ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

kprobes: Fix possible use-after-free issue on kprobe registration

In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to…

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyze_string in progs/infocmp.c

netfilter: nf_tables: fix use-after-free in nf_tables_addchain()

netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()

mm/page_alloc: prevent pcp corruption with SMP=n

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation

tipc: Fix use-after-free in tipc_mon_reinit_self().

fs/proc: fix uaf in proc_readdir_de()

Input: imx_sc_key - fix memory corruption on unload

net/mlx5: Clean up only new IRQ glue on request_irq() failure

vsock: Ignore signal/timeout on connect() if already established

af_unix: Initialise scc_index in unix_add_edge().

tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.

wifi: cfg80211: fix use-after-free in cmp_bss()

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

scsi: lpfc: Fix buffer free/clear order in deferred receive path

net/sched: Always pass notifications when child class becomes empty

hrtimers: Handle CPU state correctly on hotplug

net: sched: fix ets qdisc OOB Indexing

af_packet: avoid erroring out after sock_init_data() in packet_create()

net: inet: do not leave a dangling sk pointer in inet_create()

net: inet6: do not leave a dangling sk pointer in inet6_create()

ovl: Filter invalid inodes with missing lookup function

sh: intc: Fix use-after-free bug in register_intc_controller()

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

bpf: Fix out-of-bounds write in trie_get_next_key()

aoe: fix the potential use-after-free problem in more places

ext4: avoid use-after-free in ext4_ext_show_leaf()

ext4: fix slab-use-after-free in ext4_split_extent_at()

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

Squashfs: sanity check symbolic link size

ipv6: prevent UAF in ip6_send_skb()

net: ethernet: lantiq_etop: fix double free in detach

block/ioctl: prefer different overflow check

netns: Make get_net_ns() handle zero refcount net

ionic: fix use after netif_napi_del()

speakup: Fix sizeof() vs ARRAY_SIZE() bug

ecryptfs: Fix buffer size for tag 66 packet

net: sched: sch_multiq: fix possible OOB write in multiq_tune()

net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP

pinctrl: core: delete incorrect free in pinctrl_enable()

bna: ensure the copied buf is NUL terminated

tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

net: gtp: Fix Use-After-Free in gtp_dellink

net: openvswitch: Fix Use-After-Free in ovs_ct_exit

init/main.c: Fix potential static_command_line memory overflow