stack_protect_prologue in cfgexpand.c and stack_protect_epilogue in function.c in GNU Compiler Collection (GCC) 4.1 through 8 (under certain circumstances) generate instruction…

An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0

NFSD: NFSv4 file creation neglects setting ACL

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

ipv4: igmp: remove multicast group from hash table on device destruction

proc: protect ptrace_may_access() with exec_update_lock (FD links)

i2c: core: fix adapter deregistration race

i2c: core: fix adapter registration race

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

quota: Fix race of dquot_scan_active() with quota deactivation

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

io_uring/poll: fix signed comparison in io_poll_get_ownership()

netfilter: nf_queue: hold bridge skb->dev while queued

bpf: Free reuseport cBPF prog after RCU grace period.

net: gro: don't merge zcopy skbs

exit: prevent preemption of oopsing TASK_DEAD task

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

tcp: call sk_data_ready() after listener migration

net: skbuff: preserve shared-frag marker during coalescing

rtmutex: Use waiter::task instead of current in remove_waiter()

mm/page_alloc: clear page->private in free_pages_prepare()

netfilter: ctnetlink: ensure safe access to master conntrack

crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption

bpf: Fix regsafe() for pointers to packet

netfilter: nf_conntrack_helper: pass helper to expect cleanup

iio: adc: ti-adc161s626: use DMA-safe memory for spi_read()

iio: gyro: mpu3050: Move iio_device_register() to correct location

net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()

net: ipv6: flowlabel: defer exclusive option free until RCU teardown

netfilter: nft_ct: fix use-after-free in timeout object destroy

net: openvswitch: Avoid releasing netdev before teardown completes

net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer

net: fix fanout UAF in packet_release() via NETDEV_UP race

net: macb: use the current queue number for stats

spi: spi-fsl-lpspi: fix teardown order issue (UAF)

virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false

ext4: convert inline data to extents when truncate exceeds inline size

ext4: validate p_idx bounds in ext4_ext_correct_indexes

ext4: reject mount if bigalloc with s_first_data_block != 0

ext4: fix use-after-free in update_super_work when racing with umount

NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

net: macb: fix use-after-free access to PTP clock

spi: fix use-after-free on controller registration failure

netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()

net/sched: teql: Fix double-free in teql_master_xmit

dpaa2-switch: Fix interrupt storm after receiving bad if_id in IRQ handler

netfilter: nf_tables: release flowtable after rcu grace period on error

netfilter: xt_CT: drop pending enqueued packets on template removal

net/sched: act_ife: Fix metalist update behavior

bpf: Fix stack-out-of-bounds write in devmap