Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent

Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh

Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

A wildcard replay, as another piece of data, triggers poisoning in the serve expired reply path

Vim: Command injection in tar#Vimuntar via missing shellescape {special} flag

Binutils: out-of-bounds read in xcoff relocation processing in gnu binutils bfd library

Github.com/antchfx/xpath: xpath: denial of service via crafted boolean xpath expressions

lldpd: Heap OOB Read in VLAN Decapsulation memmove

ptrace: slightly saner 'get_dumpable()' logic

net/sched: fix pedit partial COW leading to page cache corruption

Revert "net/smc: Introduce TCP ULP support"

RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE

netfilter: nf_tables: use list_del_rcu for netlink hooks

net: gro: don't merge zcopy skbs

tun: free page on build_skb failure in tun_xdp_one()

tun: free page on short-frame rejection in tun_xdp_one()

tap: free page on error paths in tap_get_user_xdp()

net/sched: act_ct: Only release RCU read lock after ct_ft

drm/v3d: Reject empty multisync extension to prevent infinite loop

media: videobuf2: Set vma_flags in vb2_dma_sg_mmap