can: kvaser_usb: leaf: Fix potential infinite loop in command parsers

can: gs_usb: gs_usb_xmit_callback(): fix handling of failed transmitted URBs

Bluetooth: hci_core: lookup hci_conn on RX path on protocol side

platform/x86: intel: punit_ipc: fix memory corruption

net: sxgbe: fix potential NULL dereference in sxgbe_rx()

net: atlantic: fix fragment overflow handling in RX path

ceph: fix crash in process_v2_sparse_read() for encrypted directories

drm, fbcon, vga_switcheroo: Avoid race condition in fbcon setup

smb: client: fix memory leak in cifs_construct_tcon()

mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

most: usb: fix double free on late probe failure

usb: gadget: f_eem: Fix memory leak in eem_unwrap

usb: storage: Fix memory leak in USB bulk transport

usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

drm/amd/display: Check NULL before accessing

libceph: fix potential use-after-free in have_mon_and_osd_map()

libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

libceph: replace BUG_ON with bounds check for map->max_osd

usb: gadget: udc: fix use-after-free in usb_gadget_state_work

ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list