USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

usb: dwc3: run gadget disconnect from sleepable suspend context

6lowpan: fix NHC entry use-after-free on error path

tipc: fix out-of-bounds read in broadcast Gap ACK blocks

staging: vme_user: bound slave read/write to the kern_buf size

smb: client: restrict implied bcc[0] exemption to responses without data area

staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()

staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()

staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop

staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop

staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()

staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()

staging: rtl8723bs: fix OOB write in HT_caps_handler()

crypto: qat - fix VF2PF work teardown race in adf_disable_sriov()

ksmbd: fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL

net: af_key: initialize alg_key_len for IPComp states

audit: Fix data races of skb_queue_len() readers on audit_queue

Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref

Bluetooth: MGMT: Fix UAF of hci_conn_params in add_device_complete

NTB: epf: Avoid calling pci_irq_vector() from hardirq context