- tun: add missing verification for short frame {CVE-2024-41091} - tap: add missing verification for short frame {CVE-2024-41090} - drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552} - net: fix __dst_negative_advice() race {CVE-2024-36971} - net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971} - net: fix out-of-bounds access in ops_init {CVE-2024-36883} - net/sched: flower: Fix chain template offload {CVE-2024-26669} - netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397} - netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397} - netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397} - netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397} - netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397} - netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397} - sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602} - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096} - sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707} - wait: add wake_up_pollfree() {CVE-2023-52707} - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813} - x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813} - x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813} - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356} - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384} - netfilter: complete validation of user input {CVE-2024-35962} - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885} - PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635} - netfilter: validate user input for expected length {CVE-2024-35896} - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353} - bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637} - net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558} - net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929} - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017} - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621} - drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960} - gro: fix ownership transfer {CVE-2024-35890} - mlxbf_gige: stop interface during shutdown {CVE-2024-35885} - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809} - wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225} - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228} - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159} - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161} - drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581} - i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020} - vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823} - ata: libata-core: Fix double free on error {CVE-2024-41087} - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925} - tcp_metrics: validate source addr length {CVE-2024-42154}