tls: fix handling of zero-length records on the rx_list

udp: fix potential use-after-free in tunnel segmentation

veth: fix skb length accounting after XDP frag adjustment

vxlan: use neigh_ha_snapshot() in route_shortcircuit()

vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler

crypto: marvell/octeontx - fix DMA cleanup using wrong loop index

crypto: cavium/cpt - fix DMA cleanup using wrong loop index

ipv4: fib: Don't ignore error route in local/main tables.

geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint

geneve: validate inner network offset in geneve_gro_complete()

9p: avoid putting oldfid in p9_client_walk() error path

net: serialize netif_running() check in enqueue_to_backlog()

net/mlx5e: Prevent stale XSK buffer release on refill retry

net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

btrfs: fix xattr replace when multiple xattrs are packed in the same item

sctp: discard the rest of the packet on a stale-cookie error

net: openvswitch: conntrack: fix helper UAF due to extensions realloc

ipv4: free inet_opt and ireq_opt after an RCU grace period

RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access

RDMA/siw: Bound fragmented header copies by the remaining length

RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

xfrm: Fix skb double-free in xfrm_dev_direct_output()

sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

smb: smbdirect: free completion queues with ib_free_cq()

NFSv4: remove callback IDR entry on client allocation failure

NFSv4.1: zero referring call lists before decoding

fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()

ceph: properly decrypt filenames in vmalloc() buffers

NFSD: Prevent client use-after-free during export state revocation

NFSD: Prevent client use-after-free during close_lru reaping

NFSD: Prevent client use-after-free during blocked-lock reaping

spi: Fix DMA mapping ownership on partial map failure

ceph: lock mutex in ceph_mds_check_access()

nvme: add missing SRCU grace period in error path

nvmet-auth: Synchronize timeout work during SQ teardown

nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU

scsi: qla2xxx: Hold qpair lock when sending NVMe LS reject

scsi: qla2xxx: Avoid double completion in async IOCB timeout

ksmbd: fix tree connection use-after-free in smb2_tree_connect()

xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full

isofs: fix out-of-bounds page array access on empty zisofs block

NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock

nfsd: RCU-protect cl_cb_session to fix use-after-free on session teardown

nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations

nfsd: size fh_verify server sockaddr slot by xpt_locallen

nfsd: don't free session slots that are still in use

nfsd: drop the stateid, not the stateowner, on seqid_op replay retry

nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke