In GnuPG through 2.4.8, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

ublk: fix deadlock when reading partition table

Input: alps - fix use-after-free bugs caused by dev3_register_work

media: dvb-usb: dtv5100: fix out-of-bounds in dtv5100_i2c_msg()

scsi: Revert "scsi: qla2xxx: Perform lockless command completion in abort path"

ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency

net/mlx5: fw_tracer, Validate format string parameters

net/sched: ets: Remove drr class from the active list if it changes to strict

io_uring: fix filename leak in __io_openat_prep()

ksmbd: vfs: fix race on m_flags in vfs_cache

media: vidtv: initialize local pointers upon transfer of memory ownership

ksmbd: fix buffer validation by including null terminator size in EA length

NFSD: NFSv4 file creation neglects setting ACL

mlxsw: spectrum_router: Fix neighbour use-after-free

mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

caif: fix integer underflow in cffrml_receive()

perf/x86/amd: Check event before enable to avoid GPF

char: applicom: fix NULL pointer dereference in ac_ioctl

f2fs: fix to avoid updating zero-sized extent in extent cache