- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945} - scsi: bfa: Double-free fix {CVE-2025-38699} - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702} - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521} - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675} - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760} - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680} - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691} - mmc: core: replace sprintf() with scnprintf() for sysfs output {CVE-2022-49267} - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265} - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282} - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" {CVE-2023-53063} - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53063}