ksmbd: ipc: fix use-after-free in ipc_msg_send_request

net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup

net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ

nvmet-fc: avoid scheduling association deletion twice

RDMA/siw: Fix QP destroy to wait for all references dropped.

cifs: fix session state check in reconnect to avoid use-after-free issue

cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname

smb: client: fix potential cfid UAF in smb2_query_info_compound

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

mptcp: fix race condition in mptcp_schedule_work()

mptcp: fix a race in mptcp_pm_del_add_timer()

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

nfsd: fix refcount leak in nfsd_set_fh_dentry()

tls: wait for pending async decryptions if tls_strp_msg_hold fails

ipv4: start using dst_dev_rcu()

smb: client: fix wrong index reference in smb2_compound_op()

RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

nfsd: clear acl_access/acl_default after releasing them

NFSD: Fix potential use-after-free in nfsd_file_put()

skbuff: fix coalescing for page_pool fragment recycling

smb: prevent use-after-free due to open_cached_dir error paths

smb: client: Fix use-after-free of network namespace.

mctp: serial: handle zero-length frames to prevent rx buffer overflow

inetpeer: randomize RB-tree node comparison using SipHash

mptcp: fastopen: only mark MPTFO subflows with SYN data

riscv: lib: Fix ZBB strnlen reading past count boundary

cifs: validate DFS referral string offsets

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

net: skmsg: preserve sg.copy across SG transforms

netfilter: require Ethernet MAC header before using eth_hdr()

net/tcp-md5: Fix MAC comparison to be constant-time

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

netfilter: ip6t_eui64: reject invalid MAC header for all packets

ext4: avoid infinite loops caused by residual data

cifs: parse_dfs_referrals: prevent oob on malformed input

RISC-V: KVM: Synchronize hrtimer callback during teardown

ipv4: validate checksum_start before completing checksum

net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

KVM: arm64: Correctly handle end of VA space TLBI invalidation

KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

KVM: arm64: Remove VM-wide VNCR mapping counter

KVM: arm64: Sign-extend VA for range-based TLBI invalidation

KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

iommu/vt-d: Force requesting ACS when tboot is enabled

idpf: bound interrupt-vector register fill to the allocated array

KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

s390/vfio_ccw: Limit the number of channel program segments

s390/vfio_ccw: Ensure first IDAW remains constant