| f13abc1e8e1a watch_queue: fix pipe accounting mismatch |
| 6cce0cc38613 smack: ipv4/ipv6: tcp/dccp/sctp: fix incorrect child socket label |
| 2542a3f70e56 thermal: int340x: Add NULL check for adev |
| 16c6c35c03ea wifi: ath11k: fix RCU stall while reaping monitor destination ring |
| 63b7af49496d wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode |
| 3147ee567dd9 f2fs: fix potential deadloop in prepare_compress_overwrite() |
| e879a0d9cb08 md/raid1,raid10: don't ignore IO flags |
| 6130825f34d4 md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb |
| 3db440443539 md/raid10: wait barrier before returning discard request with REQ_NOWAIT |
| 9ce7603ad3cb iommu/vt-d: Fix system hang on reboot -f |
| 26064d3e2b4d block: fix adding folio to bio |
| 8f984530c242 ext4: correct behavior under errors=remount-ro mode |
| 7e91ae31e2d2 ext4: goto right label 'out_mmap_sem' in ext4_setattr() |
| 18aba2adb3e2 jbd2: fix off-by-one while erasing journal |
| 53ce7166cbff ice: ensure periodic output start time is in the future |
| e2f7d3f7331b ice: validate queue quanta parameters to prevent OOB access |
| 1388dd564183 ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() |
| 9db9c7dd5b4e btrfs: don't clobber ret in btrfs_validate_super() |
| ce2f26e73783 ext4: avoid journaling sb update on error if journal is destroying |
| 919f9f497dbc eth: bnxt: fix out-of-range access of vnic_info array |
| ed3ba9b6e280 net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. |
| 778b09d91baa netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error |
| 107b25db6112 bnxt_en: Mask the bd_cnt field in the TX BD properly |
| 5f2b28b79d2d net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry() |
| a44940d094af net: libwx: fix Tx descriptor content for some tunnel packets |
| c7d82913d5f9 net: libwx: fix Tx L4 checksum |
| d0660f9c588a drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init |
| f887685ee0eb drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set() |
| 3db89bc6d973 staging: vchiq_arm: Fix possible NPR of keep-alive thread |
| 47e35366bc6f exfat: fix missing shutdown check |
| de203da734fa ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans |
| 7ba0847fa1c2 spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock() |
| eada75467fca nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer |
| 96844075226b net: mvpp2: Prevent parser TCAM memory corruption |
| 1b7fdc702c03 rtnetlink: Use register_pernet_subsys() in rtnl_net_debug_init(). |
| 5a465a0da13e udp: Fix multiple wraparounds of sk->sk_rmem_alloc. |
| 3a0a3ff6593d net: decrease cached dst counters in dst_release |
| 8241ecec1cdc sfc: fix NULL dereferences in ef100_process_design_param() |
| 053f3ff67d7f net: ibmveth: make veth_pool_store stop hanging |
| 4103cfe9dcb8 LoongArch: Increase ARCH_DMA_MINALIGN up to 16 |
| 31ab12df7235 x86/microcode/AMD: Fix __apply_microcode_amd()'s return value |
| fa6192adc32f uprobes/x86: Harden uretprobe syscall trampoline check |
| 707549600c4a bcachefs: bch2_ioctl_subvolume_destroy() fixes |
| 3ef938c35035 x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs |
| 1bb7ff4204b6 exfat: fix random stack corruption after get_block |
| 83437689249e RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() |
| 1d6a9e7449e2 RDMA/core: Fix use-after-free when rename device name |
| fa70c4c3c580 dmaengine: fsl-edma: free irq correctly in remove path |
| 4e7f1644f2ac smb: client: Fix netns refcount imbalance causing leaks and use-after-free |
| 33981b1c4e49 riscv: Fix missing __free_pages() in check_vector_unaligned_access() |
| 15a9605f8d69 ksmbd: fix use-after-free in ksmbd_sessions_deregister() |
| fa4cdb8cbca7 ksmbd: fix session use-after-free in multichannel connection |
| 7f81f27b1093 tracing: Fix use-after-free in print_graph_function_flags during tracer switching |
| c11bcbc0a517 mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() |
| 68410c5bd381 wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path |
| b43b1e2c52db wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path |
| ed15511a773d drm/vkms: Fix use after free and double free on init error |
| ddb7ea36ba71 ksmbd: fix r_count dec/increment mismatch |
| 542027e123fc ksmbd: add bounds check for durable handle context |
| bab703ed8472 ksmbd: add bounds check for create lease context |
| beff0bc9d69b ksmbd: fix overflow in dacloffset bounds check |
| bf21e29d78cd ksmbd: validate zero num_subauth before sub_auth is accessed |
| c8b5b7c5da7d ksmbd: fix null pointer dereference in alloc_preauth_hash() |
| 3424c8f53bc6 ALSA: timer: Don't take register_mutex with copy_from/to_user() |
| 48ea8b200414 f2fs: fix to avoid panic once fallocation fails for pinfile |
| 8c3f9a70d2d4 jfs: reject on-disk inodes of an unsupported type |
| 0176e69743ec jfs: add check read-only before txBeginAnon() call |
| b5799dd77054 jfs: add check read-only before truncation in jfs_truncate_nolock() |
| 81edb983b3f5 f2fs: add check for deleted inode |
| 986c50f6bca1 f2fs: fix to avoid accessing uninitialized curseg |
| 5f920d5d6083 ext4: verify fast symlink length |
| fc88dee89d7b wifi: cfg80211: init wiphy_work before allocating rfkill fails |
| 2f6efbabceb6 ax25: Remove broken autobind |
| 6ebc5030e0c5 bpf: Fix array bounds error with may_goto |
| 81a82e8f3388 isofs: fix KMSAN uninit-value bug in do_isofs_readdir() |
| a406aff8c051 ocfs2: validate l_tree_depth to avoid out-of-bounds access |
| b0522303f672 exfat: fix the infinite loop in exfat_find_last_cluster() |
| 3f61ac7c65bd fs/9p: fix NULL pointer dereference on mkdir |
| 688c15017d5c netfilter: nf_tables: don't unregister hook when table is dormant |
| ce8fe975fd99 net_sched: skbprio: Remove overly strict queue assertions |
| 10206302af85 sctp: add mutual exclusion in proc_sctp_do_udp_port() |
| 2ff0e408db36 acpi: nfit: fix narrowing conversion in acpi_nfit_ctl |
| fdf480da5837 jfs: fix slab-out-of-bounds read in ea_get() |
| af7bb0d2ca45 exec: fix the racy usage of fs_struct->in_exec |
| 36cef585e2a3 media: vimc: skip .s_stream() for stopped entities |
| f656cfbc7a29 media: streamzap: fix race between device disconnection and urb callback |
| 930b64ca0c51 nfsd: don't ignore the return code of svc_proc_register() |
| 1f77c05408c9 Bluetooth: btnxpuart: Fix kernel panic during FW release |
| 42d9d7bed270 drm/amd/display: avoid NPD when ASIC does not support DMUB |
| efdde3d73ab2 remoteproc: core: Clear table_sz when rproc_shutdown |
| a1ecb30f9085 RDMA/core: Don't expose hw_counters outside of init net namespace |
| 5ed3b0cb3f82 RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow |
| c1baf6528bcf staging: gpib: Fix cb7210 pcmcia Oops |
| a239c6e91b66 staging: gpib: Fix Oops after disconnect in ni_usb |
| 8491e73a5223 staging: gpib: Fix Oops after disconnect in agilent usb |
| 8977752c8056 mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs |
| c28f31deeacd arm64: Don't call NULL in do_compat_alignment_fixup() |
| adc3fd2a2277 wifi: mt76: mt7921: fix kernel panic due to null pointer dereference |
| 2d117e67f318 RISC-V: KVM: Teardown riscv specific bits after kvm_exit |
| eb85c2410d6f f2fs: quota: fix to avoid warning in dquot_writeback_dquots() |
| 680811c67906 idpf: check error for register_netdev() on init |
| 2d8e5168d48a btrfs: fix block group refcount race in btrfs_create_pending_block_groups() |
| 0dd765fae295 vmxnet3: unregister xdp rxq info in the reset path |
| 094ee6017ea0 bonding: check xdp prog when set bond mode |
| f0c2427412b4 RDMA/mlx5: Fix page_size variable overflow |
| dc84bc2aba85 x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() |
| 1d1a7e252549 fs/ntfs3: Fix 'proc_info_root' leak when init ntfs failed |
| 23f00807619d rtnetlink: Allocate vfinfo size for VF GUIDs when supported |
| 67a5ba8f742f riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler |
| 57b290d97c61 net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue() |
| d90c9de9de2f x86/tsc: Always save/restore TSC sched_clock() on suspend/resume |
| d093c9089260 nfsd: fix management of listener transports |
| d6834d9c9903 watchdog/hardlockup/perf: Fix perf_event memory leak |
| ff99d5b6a246 powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu' |
| 933ab187e679 wifi: ath11k: update channel list in reg notifier instead reg worker |
| 5701875f9609 ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() |
| d93a6caab5d7 ibmvnic: Use kernel helpers for hex dumps |
| 04d50d953ab4 PCI: Fix NULL dereference in SR-IOV VF creation error path |
| 4c9106f4906a idpf: fix adapter NULL pointer dereference on reboot |
| 1b755d8eb1ac netfilter: nft_tunnel: fix geneve_opt type confusion addition |
| b27055a08ad4 net: fix geneve_opt length integer overflow |
| d5e206778e96 ext4: fix OOB read when checking dotdot dir |
| 667f053b05f0 PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion |
| f9bdf1f95339 perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read |
| 0b305b7cadce drm/msm/gem: Fix error code msm_parse_deps() |
| 035b4989211d iio: backend: make sure to NULL terminate stack buffer |
| 57e7239ce0ed ext4: fix potential null dereference in ext4 kunit test |
| 426db24d4db2 cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update |
| a121798ae669 x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors |
| 8e2bad543eca dlm: prevent NPD when writing a positive value to event_done |
| 8542870237c3 md: fix mddev uaf while iterating all_mddevs list |
| 0032c99e83b9 net: fix NULL pointer dereference in l3mdev_l3_rcv |
| 106a6de46cf4 drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr |
| d19d7345a7bc clk: samsung: Fix UBSAN panic in samsung_clk_init() |
| 0dd6770a72f1 w1: fix NULL pointer dereference in probe |
| 93d34608fd16 ASoC: imx-card: Add NULL check in imx_card_probe() |
| 078aabd567de netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets |
| fda8c491db2a arcnet: Add NULL check in com20020pci_probe() |
| 51de36000934 usbnet:fix NPE during rx_complete |
| 60f3caff1492 LoongArch: BPF: Don't override subprog's return value |
| 3651ad5249c5 PCI: brcmstb: Fix error path after a call to regulator_bulk_get() |
| 1a15bb8303b6 x86/mce: use is_copy_from_user() to determine copy-from-user context |
| 1a15bb8303b6 x86/mce: use is_copy_from_user() to determine copy-from-user context |
| 5ad414f4df22 fs/ntfs3: Fix a couple integer overflows on 32bit systems |
| 6bb81b94f7a9 fs/ntfs3: Prevent integer overflow in hdr_first_de() |
| 35a566a24e58 NFSv4: Avoid unnecessary scans of filesystems for returning delegations |
| f163aa81a799 NFSv4: Avoid unnecessary scans of filesystems for expired delegations |
| e767b59e29b8 NFSv4: Avoid unnecessary scans of filesystems for delayed delegations |
| 230ca758453c nfsd: put dl_stid if fail to queue dl_recall |
| 28a9972e0f06 wifi: ath12k: fix skb_ext_desc leak in ath12k_dp_tx() error path |
| 5fbcf76e0dfe md/raid1: fix memory leak in raid1_run() if no active rdev |
| 57b030224074 PCI: xilinx-cpm: Fix IRQ domain leak in error path of probe |
| aac2f8363f77 soundwire: slave: fix an OF node reference leak in soundwire slave device |
| 2e3bc71e4f39 LoongArch: Fix device node refcount leak in fdt_cpu_clk_init() |
| d1ca8698ca13 spufs: fix a leak on spufs_new_file() failure |
| 0f5cce3fc55b spufs: fix a leak in spufs_create_context() |
| df207de9d9e7 udp: Fix memory accounting leak. |
| 3834a759afb8 mmc: omap: Fix memory leak in mmc_omap_new_slot |
| c2b96a681815 media: platform: allgro-dvt: unregister v4l2_device on the error path |
| 5dd639a1646e vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint |
| cfb320d99091 staging: vchiq_arm: Stop kthreads if vchiq cdev register fails |
| c134deabf478 spufs: fix gang directory lifetimes |
| 0590c94c3596 drm/panthor: Fix race condition when gathering fdinfo group samples |
| cbf937dcadfd PCI/ASPM: Fix link state exit during switch upstream function removal |
| 8741d0737921 ublk: make sure ubq->canceling is set when queue is frozen |
| e63d465f5901 objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() |
| 47a60391ae0e rwonce: fix crash by removing READ_ONCE() for unaligned read |
| ea8d7647f9dd tracing: Verify event formats that have "%*p.." |
| 0a7c2a843596 libbpf: Fix accessing BTF.ext core_relo header |
