ipv4: icmp: validate reply type before using icmp_pointers

slip: bound decode() reads against the compressed packet length

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size

Bluetooth: RFCOMM: validate skb length in MCC handlers

thunderbolt: Validate XDomain request packet size before type cast

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb: client: fix OOB reads parsing symlink error response

Potential Use-after-free in DANE Client Code

ipv6: use RCU in ip6_xmit()

arp: use RCU protection in arp_xmit()

ndisc: extend RCU protection in ndisc_send_skb()

An issue was discovered in the Linux kernel before 5.19.16

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

drm/i915/gem: Fix phys BO pread/pwrite with offset

dm cache policy smq: check allocation under invalidate lock

net/sched: act_api: use RCU with deferred freeing for action lifecycle

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

netfilter: nft_tunnel: fix use-after-free on object destroy

ALSA: timer: Fix UAF at snd_timer_user_params()

thunderbolt: Clamp XDomain response data copy to allocation size

net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

net: skbuff: fix missing zerocopy reference in pskb_carve helpers

ipc: limit next_id allocation to the valid ID range

bpf: Free reuseport cBPF prog after RCU grace period.

ip6_vti: set netns_immutable on the fallback device.

net/sched: fix pedit partial COW leading to page cache corruption

net: gro: don't merge zcopy skbs

dm: fix a buffer overflow in ioctl processing

Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths

vsock: fix buffer size clamping order

sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task

exit: prevent preemption of oopsing TASK_DEAD task

wifi: b43legacy: enforce bounds check on firmware key index in RX path

wifi: mt76: mt7921: fix a potential clc buffer length underflow

wifi: b43: enforce bounds check on firmware key index in b43_rx()

ip6_gre: Use cached t->net in ip6erspan_changelink().

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

dm-thin: fix metadata refcount underflow

wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()

fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info

net: qrtr: ns: Fix use-after-free in driver remove()

tcp: call sk_data_ready() after listener migration

udf: fix partition descriptor append bookkeeping

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()