Linux Kernel

ksmbd: serialize QUERY_DIRECTORY requests per file

spi: fsl-lpspi: terminate the RX channel on TX prepare failure path

net: bcmgenet: Use stronger register read/writes to assure ordering

rxrpc: Fix integer overflow in rxgk_verify_response()

cifs: Fix server re-repick on subrequest retry

NVIDIA NeMo Framework contains a vulnerability where a user could cause an improper control of generation of code by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.

IBM Sterling Partner Engagement Manager SQL injection

9p/net: fix improper handling of bogus negative read/write replies

NFSD: prevent underflow in nfssvc_decode_writeargs()

udp: do not accept non-tunnel GSO skbs landing in a tunnel

net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown

RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds

NVIDIA NeMo Framework contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.

can: j1939: j1939_session_new(): fix skb reference counting

IBM InfoSphere Information Server SQL injection

SUNRPC: Trap RDMA segment overflows

gfs2: Fix potential glock use-after-free on unmount

nvme: avoid double free special payload

block: recompute nr_integrity_segments in blk_insert_cloned_request

net/tcp-ao: Fix MAC comparison to be constant-time

block: add pgmap check to biovec_phys_mergeable

rxrpc: Fix re-decryption of RESPONSE packets

lib/scatterlist: fix length calculations in extract_kvec_to_sg

smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list()

dmaengine: idxd: fix possible wrong descriptor completion in llist_abort_desc()

smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()

ipv6: ioam: refresh hdr pointer before ioam6_event()

netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages()

smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked()

rxrpc: Fix the ACK parser to extract the SACK table for parsing

kthread: consolidate kthread exit paths to prevent use-after-free

ksmbd: fix slab-use-after-free in ksmbd_smb2_session_create

net/tls: fix slab-out-of-bounds bug in decrypt_internal

crypto: hisilicon/sec - fix the aead software fallback for engine

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

nvme-tcp: fix possible use-after-free in transport error_recovery work

net: vertexcom: mse102x: Fix possible double free of TX skb

smb: client: fix potential UAF in smb2_is_valid_lease_break()

smb: client: fix potential UAF in smb2_is_network_name_deleted()

smb: client: fix potential UAF in is_valid_oplock_break()