gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character

netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

net/sched: Always pass notifications when child class becomes empty

hrtimers: Handle CPU state correctly on hotplug

net: sched: fix ets qdisc OOB Indexing

af_packet: avoid erroring out after sock_init_data() in packet_create()

net: inet: do not leave a dangling sk pointer in inet_create()

net: inet6: do not leave a dangling sk pointer in inet6_create()

ovl: Filter invalid inodes with missing lookup function

sh: intc: Fix use-after-free bug in register_intc_controller()

net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT

bpf: Fix out-of-bounds write in trie_get_next_key()

aoe: fix the potential use-after-free problem in more places

ext4: avoid use-after-free in ext4_ext_show_leaf()

ext4: fix slab-use-after-free in ext4_split_extent_at()

ext4: avoid OOB when system.data xattr changes underneath the filesystem

RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency

hwmon: (adc128d818) Fix underflows seen when writing limit attributes

Squashfs: sanity check symbolic link size

ipv6: prevent UAF in ip6_send_skb()

Out-of-bounds read & write in RFC 3211 KEK Unwrap

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

net: ethernet: lantiq_etop: fix memory disclosure

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to…

gzip integer overflow

igb: Fix potential invalid memory access in igb_init_module()

netfilter: x_tables: fix LED ID check in led_tg_check()

security/keys: fix slab-out-of-bounds in key_task_permission

ppp: fix ppp_async_encode() illegal access

slip: make slhc_remember() more robust against malicious packets

of/irq: Prevent device address out-of-bounds read in interrupt map walk

eventfd double close

net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition

OCSP stapling bypass with GnuTLS

ASN.1 date parser overread

netfilter: nft_payload: sanitize offset and length before calling skb_checksum()

pam_cap: Fix potential configuration parsing error

Out-of-bounds read in HTTP client no_proxy handling

An issue was discovered in libexpat before 2.6.4

do_change_type(): refuse to operate on unmounted/not ours mounts

fs/proc: fix softlockup in __read_vmcore (part 2)

bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again

quota: flush quota_release_work upon quota writeback

net/sched: netem: account for backlog updates from child qdisc

net/ipv6: release expired exception dst cached in socket

ftrace: Fix regression with module command in stack_trace_filter

fs: Fix uninitialized value issue in from_kuid and from_kgid

sctp: properly validate chunk size in sctp_sf_ootb()