- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352} - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} - nfsd: fix race between laundromat and free_stateid {CVE-2024-50106} - nfsd: split sc_status out of sc_type {CVE-2024-50106} - nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106} - nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106} - can: peak_usb: fix use after free bugs {CVE-2021-47670} - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159} - i2c/designware: Fix an initialization issue {CVE-2025-38380} - RDMA/rxe: Fix error unwind in rxe_create_qp() {CVE-2022-50127} - i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200} - udp: Fix memory accounting leak. {CVE-2025-22058} - Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250} - net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-38085} - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085} - mm/khugepaged: fix GUP-fast interaction by sending IPI {CVE-2025-38085} - padata: fix UAF in padata_reorder {CVE-2025-21727} - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350} - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177} - sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177} - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177} - sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177} - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177} - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177} - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000} - net/sched: sch_qfq: Fix race condition on qfq_aggregate {CVE-2025-38477} - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464} - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211} - scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332} - netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038} - netfilter: xtables: Add snapshot of hardidletimer target {CVE-2024-50038} - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079} - ext4: avoid resizing to a partial cluster size {CVE-2022-50020} - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890} - net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273} - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052} - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}