media: v4l2-subdev: Fix alloc failure check in v4l2_subdev_call_state_try()

netfilter: nft_objref: validate objref and objrefmap expressions

btrfs: avoid potential out-of-bounds in btrfs_encode_fh()

sctp: Fix MAC comparison to be constant-time

ipmi: Rework user message limit handling

kernel/sys.c: fix the racy usage of task_lock(tsk->group_leader) in sys_prlimit64() paths

Squashfs: reject negative file sizes in squashfs_read_inode()

ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()

media: mc: Clear minor number before put device

mount: handle NULL values in mnt_ns_release()

cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()

xtensa: simdisk: add input size check in proc_write_simdisk

Revert "ipmi: fix msg stack when IPMI is disconnected"

ext4: guard against EA inode refcount underflow in xattr update

pwm: berlin: Fix wrong register in suspend/resume

net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()

mailbox: zynqmp-ipi: Fix out-of-bounds access in mailbox cleanup loop

ext4: verify orphan file size is not too big

pid: Add a judgment for ns null in pid_nr_ns

tls: wait for pending async decryptions if tls_strp_msg_hold fails