blk-mq: pop cached request if it is usable

security/keys: fix missed RCU read section on lookup

ALSA: pcm: oss: Fix setup list UAF on proc write error

ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

net/sched: fix packet loop on netem when duplicate is on

net/handshake: hand off the pinned file reference to accept_doit

net/handshake: Drain pending requests at net namespace exit

Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close

usb: typec: ucsi: ccg: reject firmware images without a ':' record header

usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

usb: typec: altmodes/displayport: validate count before reading Status Update VDO

usb: typec: wcove: don't write past struct pd_message in wcove_read_rx_buffer()

usb: typec: tcpm/tcpci_maxim: validate header NDO against RX_BYTE_CNT

usb: typec: ucsi: validate connector number in ucsi_connector_change()

hpfs: fix a crash if hpfs_map_dnode_bitmap fails

KVM: SEV: Ignore Port I/O requests of length '0'

Nano: gnu nano: arbitrary memory writes, information disclosure, or denial of service via format string vulnerability in error handling.

drm/amdkfd: fix NULL pointer bug in svm_range_set_attr

drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger