Commit ae453eef9259 for kernel

commit ae453eef925945a02bb558bff9debbee352e33e9
Merge: e2a936998ab2 2d66a033864e
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Jul 24 19:31:12 2026 -0700

    Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

    Pull bpf fixes from Eduard Zingerman:

     - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
       sk_psock->cork for the local temporary message and freeing it again
       (Chengfeng Ye)

     - Reject passing scalar NULL to nonnull arg of a global subprog.

       Previously the verifier did not account for the cases directly
       passing scalars to a global subprog, e.g.: 'global_func(0);' would
       pass even if 'global_func' argument was marked nonnull (Amery Hung)

    * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
      bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
      selftests/bpf: Test passing scalar NULL to nonnull global subprog
      bpf: Reject passing scalar NULL to nonnull arg of a global subprog