wifi: cfg80211: fix use-after-free in cmp_bss()

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

scsi: lpfc: Fix buffer free/clear order in deferred receive path

net/sched: Always pass notifications when child class becomes empty

hrtimers: Handle CPU state correctly on hotplug

net: sched: fix ets qdisc OOB Indexing

af_packet: avoid erroring out after sock_init_data() in packet_create()

net: inet: do not leave a dangling sk pointer in inet_create()

net: inet6: do not leave a dangling sk pointer in inet6_create()

ovl: Filter invalid inodes with missing lookup function

sh: intc: Fix use-after-free bug in register_intc_controller()

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

bpf: Fix out-of-bounds write in trie_get_next_key()

aoe: fix the potential use-after-free problem in more places

ext4: avoid use-after-free in ext4_ext_show_leaf()

ext4: fix slab-use-after-free in ext4_split_extent_at()

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

Squashfs: sanity check symbolic link size

ipv6: prevent UAF in ip6_send_skb()

Out-of-bounds read & write in RFC 3211 KEK Unwrap

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

Out of bounds read for cookie path

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

net: ethernet: lantiq_etop: fix memory disclosure

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to…

gzip integer overflow

i40e: Fix potential invalid access when MAC list is empty

batman-adv: fix OOB read/write in network-coding decode

igb: Fix potential invalid memory access in igb_init_module()

netfilter: x_tables: fix LED ID check in led_tg_check()

security/keys: fix slab-out-of-bounds in key_task_permission

ppp: fix ppp_async_encode() illegal access

slip: make slhc_remember() more robust against malicious packets

of/irq: Prevent device address out-of-bounds read in interrupt map walk

eventfd double close

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition