- tls: always refresh the queue when reading sock {CVE-2025-38471} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250} - i2c/designware: Fix an initialization issue {CVE-2025-38380} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159} - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() {CVE-2025-21867} - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079} - ext4: avoid journaling sb update on error if journal is destroying {CVE-2025-22113} - ext4: define ext4_journal_destroy wrapper - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013} - Bluetooth: Remove BT_HS {CVE-2024-38620} - block, bfq: fix bfqq uaf in bfq_limit_depth() {CVE-2024-53166} - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763} - bpf: Fix helper writes to read-only maps (alt version) {CVE-2024-49861} - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621} - netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038} - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014} - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901} - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556} - net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890} - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052} - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788} - padata: fix UAF in padata_reorder {CVE-2025-21727} - RDMA/mlx5: Fix page_size variable overflow {CVE-2025-22091}