Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[4.14.35-2025.403.3]
- RDMA/umem: Move to allocate SG table from pages (Maor Gottlieb) [Orabug: 32005117]
- lib/scatterlist: Add support in dynamic allocation of SG table from pages (Maor Gottlieb) [Orabug: 32005117]
- lib/scatterlist: Add SG_CHAIN and SG_END macros for LSB encodings (Anshuman Khandual) [Orabug: 32005117]
- lib/scatterlist: Avoid potential scatterlist entry overflow (Tvrtko Ursulin) [Orabug: 32005117]
- lib/scatterlist: Fix offset type in sg_alloc_table_from_pages (Tvrtko Ursulin) [Orabug: 32005117]
- uek-rpm: Don't build emb2 kernel for mips (Dave Kleikamp) [Orabug: 32176889]
- vt: Disable KD_FONT_OP_COPY (Daniel Vetter) [Orabug: 32187748] {CVE-2020-28974}
- page_frag: Recover from memory pressure (Dongli Zhang) [Orabug: 32201999]
- xen/events: block rogue events for some time (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: defer eoi in case of excessive number of events (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: use a common cpu hotplug hook for event channels (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: switch user event channels to lateeoi model (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/pciback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/pvcallsback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/scsiback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/netback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/blkback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: add a new 'late EOI' evtchn framework (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: avoid removing an event channel while handling it (Juergen Gross) [Orabug: 32177548]

[4.14.35-2025.403.2]
- tty: make FONTX ioctl use the tty pointer they were actually passed (Linus Torvalds) [Orabug: 32122729] {CVE-2020-25668}
- vt: keyboard, extend func_buf_lock to readers (Jiri Slaby) [Orabug: 32122952] {CVE-2020-25656} {CVE-2020-25656}
- vt: keyboard, simplify vt_kdgkbsent (Jiri Slaby) [Orabug: 32122952] {CVE-2020-25656}
- perf/core: Fix a memory leak in perf_event_parse_addr_filter() (kiyin) [Orabug: 32131175] {CVE-2020-25704}
- perf/core: Fix bad use of igrab() (Song Liu) [Orabug: 32131175] {CVE-2020-25704}
- IB/mlx4: Adjust delayed work when a dup is observed (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add support for REJ due to timeout (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Fix starvation in paravirt mux/demux (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Separate tunnel and wire bufs parameters (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add support for MRA (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add and improve logging (Hakon Bugge) [Orabug: 32136898]
- xen/gntdev: fix up blockable calls to mn_invl_range_start (Michal Hocko) [Orabug: 32139244]

[4.14.35-2025.403.1]
- lockdown: By default run in integrity mode. (Konrad Rzeszutek Wilk) [Orabug: 32131561]
- Revert 'iomap: Fix pipe page leakage during splicing' (George Kennedy) [Orabug: 32136519]
- kernel: add panic_on_taint (Rafael Aquini) [Orabug: 32138016]
- Revert 'pci: hardcode enumeration' (Dave Aldridge) [Orabug: 32152249]
- hv_utils: drain the timesync packets on onchannelcallback (Vineeth Pillai) [Orabug: 32152144]
- hv_utils: return error if host timesysnc update is stale (Vineeth Pillai) [Orabug: 32152144]

[4.14.35-2025.403.0]
- powercap: restrict energy meter to root access (Kanth Ghatraju) [Orabug: 32138487] {CVE-2020-8694} {CVE-2020-8695}
- Btrfs: fix selftests failure due to uninitialized i_mode in test inodes (Filipe Manana) [Orabug: 31864726]
- btrfs: fix return value mixup in btrfs_get_extent (Pavel Machek) [Orabug: 31864726]
- btrfs: inode: Verify inode mode to avoid NULL pointer dereference (Qu Wenruo) [Orabug: 31864726] {CVE-2019-19816}
- x86/apic: Get rid of multi CPU affinity (Thomas Gleixner) [Orabug: 31975320]
- hv_netvsc: Set probe mode to sync (Haiyang Zhang) [Orabug: 32132413]
- net/rds: Check for NULL rds_ibdev in rds_ib_rx() only if rds_ib_srq_enabled (Sharath Srinivasan) [Orabug: 32113843]
- perf symbols: Check if we read regular file in dso__load() (Jiri Olsa) [Orabug: 30696035]
- rds: Restore MR use-once semantics (Hakon Bugge) [Orabug: 31990092] [Orabug: 31990095]
- rds: Fix incorrect cmsg status and use-after-free (Hakon Bugge) [Orabug: 32003078] [Orabug: 32003081]
- dm cache: remove all obsolete writethrough-specific code (Mike Snitzer) [Orabug: 32010352]
- dm cache: pass cache structure to mode functions (Mike Snitzer) [Orabug: 32010352]
- dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Ming Lei) [Orabug: 32010352]
- bcache: allocate meta data pages as compound pages (Coly Li) [Orabug: 32010352]
- md/raid5: Fix Force reconstruct-write io stuck in degraded raid5 (ChangSyun Peng) [Orabug: 32010352]
- bcache: fix super block seq numbers comparision in register_cache_set() (Coly Li) [Orabug: 32010352]
- md-cluster: fix wild pointer of unlock_all_bitmaps() (Zhao Heming) [Orabug: 32010352]
- dm: use noio when sending kobject event (Mikulas Patocka) [Orabug: 32010352]
- dm zoned: assign max_io_len correctly (Hou Tao) [Orabug: 32010352]
- md: add feature flag MD_FEATURE_RAID0_LAYOUT (NeilBrown) [Orabug: 32010352]
- dm zoned: return NULL if dmz_get_zone_for_reclaim() fails to find a zone (Hannes Reinecke) [Orabug: 32010352]
- dm mpath: switch paths in dm_blk_ioctl() code path (Martin Wilck) [Orabug: 32010352]
- dm crypt: avoid truncating the logical block size (Eric Biggers) [Orabug: 32010352]
- md: don't flush workqueue unconditionally in md_open (Guoqing Jiang) [Orabug: 32010352]
- x86/mce/