net: skmsg: preserve sg.copy across SG transforms

netfilter: require Ethernet MAC header before using eth_hdr()

net/tcp-md5: Fix MAC comparison to be constant-time

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

netfilter: ip6t_eui64: reject invalid MAC header for all packets

ext4: avoid infinite loops caused by residual data

In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item…

firmware: arm_ffa: Snapshot notifier callbacks under lock

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

net: mana: validate rx_req_idx to prevent out-of-bounds array access

KVM: SEV: Check PSC request indices against the actual size of the buffer

KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted…

tipc: fix out-of-bounds read in broadcast Gap ACK blocks

ksmbd: run set info with opener credentials

ksmbd: use opener credentials for delete-on-close

nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page

nvmet-auth: validate reply message payload bounds against transfer length

RDMA/rtrs-srv: Bound RDMA-Write length to chunk size in rdma_write_sg

smb: client: reject overlapping data areas in SMB2 responses

tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

sctp: fix uninit-value in __sctp_rcv_asconf_lookup()

sctp: validate embedded INIT chunk and address list lengths in cookie

RDMA/srp: bound SRP_RSP sense copy by the received length

ocfs2/dlm: validate qr_numregions in dlm_match_regions()

netfilter: nfnetlink_osf: fix out-of-bounds read on option matching

libceph: Fix potential out-of-bounds access in osdmap_decode()

inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP

netfilter: nft_inner: Fix IPv6 inner_thoff desync

smb/client: fix out-of-bounds read in symlink_data()

smb/client: fix out-of-bounds read in smb2_compound_op()

libceph: Fix slab-out-of-bounds access in auth message processing

RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv

libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()

libceph: prevent potential out-of-bounds reads in process_message_header()

netconsole: avoid OOB reads, msg is not nul-terminated

btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()

net: ioam6: fix OOB and missing lock

dcache: Limit the minimal number of bucket to two

bridge: br_nd_send: linearize skb before parsing ND options

rxrpc: fix RESPONSE authenticator parser OOB read

netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in…

In the Linux kernel, the following vulnerability has been resolved: isofs: Fix out of bound access for corrupted isofs image When isofs image is suitably corrupted…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if…

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never…

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP over-read and corruption Instead of reading the desired 5 bytes of the actual…

net/mlx5: Properly link new fs rules into the tree

wifi: iwlwifi: dbg-tlv: ensure NUL termination