ASoC: stm32: sai: fix OF node leak on probe

net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write

powerpc/64s/slb: Fix SLB multihit issue during SLB preload

tpm: Cap the number of PCR banks

scsi: aic94xx: fix use-after-free in device removal path

functionfs: fix the open/removal races

Input: lkkbd - disable pending work before freeing device

shmem: fix recovery on rename failures

f2fs: invalidate dentry cache on failed whiteout creation

svcrdma: bound check rq_pages index in inline path

ntfs: set dummy blocksize to read boot_block when mounting

net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

f2fs: fix to avoid potential deadlock

net: hns3: using the num_tqps in the vf driver to apply for resources

HDF5 H5FSsection.c H5FS__sect_link_size heap-based overflow

HDF5 H5FL.c H5FL__malloc memory leak

HDF5 H5FScache.c H5FS__sinfo_serialize_node_cb heap-based overflow

Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.