nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end()

gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character

An issue was discovered in libexpat before 2.6.3

An issue was discovered in libexpat before 2.6.3

Libxml: heap use after free (uaf) leads to denial of service (dos)

Libxml: type confusion leads to denial of service (dos)

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

SSL_select_next_proto buffer overread

net/mlx5: Properly link new fs rules into the tree

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

kprobes: Fix possible use-after-free issue on kprobe registration

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

mm/page_alloc: prevent pcp corruption with SMP=n

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation

net/mlx5: Clean up only new IRQ glue on request_irq() failure

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

net/sched: Always pass notifications when child class becomes empty

hrtimers: Handle CPU state correctly on hotplug

net: sched: fix ets qdisc OOB Indexing

af_packet: avoid erroring out after sock_init_data() in packet_create()

net: inet: do not leave a dangling sk pointer in inet_create()

net: inet6: do not leave a dangling sk pointer in inet6_create()

ovl: Filter invalid inodes with missing lookup function

sh: intc: Fix use-after-free bug in register_intc_controller()

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

bpf: Fix out-of-bounds write in trie_get_next_key()

aoe: fix the potential use-after-free problem in more places

ext4: avoid use-after-free in ext4_ext_show_leaf()

ext4: fix slab-use-after-free in ext4_split_extent_at()

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

Squashfs: sanity check symbolic link size

ipv6: prevent UAF in ip6_send_skb()

net: ethernet: lantiq_etop: fix double free in detach

block/ioctl: prefer different overflow check

netns: Make get_net_ns() handle zero refcount net

ionic: fix use after netif_napi_del()

speakup: Fix sizeof() vs ARRAY_SIZE() bug

ecryptfs: Fix buffer size for tag 66 packet

net: sched: sch_multiq: fix possible OOB write in multiq_tune()

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

pinctrl: core: delete incorrect free in pinctrl_enable()

bna: ensure the copied buf is NUL terminated

tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().