Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2025.401.4]
- KVM: x86: always expose VIRT_SSBD to guests (Paolo Bonzini) [Orabug: 31957046]

[4.14.35-2025.401.3]
- iommu/amd: Restore IRTE.RemapEn bit after programming IRTE (Suravee Suthikulpanit) [Orabug: 31931371]
- oracleasm: Access d_bdev before dropping inode (Stephen Brennan) [Orabug: 31901948]
- net: Correct warning: label 'drop' defined but not used. (John Donnelly) [Orabug: 31916130]
- KVM: Corrects build warnings for emulator_get_fpu/emulator_put_fpu (John Donnelly) [Orabug: 31907286]
- ext4: fix potential negative array index in do_split() (Eric Sandeen) [Orabug: 31895330] {CVE-2020-14314}
- net/rds: Extract dest qp num for displaying in rds-info (Praveen Kumar Kannoju) [Orabug: 31880143]
- bpf: Fix bpf_event_output re-entry issue (Allan Zhang) [Orabug: 31865842]
- bpf: fix nested bpf tracepoints with per-cpu data (Matt Mullins) [Orabug: 31865842]
- uek-rpm: Turn on module signing for embedded2 kernel (Dave Kleikamp) [Orabug: 31895264]
- uek-rpm: Clean up config-aarch64-embedded2 (Dave Kleikamp) [Orabug: 31895264]

[4.14.35-2025.401.2]
- mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song) [Orabug: 31884238] {CVE-2020-25285}
- rbd: require global CAP_SYS_ADMIN for mapping and unmapping (Ilya Dryomov) [Orabug: 31884165] {CVE-2020-25284}
- nfs: Fix getxattr kernel panic and memory overflow (Jeffrey Mitchell) [Orabug: 31872904] {CVE-2020-25212}
- IB/mlx5: Fix MR registration flow to use UMR properly (Guy Levi) [Orabug: 31631231]
- IB/mlx5: Prevent concurrent MR updates during invalidation (Moni Shoua) [Orabug: 31631231]
- IB/mlx5: Replace kfree with kvfree (Chuhong Yuan) [Orabug: 31631231]
- RDMA/odp: Do not leak dma maps when working with huge pages (Jason Gunthorpe) [Orabug: 31631231]
- IB/mlx5: Respect new UMR capabilities (Majd Dibbiny) [Orabug: 31631231]
- RDMA/mlx5: Unify error flows in rereg MR failure paths (Leon Romanovsky) [Orabug: 31631231]
- IB/mlx5: Maintain a single emergency page (Ilya Lesokhin) [Orabug: 31631231]
- genirq/irqdomain: Make sure all irq domain flags are distinct (Zenghui Yu) [Orabug: 31885236]
- irq/msi: Direct update affinity if irq is for msix or, maskable (Joe Jin) [Orabug: 31885236]
- x86/apic/msi: Plug non-maskable MSI affinity race (Joe Jin) [Orabug: 31885236]
- mm: memcg: Optimize cgroup traversal in memory.stat read (Tom Hromatka) [Orabug: 31849182]
- SUNRPC: Fix disconnection races (Trond Myklebust) [Orabug: 31796863]
- SUNRPC: Add a helper to wake up a sleeping rpc_task and set its status (Trond Myklebust) [Orabug: 31796863]
- dmaengine: ioatdma: Add Snow Ridge ioatdma device id (Dave Jiang) [Orabug: 31669166]

[4.14.35-2025.401.1]
- PCI: Probe bridge window attributes once at enumeration-time (Bjorn Helgaas) [Orabug: 31867576]
- net/packet: fix overflow in tpacket_rcv (Or Cohen) [Orabug: 31866489] {CVE-2020-14386} {CVE-2020-14386}
- scsi: qla2xxx: Fix login timeout (Quinn Tran) [Orabug: 31860034]
- block: better deal with the delayed not supported case in blk_cloned_rq_check_limits (Ritika Srivastava) [Orabug: 31850343]
- block: Return blk_status_t instead of errno codes (Ritika Srivastava) [Orabug: 31850343]
- block: print offending values when cloned rq limits are exceeded (John Pittman) [Orabug: 31850343]
- iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE (Suravee Suthikulpanit) [Orabug: 31849532]

[4.14.35-2025.401.0]
- Pensando: kernel config changes for kdump (Rob Gardner) [Orabug: 31821490]
- Pensando: Enable iScsi in kernel config (Rob Gardner) [Orabug: 31821490]
- sample-trace-array: Fix timer definition in samples/ftrace/sample-trace-array.c (Aruna Ramakrishna) [Orabug: 31845460]
- IB/mlx5: Expose RoCE accelerator counters (Avihai Horon) [Orabug: 31621816]
- net/mlx5: Add RoCE accelerator counters (Leon Romanovsky) [Orabug: 31621816]
- lib: Reduce user_access_begin() boundaries in strncpy_from_user() and strnlen_user() (Christophe Leroy) [Orabug: 29623005] {CVE-2018-20669}
- x86: uaccess: Inhibit speculation past access_ok() in user_access_begin() (Will Deacon) [Orabug: 29623005] {CVE-2018-20669}
- arch/openrisc: Fix issues with access_ok() (Stafford Horne) [Orabug: 29623005] {CVE-2018-20669}
- Fix 'acccess_ok()' on alpha and SH (Linus Torvalds) [Orabug: 29623005] {CVE-2018-20669}
- make 'user_access_begin()' do 'access_ok()' (Linus Torvalds) [Orabug: 29623005] {CVE-2018-20669}
- kabi fix for reparent slab memory on cgroup removal patchset (Tom Hromatka) [Orabug: 31746022]
- mm/memcontrol.c: add missed css_put() (Muchun Song) [Orabug: 31746022]
- mm: memcg/slab: reparent memcg kmem_caches on cgroup removal (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: stop setting page->mem_cgroup pointer for slab pages (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: rework non-root kmem_cache lifecycle management (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: synchronize access to kmem_cache dying flag using a spinlock (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: don't check the dying flag on kmem_cache creation (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: unify SLAB and SLUB page accounting (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: introduce __memcg_kmem_uncharge_memcg() (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: generalize postponed non-root kmem_cache deactivation (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: rename slab delayed deactivation functions and fields (Roman Gushchin) [Orabug: 31746022]
- mm: memcg/slab: postpone kmem_cache memcg pointer initialization to memcg_link_cache() (Roman Gushchin) [Orabug: 31746022]
- mm: introduce mem_cgroup_put() helper (Roman Gushchin) [Orabug: 31746022]
- mm/memcontrol.c: export mem_cgroup_is_root() (Kirill Tkhai) [Orabug: 31746022]
- memcg: localize memcg_kmem_enabled() check (Shakeel Butt) [Orabug: 31746022]
- mm: fix race between kmem_cache destroy, create and deactivate (Shakeel Butt) [Orabug: 31746022]
- uek-rpm: Sync up aarch64 config files wi