futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

misc: fastrpc: fix use-after-free race in fastrpc_map_create

misc: fastrpc: fix DMA address corruption due to find_vma misuse

misc: fastrpc: Fix NULL pointer dereference in rpmsg callback

net: phonet: free phonet_device after RCU grace period

nvmem: core: fix use-after-free bugs in error paths

mm/hugetlb: restore reservation on error in hugetlb folio copy paths

rxrpc: Fix the ACK parser to extract the SACK table for parsing

thunderbolt: Reject zero-length property entries in validator

thunderbolt: Bound root directory content to block size

thunderbolt: Clamp XDomain response data copy to allocation size

thunderbolt: Validate XDomain request packet size before type cast

thunderbolt: Limit XDomain response copy to actual frame size

drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11

drm/v3d: Skip CSD when it has zeroed workgroups

drm/amd/display: Bound VBIOS record-chain walk loops

drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size

drm/amd/display: Clamp VBIOS HDMI retimer register count to array size