tls: fix handling of zero-length records on the rx_list

crypto: algif_aead - Revert to operating out-of-place

Heap Buffer Overflow in Hexadecimal Conversion

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0)

Potential Use-after-free in DANE Client Code

fs: writeback: fix use-after-free in __mark_inode_dirty()

Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()

bus: mhi: host: Detect events pointing to unexpected TREs

PCI: endpoint: Fix configfs group list head handling

mm/debug_vm_pgtable: clear page table entries at destroy_args()

btrfs: do not allow relocation of partially dropped subvolumes

fs/buffer: fix use-after-free when call bh_read() helper

ftrace: Also allocate and copy hash for reading of filter files

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

drbd: add missing kref_get in handle_write_conflicts

fbdev: fix potential buffer overflow in do_register_framebuffer()

fbdev: Fix vmalloc out-of-bounds write in fast_imageblit

tls: separate no-async decryption request handling from async

mptcp: plug races between subflow fail and subflow creation

Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0)

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

NULL Pointer Dereference When Processing a Delta CRL

Out-of-bounds read & write in RFC 3211 KEK Unwrap

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

tracing: Limit access to parser->buffer when trace_get_user failed

net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization

smb3: fix for slab out of bounds on mount to ksmbd

bpf: Fix oob access in cgroup local storage

net: rose: convert 'use' field to refcount_t

ipv6: sr: Fix MAC comparison to be constant-time

Out-of-Bounds read vulnerability in TCG TPM2.0 reference implementation

Out-of-bounds read in HTTP client no_proxy handling

net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync()

x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings()

net: rose: include node references in rose_neigh refcount

NFS: Fix the setting of capabilities when automounting a new filesystem

block: avoid possible overflow for chunk_sectors check in blk_stack_limits()

soc: qcom: mdt_loader: Ensure we don't read past the ELF header

jbd2: prevent softlockup in jbd2_log_do_checkpoint()

net: bridge: fix soft lockup in br_multicast_query_expired()

net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

fs: Prevent file descriptor table allocations exceeding INT_MAX

x86/vmscape: Add conditional IBPB mitigation

serial: 8250: fix panic due to PSLVERR

vsock/virtio: Validate length in packet header before skb_put()

net, hsr: reject HSR frame if skb can't hold tag

x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper