- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911} - media: rc: fix races with imon_disconnect() {CVE-2025-39993} - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} - partitions: mac: fix handling of bogus partition table {CVE-2025-21772} - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923} - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277} - Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237} - net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410} - i40e: add validation for ring_len param {CVE-2025-39973} - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248} - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240} - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724} - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259} - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014} - isofs: Prevent the use of too small fid {CVE-2025-37780} - net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749} - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860} - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853} - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249} - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322} - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}