Commit 940d91caf09c for kernel

commit 940d91caf09cc849ac514043bbf5c0e1b43aea0b
Merge: bffa972b3f66 1463ca3ec660
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Jul 12 12:43:26 2026 -0700

    Merge tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

    Pull staging driver fixes from Greg KH:
     "Here are some staging driver fixes for 7.2-rc3 for some reported bugs
      in the vme_user and rtl8723bs drivers. These include:

       - many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts

       - vme_user bugfixes to correctly validate some user-provided data

      All of these have been in linux-next for a while with no reported
      issues"

    * tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
      staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
      staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
      staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
      staging: rtl8723bs: fix OOB write in HT_caps_handler()
      staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
      staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
      staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
      staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
      staging: vme_user: fix location monitor leak in tsi148 bridge
      staging: vme_user: fix location monitor leak in fake bridge
      staging: vme_user: bound slave read/write to the kern_buf size
      staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()