- Bluetooth: Fix use after free in hci_send_acl {CVE-2022-49111} - drm/amd/display: clear optc underflow before turn off odm clock {CVE-2022-49969} - NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072} - NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-50072} - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940} - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066} - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764} - udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803} - mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669} - net: introduce and use lock_sock_fast_nested() {CVE-2022-49669} - net: add annotation for sock_{lock,unlock}_fast {CVE-2022-49669} - net/mlx5: Always stop health timer during driver removal {CVE-2024-40906} - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682} - nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043} - nfsd: fix race between laundromat and free_stateid {CVE-2024-50106} - nfsd: split sc_status out of sc_type {CVE-2024-50106} - nfsd: avoid race after unhash_delegation_locked() {CVE-2024-50106} - nfsd: remove fault injection code {CVE-2024-50106} - nfsd: don't call functions with side-effecting inside WARN_ON() {CVE-2024-50106} - ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 {CVE-2022-49238} - cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572} - cifs: fix potential double free during failed mount {CVE-2022-49541} - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982} - drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() {CVE-2024-50282}