- mm/hugetlb: unshare page tables during VMA split, not before {CVE-2025-38084} - hugetlb: unshare some PMDs when splitting VMAs {CVE-2025-38084} - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352} - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464} - vsock: Fix transport_* TOCTOU {CVE-2025-38461} - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200} - net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-37914} - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823} - udp: Fix memory accounting leak. {CVE-2025-22058} - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177} - sch_htb: make htb_deactivate() idempotent {CVE-2025-38177} - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177} - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177} - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177} - sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177} - sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000} - net: fix udp gso skb_segment after pull from frag_list {CVE-2025-38124}