| d093c9089260 ("nfsd: fix management of listener transports") |
| 230ca758453c ("nfsd: put dl_stid if fail to queue dl_recall") |
| d1bc15b147d3 ("nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid()") |
| 36cef585e2a3 ("media: vimc: skip .s_stream() for stopped entities") |
| 930b64ca0c51 ("nfsd: don't ignore the return code of svc_proc_register()") |
| f656cfbc7a29 ("media: streamzap: fix race between device disconnection and urb callback") |
| c11bcbc0a517 ("mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead()") |
| af7bb0d2ca45 ("exec: fix the racy usage of fs_struct->in_exec") |
| 667f053b05f0 ("PCI/bwctrl: Fix NULL pointer dereference on bus number exhaustion") |
| adc3fd2a2277 ("wifi: mt76: mt7921: fix kernel panic due to null pointer dereference") |
| c28f31deeacd ("arm64: Don't call NULL in do_compat_alignment_fixup()") |
| 8977752c8056 ("mm/gup: reject FOLL_SPLIT_PMD with hugetlb VMAs") |
| ea8d7647f9dd ("tracing: Verify event formats that have "%*p.."") |
| 21581dd4e7ff ("tracing: Ensure module defining synth event cannot be unloaded while tracing") |
| 7f81f27b1093 ("tracing: Fix use-after-free in print_graph_function_flags during tracer switching") |
| bf21e29d78cd ("ksmbd: validate zero num_subauth before sub_auth is accessed") |
| c8b5b7c5da7d ("ksmbd: fix null pointer dereference in alloc_preauth_hash()") |
| 1bb7ff4204b6 ("exfat: fix random stack corruption after get_block") |
| beff0bc9d69b ("ksmbd: fix overflow in dacloffset bounds check") |
| bab703ed8472 ("ksmbd: add bounds check for create lease context") |
| fa4cdb8cbca7 ("ksmbd: fix session use-after-free in multichannel connection") |
| 15a9605f8d69 ("ksmbd: fix use-after-free in ksmbd_sessions_deregister()") |
| 542027e123fc ("ksmbd: add bounds check for durable handle context") |
| 2ff0e408db36 ("acpi: nfit: fix narrowing conversion in acpi_nfit_ctl") |
| 3ef938c35035 ("x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs") |
| 707549600c4a ("bcachefs: bch2_ioctl_subvolume_destroy() fixes") |
| fa6192adc32f ("uprobes/x86: Harden uretprobe syscall trampoline check") |
| 31ab12df7235 ("x86/microcode/AMD: Fix __apply_microcode_amd()'s return value") |
| 74c1807f6c4f ("KVM: x86: block KVM_CAP_SYNC_REGS if guest state is protected") |
| 7e2586991e36 ("LoongArch: BPF: Fix off-by-one error in build_prologue()") |
| 4103cfe9dcb8 ("LoongArch: Increase ARCH_DMA_MINALIGN up to 16") |
| 60f3caff1492 ("LoongArch: BPF: Don't override subprog's return value") |
| 51de36000934 ("usbnet:fix NPE during rx_complete") |
| 8491e73a5223 ("staging: gpib: Fix Oops after disconnect in agilent usb") |
| a239c6e91b66 ("staging: gpib: Fix Oops after disconnect in ni_usb") |
| fda8c491db2a ("arcnet: Add NULL check in com20020pci_probe()") |
| 053f3ff67d7f ("net: ibmveth: make veth_pool_store stop hanging") |
| a58d882841a0 ("net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy") |
| b27055a08ad4 ("net: fix geneve_opt length integer overflow") |
| 1b755d8eb1ac ("netfilter: nft_tunnel: fix geneve_opt type confusion addition") |
| 3a0a3ff6593d ("net: decrease cached dst counters in dst_release") |
| 5a465a0da13e ("udp: Fix multiple wraparounds of sk->sk_rmem_alloc.") |
| df207de9d9e7 ("udp: Fix memory accounting leak.") |
| 96844075226b ("net: mvpp2: Prevent parser TCAM memory corruption") |
| 57b290d97c61 ("net: airoha: Fix qid report in airoha_tc_get_htb_get_leaf_queue()") |
| 10206302af85 ("sctp: add mutual exclusion in proc_sctp_do_udp_port()") |
| 078aabd567de ("netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets") |
| 4c9106f4906a ("idpf: fix adapter NULL pointer dereference on reboot") |
| 688c15017d5c ("netfilter: nf_tables: don't unregister hook when table is dormant") |
| 93d34608fd16 ("ASoC: imx-card: Add NULL check in imx_card_probe()") |
| 7ba0847fa1c2 ("spi: cadence: Fix out-of-bounds array access in cdns_mrvl_xspi_setup_clock()") |
| 83d78ac677b9 ("riscv: Fix hugetlb retrieval of number of ptes in case of !present pte") |
| 8741d0737921 ("ublk: make sure ubq->canceling is set when queue is frozen") |
| 67a5ba8f742f ("riscv: fgraph: Fix stack layout to match __arch_ftrace_regs argument of ftrace_return_to_handler") |
| de203da734fa ("ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans") |
| d1ca8698ca13 ("spufs: fix a leak on spufs_new_file() failure") |
| 0f5cce3fc55b ("spufs: fix a leak in spufs_create_context()") |
| 3f61ac7c65bd ("fs/9p: fix NULL pointer dereference on mkdir") |
| c134deabf478 ("spufs: fix gang directory lifetimes") |
| 8e5419d6542f ("nfs: Add missing release on error in nfs_lock_and_join_requests()") |
| 6171063e9d04 ("ksmbd: use aead_request_free to match aead_request_alloc") |
| ddb7ea36ba71 ("ksmbd: fix r_count dec/increment mismatch") |
| 23f00807619d ("rtnetlink: Allocate vfinfo size for VF GUIDs when supported") |
| 4e7f1644f2ac ("smb: client: Fix netns refcount imbalance causing leaks and use-after-free") |
| 47e35366bc6f ("exfat: fix missing shutdown check") |
| 107a23185d99 ("objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show()") |
| 76e51db43fe4 ("objtool, spi: amd: Fix out-of-bounds stack access in amd_set_spi_freq()") |
| 3db89bc6d973 ("staging: vchiq_arm: Fix possible NPR of keep-alive thread") |
| a406aff8c051 ("ocfs2: validate l_tree_depth to avoid out-of-bounds access") |
| 096cbb80ab3f ("kernel/events/uprobes: handle device-exclusive entries correctly in __replace_page()") |
| ee735aa33db1 ("iio: light: Add check for array bounds in veml6075_read_int_time_ms") |
| c9c59da76ce9 ("dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister") |
| 5ad414f4df22 ("fs/ntfs3: Fix a couple integer overflows on 32bit systems") |
| 6bb81b94f7a9 ("fs/ntfs3: Prevent integer overflow in hdr_first_de()") |
| 035b4989211d ("iio: backend: make sure to NULL terminate stack buffer") |
| 5dd639a1646e ("vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint") |
| 0dd6770a72f1 ("w1: fix NULL pointer dereference in probe") |
| 0a7c2a843596 ("libbpf: Fix accessing BTF.ext core_relo header") |
| 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name") |
| 5ed3b0cb3f82 ("RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow") |
| 6ebc5030e0c5 ("bpf: Fix array bounds error with may_goto") |
| 00153c64a72d ("clk: mmp: Fix NULL vs IS_ERR() check") |
| 7505436e2925 ("crypto: api - Fix larval relookup type and mask") |
| 83437689249e ("RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()") |
| a1ecb30f9085 ("RDMA/core: Don't expose hw_counters outside of init net namespace") |
| b4a8b5bba712 ("bpf: Use preempt_count() directly in bpf_send_signal_common()") |
| 1e245948ca0c ("crypto: tegra - finalize crypto req on error") |
| bde558220866 ("crypto: tegra - Set IV to NULL explicitly for AES ECB") |
| ce390d6c2675 ("crypto: tegra - Fix CMAC intermediate result handling") |
| dc84bc2aba85 ("x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()") |
| f0c2427412b4 ("RDMA/mlx5: Fix page_size variable overflow") |
| ff4b7df0b511 ("crypto: tegra - Fix HASH intermediate result handling") |
| 04d50d953ab4 ("PCI: Fix NULL dereference in SR-IOV VF creation error path") |
| 42d9d7bed270 ("drm/amd/display: avoid NPD when ASIC does not support DMUB") |
| ff99d5b6a246 ("powerpc/perf: Fix ref-counting on the PMU 'vpa_pmu'") |
| c63c3bfdde26 ("drm/panthor: Avoid sleep locking in the internal BO size path") |
| e379856b428a ("drm/panthor: Replace sleep locks with spinlocks in fdinfo path") |
| 3651ad5249c5 ("PCI: brcmstb: Fix error path after a call to regulator_bulk_get()") |
| fddc45026311 ("drm/amdkfd: Fix Circular Locking Dependency in 'svm_range_cpu_invalidate_pagetables'") |
| 0b305b7cadce ("drm/msm/gem: Fix error code msm_parse_deps()") |
| cbf937dcadfd ("PCI/ASPM: Fix link state exit during switch upstream function removal") |
| dc0297f3198b ("drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversion in SRIOV") |
| ed15511a773d ("drm/vkms: Fix use after free and double free on init error") |
| f887685ee0eb ("drm: zynqmp_dp: Fix a deadlock in zynqmp_dp_ignore_hpd_set()") |
| d0660f9c588a ("drm: xlnx: zynqmp_dpsub: Add NULL check in zynqmp_audio_init") |
| 0590c94c3596 ("drm/panthor: Fix race condition when gathering fdinfo group samples") |
| c7d82913d5f9 ("net: libwx: fix Tx L4 checksum") |
| 1f77c05408c9 ("Bluetooth: btnxpuart: Fix kernel panic during FW release") |
| 0dd765fae295 ("vmxnet3: unregister xdp rxq info in the reset path") |
| 094ee6017ea0 ("bonding: check xdp prog when set bond mode") |
| 0032c99e83b9 ("net: fix NULL pointer dereference in l3mdev_l3_rcv") |
| d93a6caab5d7 ("ibmvnic: Use kernel helpers for hex dumps") |
| 5f2b28b79d2d ("net: dsa: sja1105: fix kasan out-of-bounds warning in sja1105_table_delete_entry()") |
| 2f6efbabceb6 ("ax25: Remove broken autobind") |
| 107b25db6112 ("bnxt_en: Mask the bd_cnt field in the TX BD properly") |
| 778b09d91baa ("netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error") |
| 919f9f497dbc ("eth: bnxt: fix out-of-range access of vnic_info array") |
| ed3ba9b6e280 ("net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.") |
| ce2f26e73783 ("ext4: avoid journaling sb update on error if journal is destroying") |
| 2d8e5168d48a ("btrfs: fix block group refcount race in btrfs_create_pending_block_groups()") |
| 9db9c7dd5b4e ("btrfs: don't clobber ret in btrfs_validate_super()") |
| 1388dd564183 ("ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw()") |
| 680811c67906 ("idpf: check error for register_netdev() on init") |
| e2f7d3f7331b ("ice: validate queue quanta parameters to prevent OOB access") |
| fc88dee89d7b ("wifi: cfg80211: init wiphy_work before allocating rfkill fails") |
| 7e91ae31e2d2 ("ext4: goto right label 'out_mmap_sem' in ext4_setattr()") |
| 5701875f9609 ("ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all()") |
| 26064d3e2b4d ("block: fix adding folio to bio") |
| 986c50f6bca1 ("f2fs: fix to avoid accessing uninitialized curseg") |
| f7f8932ca6bb ("f2fs: fix to avoid running out of free segments") |
| 41a8e04c94b8 ("gfs2: skip if we cannot defer delete") |
| 6130825f34d4 ("md/md-bitmap: fix wrong bitmap_limit for clustermd when write sb") |
| e879a0d9cb08 ("md/raid1,raid10: don't ignore IO flags") |
| 8542870237c3 ("md: fix mddev uaf while iterating all_mddevs list") |
| 3147ee567dd9 ("f2fs: fix potential deadloop in prepare_compress_overwrite()") |
| b43b1e2c52db ("wifi: ath12k: Clear affinity hint before calling ath12k_pci_free_irq() in error path") |
| 68410c5bd381 ("wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path") |
| b5799dd77054 ("jfs: add check read-only before truncation in jfs_truncate_nolock()") |
| 0176e69743ec ("jfs: add check read-only before txBeginAnon() call") |
| c733741ae1c3 ("scsi: mpi3mr: Fix locking in an error path") |
| b9c7299a3341 ("wifi: ath12k: Fix locking in "QMI firmware ready" error paths") |
| 63b7af49496d ("wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode") |
| 16c6c35c03ea ("wifi: ath11k: fix RCU stall while reaping monitor destination ring") |
| 48ea8b200414 ("f2fs: fix to avoid panic once fallocation fails for pinfile") |
| 8e2bad543eca ("dlm: prevent NPD when writing a positive value to event_done") |
| 933ab187e679 ("wifi: ath11k: update channel list in reg notifier instead reg worker") |
| eb85c2410d6f ("f2fs: quota: fix to avoid warning in dquot_writeback_dquots()") |
| 3424c8f53bc6 ("ALSA: timer: Don't take register_mutex with copy_from/to_user()") |
| de74ec718e07 ("ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai()") |
| 2d117e67f318 ("RISC-V: KVM: Teardown riscv specific bits after kvm_exit") |
| 2542a3f70e56 ("thermal: int340x: Add NULL check for adev") |
| c929d08df8be ("x86/split_lock: Fix the delayed detection logic") |
| 426db24d4db2 ("cpufreq/amd-pstate: Add missing NULL ptr check in amd_pstate_update") |
| 5d3b81d4d852 ("x86/fpu: Avoid copying dynamic FP state from init_task in arch_dup_task_struct()") |
| 267e5b1d2675 ("EDAC/igen6: Fix the flood of invalid error reports") |
| 1937e18cc3cf ("x86/fpu: Fix guest FPU state buffer allocation size") |
| f13abc1e8e1a ("watch_queue: fix pipe accounting mismatch") |
