Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF

Bluetooth: 6lowpan: reset link-local header on ipv6 recv path

sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto

tipc: Fix use-after-free in tipc_mon_reinit_self().

net: sched: act_connmark: initialize struct tc_ife to fix kernel leak

net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak

drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd

NFSD: free copynotify stateid in nfs4_free_ol_stateid()

mm/secretmem: fix use-after-free race in fault handler

ALSA: usb-audio: Fix potential overflow of PCM transfer buffer

cifs: client: fix memory leak in smb3_fs_context_parse_param

KVM: arm64: Check the untrusted offset in FF-A memory share

be2net: pass wrb_params in case of OS2BMC

Input: cros_ec_keyb - fix an invalid memory access

Input: imx_sc_key - fix memory corruption on unload

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

scsi: sg: Do not sleep in atomic context

mptcp: fix race condition in mptcp_schedule_work()

mptcp: fix a race in mptcp_pm_del_add_timer()