mctp: serial: handle zero-length frames to prevent rx buffer overflow

inetpeer: randomize RB-tree node comparison using SipHash

mptcp: fastopen: only mark MPTFO subflows with SYN data

riscv: lib: Fix ZBB strnlen reading past count boundary

cifs: validate DFS referral string offsets

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

net: skmsg: preserve sg.copy across SG transforms

netfilter: require Ethernet MAC header before using eth_hdr()

net/tcp-md5: Fix MAC comparison to be constant-time

netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry

netfilter: ip6t_eui64: reject invalid MAC header for all packets

ext4: avoid infinite loops caused by residual data

cifs: parse_dfs_referrals: prevent oob on malformed input

RISC-V: KVM: Synchronize hrtimer callback during teardown

ipv4: validate checksum_start before completing checksum

net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()

KVM: nVMX: Service local TLB flushes on failed nested VM-Enter

KVM: arm64: Correctly handle end of VA space TLBI invalidation

KVM: arm64: Make VNCR invalidation participate in MMU invalidation retry

KVM: arm64: Remove VM-wide VNCR mapping counter

KVM: arm64: Sign-extend VA for range-based TLBI invalidation

KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation

iommu/vt-d: Force requesting ACS when tboot is enabled

idpf: bound interrupt-vector register fill to the allocated array

KVM: s390: pci: Fix NULL dereference on AIBV allocation failure

perf sched: Fix register_pid() overflow, strcpy, and BUG_ON

s390/vfio_ccw: Limit the number of channel program segments

s390/vfio_ccw: Ensure first IDAW remains constant

vdpa/mlx5: Fix buffer length in create_direct_keys()

iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE

KVM: arm64: vgic: Fix race between LPI release and re-registration

KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs

iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry

vhost/net: complete zerocopy ubufs only once

RDMA/bnxt_re: Avoid repeated requests to allocate WC pages

s390/mm: Fix handling of _PAGE_UNUSED pte bit

net/liquidio: drop cached VF pci_dev LUT

KVM: s390: Fix unlikely race in try_get_locked_pte()

KVM: arm64: vgic: Check the interrupt is still ours before migrating it

KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling

KVM: arm64: nv: Re-translate VNCR before injecting abort

KVM: arm64: nv: Inject SEA if guest VNCR isn't normal memory

x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"

scsi: xen: scsiback: Free unsubmitted command instead of double-putting it

firmware: arm_ffa: Snapshot notifier callbacks under lock

net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer

net: mana: validate rx_req_idx to prevent out-of-bounds array access

KVM: SEV: Ignore Port I/O requests of length '0'

KVM: SEV: Compute the correct max length of the in-GHCB scratch area

KVM: SEV: Check PSC request indices against the actual size of the buffer