tls: fix handling of zero-length records on the rx_list

netfilter: bridge: make ebt_snat ARP rewrite writable

ipv6: account for fraggap on the paged allocation path

crypto: algif_aead - Revert to operating out-of-place

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

net: fix __dst_negative_advice() race

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

HID: core: zero-initialize the report buffer

udp: fix potential use-after-free in tunnel segmentation

veth: fix skb length accounting after XDP frag adjustment

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler

crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

crypto: cavium/cpt - fix DMA cleanup using wrong loop index

ipv4: fib: Don't ignore error route in local/main tables.

geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

geneve: validate inner network offset in geneve_gro_complete()

9p: avoid putting oldfid in p9_client_walk() error path

net: serialize netif_running() check in enqueue_to_backlog()

net/mlx5e: Prevent stale XSK buffer release on refill retry

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

btrfs: fix xattr replace when multiple xattrs are packed in the same item

sctp: discard the rest of the packet on a stale-cookie error

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

ipv4: free inet_opt and ireq_opt after an RCU grace period

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

RDMA/siw: Bound fragmented header copies by the remaining length

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

xfrm: Fix skb double-free in xfrm_dev_direct_output()

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

smb: smbdirect: free completion queues with ib_free_cq()

NFSv4: remove callback IDR entry on client allocation failure

NFSv4.1: zero referring call lists before decoding

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

ceph: properly decrypt filenames in vmalloc() buffers

NFSD: Prevent client use-after-free during export state revocation

NFSD: Prevent client use-after-free during close_lru reaping

NFSD: Prevent client use-after-free during blocked-lock reaping

spi: Fix DMA mapping ownership on partial map failure

ceph: lock mutex in ceph_mds_check_access()

nvme: add missing SRCU grace period in error path

nvmet-auth: Synchronize timeout work during SQ teardown

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

scsi: qla2xxx: Avoid double completion in async IOCB timeout