apparmor: fix: limit the number of levels of policy namespaces

apparmor: replace recursive profile removal with iterative approach

apparmor: fix memory leak in verify_header

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

nf_tables: nft_dynset: fix possible stateful expression memleak in error path

icmp: fix NULL pointer dereference in icmp_tag_validation()

nfnetlink_osf: validate individual option lengths in fingerprints

wifi: mac80211: fix NULL deref in mesh_matches_local()

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

af_unix: Give up GC if MSG_PEEK intervened.

bridge: cfm: Fix race condition in peer_mep deletion

netfilter: nf_tables: release flowtable after rcu grace period on error

netfilter: xt_CT: drop pending enqueued packets on template removal

tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow

ice: Fix memory leak in ice_set_ringparam()

Squashfs: check metadata block offset is within range

gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL

bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing

HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them

net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled