- udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846} - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set {CVE-2022-49136} - Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111} - NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072} - NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072} - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764} - cifs: fix double free race when mount fails in cifs_get_root() {CVE-2022-48919} - udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803} - um: Fix out-of-bounds read in LDT setup {CVE-2022-49395} - rtw89: cfo: check mac_id to avoid out-of-bounds {CVE-2022-49471} - vsock: Keep the binding until socket destruction {CVE-2025-21756} - net/mlx5: Always stop health timer during driver removal {CVE-2024-40906} - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785} - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969} - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780} - drm: nv04: Fix out of bounds access {CVE-2024-27008} - parport: Proper fix for array out-of-bounds access {CVE-2024-50074} - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168} - net: make sock_inuse_add() available {CVE-2024-53168} - drm/amdgpu: fix possible UAF in amdgpu_cs_pass1() {CVE-2023-52921}