netfilter: synproxy: add mutex to guard hook reference counting

netfilter: conntrack_irc: fix possible out-of-bounds read

netfilter: nft_ct: bail out on template ct in get eval

netfilter: bridge: make ebt_snat ARP rewrite writable

dm cache policy smq: check allocation under invalidate lock

net/sched: act_api: use RCU with deferred freeing for action lifecycle

6lowpan: fix off-by-one in multicast context address compression

l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()

wifi: fix leak if split 6 GHz scanning fails

Bluetooth: MGMT: validate advertising TLV before type checks

Bluetooth: RFCOMM: validate skb length in MCC handlers

Bluetooth: bnep: reject short frames before parsing

Bluetooth: fix memory leak in error path of hci_alloc_dev()

ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing

net/802/mrp: fix vector attribute parsing in mrp_pdu_parse_vecattr

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

netlabel: validate unlabeled address and mask attribute lengths