netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation

ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1

ata: libata-scsi: avoid Non-NCQ command starvation

ipvs: skip ipv6 extension headers for csum checks

bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()

net/sched: taprio: fix NULL pointer dereference in class dump

netfilter: arp_tables: fix IEEE1394 ARP payload parsing

slip: bound decode() reads against the compressed packet length

slip: reject VJ receive packets on instances with no rstate array

netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO

openvswitch: cap upcall PID array size and pre-size vport replies

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

bpf: fix end-of-list detection in cgroup_storage_get_next_key()

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb()

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb()

Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()

gh: GitHub Actions log output in `gh run view` allows terminal escape sequence injection

rust-openssl: Potential out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers

ws: Uninitialized memory disclosure

Microsoft SharePoint Remote Code Execution Vulnerability