misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error

thermal: int340x: Add NULL check for adev

RISC-V: KVM: Teardown riscv specific bits after kvm_exit

wifi: ath11k: update channel list in reg notifier instead reg worker

f2fs: quota: fix to avoid warning in dquot_writeback_dquots()

dlm: prevent NPD when writing a positive value to event_done

f2fs: fix to avoid panic once fallocation fails for pinfile

cifs.upcall makes an upcall to the wrong namespace in containerized environments

wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path

HDF5 Metadata Attribute Decoder H5MM_strndup heap-based overflow

HDF5 Type Conversion Logic H5T__bit_copy heap-based overflow

Rejected reason: This CVE record has been withdrawn due to a duplicate entry CVE-2025-23083.

HDF5 Scale-Offset Filter H5Z__scaleoffset_decompress_one_byte heap-based overflow

A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could lead to increased memory consumption and potential denial of service under certain conditions. This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.

A vulnerability has been identified in Node.js, specifically affecting the handling of drive names in the Windows environment. Certain Node.js functions do not treat drive names as special on Windows. As a result, although Node.js assumes a relative path, it actually refers to the root directory. On Windows, a path that does not start with the file separator is treated as relative to the current directory. This vulnerability affects Windows users of `path.join` API.

With the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage. This vulnerability affects Permission Model users (--permission) on Node.js v20, v22, and v23.

Apache HTTP Server: mod_ssl access control bypass with session resumption

FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.

Un-verified kernel bypass Secure Boot mechanism in direct boot mode

Potential iSCSI R2T PDU Vulnerability