nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

mptcp: fix race condition in mptcp_schedule_work()

mptcp: fix a race in mptcp_pm_del_add_timer()

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character

An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

SSL_select_next_proto buffer overread

net/mlx5: Properly link new fs rules into the tree

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

kprobes: Fix possible use-after-free issue on kprobe registration

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

mm/page_alloc: prevent pcp corruption with SMP=n

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation

tipc: Fix use-after-free in tipc_mon_reinit_self().

fs/proc: fix uaf in proc_readdir_de()

Input: imx_sc_key - fix memory corruption on unload

net/mlx5: Clean up only new IRQ glue on request_irq() failure

vsock: Ignore signal/timeout on connect() if already established

af_unix: Initialise scc_index in unix_add_edge().

tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

wifi: cfg80211: fix use-after-free in cmp_bss()

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

scsi: lpfc: Fix buffer free/clear order in deferred receive path

net/sched: Always pass notifications when child class becomes empty

hrtimers: Handle CPU state correctly on hotplug

net: sched: fix ets qdisc OOB Indexing

af_packet: avoid erroring out after sock_init_data() in packet_create()

net: inet: do not leave a dangling sk pointer in inet_create()

net: inet6: do not leave a dangling sk pointer in inet6_create()

ovl: Filter invalid inodes with missing lookup function

sh: intc: Fix use-after-free bug in register_intc_controller()

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

bpf: Fix out-of-bounds write in trie_get_next_key()

aoe: fix the potential use-after-free problem in more places

ext4: avoid use-after-free in ext4_ext_show_leaf()

ext4: fix slab-use-after-free in ext4_split_extent_at()

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

Squashfs: sanity check symbolic link size

ipv6: prevent UAF in ip6_send_skb()

net: ethernet: lantiq_etop: fix double free in detach