jfs: fix out-of-bounds in dbNextAG() and diAlloc()
fac1bceeeb04 xen: use correct end address of kernel for conflict checking
e3aaebcbb7c6 tpm: Clean up TPM space after command failure
5d99e198be27 bpf, lsm: Add check for BPF LSM return value
92de36080c93 bpf: Fail verification for sign-extension of packet data/data_end/data_meta
3d2786d65aaa bpf: correctly handle malformed BPF_CORE_TYPE_ID_LOCAL relos
c6b72f5d82b1 ext4: avoid OOB when system.data xattr changes underneath the filesystem
ee85e0938aa8 ext4: check stripe size compatibility on remount as well
9403001ad65a nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
f9c96351aa67 nilfs2: fix potential oob read in nilfs_btree_check_delete()
4b3786a6c539 bpf: Zero former ARG_PTR_TO_{LONG,INT} args in case of error
8ae06f360cfa drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
46d7ebfe6a75 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
6188a1c762eb PCI: keystone: Fix if-statement expression in ks_pcie_quirk()
62c2aa6b1f56 nvdimm: Fix devs leaks in scan_labels()
86dfdd828890 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
9be85491619f media: mediatek: vcodec: Fix H264 multi stateless decoder smatch warning
b113bc7c0e83 media: mediatek: vcodec: Fix VP8 stateless decoder smatch warning
7878d3a385ef media: mediatek: vcodec: Fix H264 stateless decoder smatch warning
3e4289b29e21 RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds
112e6e83a894 IB/mlx5: Fix UMR pd cleanup on error flow of driver init
1403c8b14765 IB/core: Fix ib_cache_setup_one error flow cleanup
c500a86693a1 PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port()
fd8489294dd2 RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08
74d315b5af18 RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled
d3745e3ae6c0 PCI: qcom-ep: Enable controller resources like PHY only after refclk is available
e766e6a92410 RDMA/cxgb4: Added NULL check for lookup_atid
e229897d373a ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
22451a16b7ab nfsd: return -EINVAL when namelen is 0
c7f114d864ac f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()
884ee6dc85b9 f2fs: get rid of online repaire on corrupted directory
930c6ab93492 f2fs: fix to don't set SB_RDONLY in f2fs_handle_critical_error()
18ec12c97b39 driver core: Fix a potential null-ptr-deref in module_add_driver()
dc12502905b7 vdpa/mlx5: Fix invalid mr resource destroy
02e9e9366fef vhost_vdpa: assign irq bypass producer token correctly
c7f06284a642 ep93xx: clock: Fix off by one in ep93xx_div_recalc_rate()
9c778fe48d20 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
b5109b60ee4f net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
c8770db2d544 tcp: check skb is non-NULL in tcp_rto_delta_us()
0cbfd45fbcf0 bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave()
2f3d8ff45798 fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set
ea7e2d5e49c0 mm: call the security_mmap_file() LSM hook in remap_file_pages()
a09c17240bdf io_uring/sqpoll: retain test for whether the CPU is valid
d925c04d974c drm/amd/display: Check link_res->hpo_dp_link_enc before using it
23ab1cb6591d drm/xe: fix engine_class bounds check again
8f6887349b2f iommufd: Protect against overflow of ALIGN() during iova allocation
44d174596260 KVM: Use dedicated mutex to protect kvm_usage_count to avoid deadlock
8151a6c13111 drm/amd/display: Skip Recompute DSC Params if no Stream on Link [auto: cve already created]
d4fc4d014715 x86/tdx: Fix "in-kernel MMIO" check
70fd1966c93b KEYS: prevent NULL pointer dereference in find_asymmetric_key()
f81eaf08385d scsi: sd: Fix off-by-one error in sd_read_block_characteristics()
e385c948aa25 usb: dwc2: drd: fix clock gating on USB role switch
f0e5311aa802 firmware_loader: Block path traversal
a5e61b50c9f4 drbd: Add NULL check for net_conf to prevent dereference in state validation
77d48d39e991 efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption
f503ae90c735 wifi: mt76: mt7996: fix NULL pointer dereference in mt7996_mcu_sta_bfer_he
9679ca7326e5 wifi: mt76: mt7925: fix a potential array-index-out-of-bounds issue for clc
7ee85f5515e8 btrfs: fix race setting file private on concurrent lseek using same fd
96cfeb038953 f2fs: fix to wait dio completion
4f5a100f87f3 f2fs: Require FMODE_WRITE for atomic write ioctls
43aec4d01bd2 f2fs: check discard support for conventional zones
88b1afbf0f6b vfs: fix race between evice_inodes() and find_inode()&iput()
3c58a9575e02 netfs: Delete subtree of 'fs/netfs' when netfs module exits
8c2bd38b95f7 icmp: change the order of rate limits
9a22b2812393 padata: use integer wrap around to prevent deadlock on seq_nr overflow
e6a3531dd542 dm-verity: restart or panic on an I/O error
c290fe508eee exfat: resolve memory leak from exfat_create_upcase_table()
98b74bb4d7e9 mm/hugetlb.c: fix UAF of vma in hugetlb fault pathway
5fe6e308abae bpf: Fix use-after-free in bpf_uprobe_multi_link_attach()