usb: typec: tcpm: Check for port partner validity before consuming it

maple_tree: fix mas_empty_area_rev() null pointer dereference

moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application crashes.

moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function resulting in resource leaks/exhaustion.

moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go.

Arbitrary code injection vulnerability in Keras framework < 2.13

tracing/probes: fix error check in parse_btf_field()

fpga: bridge: add owner module and take its refcount

tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer

RDMA/rtrs: Ensure 'ib_sge list' is accessible

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

AMD: CVE-2024-36357 Transient Scheduler Attack in L1 Data Queue

AMD: CVE-2024-36350 Transient Scheduler Attack in Store Queue

SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

net/sched: taprio: extend minimum interval restriction to entire cycle too

Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child_process.spawn / child_process.spawnSync. A malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled.

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission Model do not operate on file descriptors, however, operations such as fs.fchown or fs.fchmod can use a "read-only" file descriptor to change the owner and permissions of a file.