- crypto: algif_aead - Fix minimum RX size check for decryption - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: scatterwalk - Backport memcpy_sglist() - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965} - Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966} - Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967} - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101} - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204} - net: add skb_header_pointer_careful() helper - ext4: lost matching-pair of trace in ext4_truncate - usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022} - net/atm: remove the atmdev_ops {get, set}sockopt methods {CVE-2022-50410} - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565} - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685} - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102} - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422} - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305} - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259} - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class