drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

futex: Drop CLONE_THREAD requirement for private default hash alloc

drm/xe/dma-buf: handle empty bo and UAF races

drm/xe/dma-buf: fix UAF with retry loop

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

net/sched: fix pedit partial COW leading to page cache corruption

Heap buffer overflow in Calc formula compilation

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen

net: gro: don't merge zcopy skbs

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Rrdtool: rrdtool: stack buffer overflow allows local code execution or denial of service

Poppler: integer overflow in poppler splashoutputdev::tilingpatternfill leads to heap buffer overflow via unchecked dimension multiplication

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

RDMA/mana: Validate rx_hash_key_len

RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

ALSA: aloop: Fix peer runtime UAF during format-change stop

rxrpc: Fix potential UAF after skb_unshare() failure

gfs2: Fix use-after-free in iomap inline data write path

RDMA/rxe: Fix double free in rxe_srq_from_init

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

net: skbuff: preserve shared-frag marker during coalescing

HP Linux Imaging and Printing Software – Potential Escalation of Privilege and Arbitrary Code Execution

netfilter: flowtable: strictly check for maximum number of actions

xfrm: hold dev ref until after transport_finish NF_HOOK

Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access

Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption

Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling

drm/amd/display: Do not skip unrelated mode changes in DSC validation

can: isotp: fix tx.buf use-after-free in isotp_sendmsg()

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing

In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

net: bonding: fix use-after-free in bond_xmit_broadcast()

GIMP XPM File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP JP2 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability