Important: Unbreakable Enterprise kernel-container security update (Oracle Linux 7)

[4.14.35-2025.404.1.1.el7]
- target: fix XCOPY NAA identifier lookup (David Disseldorp) [Orabug: 32248040]
{CVE-2020-28374}

[4.14.35-2025.404.1.el7]
- xenbus/xenbus_backend: Disallow pending watch messages (SeongJae Park) [Orabug: 32253412] {CVE-2020-29568}
- xen/xenbus: Count pending messages for each watch (SeongJae Park) [Orabug: 32253412] {CVE-2020-29568}
- xen/xenbus/xen_bus_type: Support will_handle watch callback (SeongJae Park) [Orabug: 32253412] {CVE-2020-29568}
- xen/xenbus: Add 'will_handle' callback support in xenbus_watch_path() (SeongJae Park) [Orabug: 32253412] {CVE-2020-29568}
- xen/xenbus: Allow watches discard events before queueing (SeongJae Park) [Orabug: 32253412] {CVE-2020-29568}
- xen-blkback: set ring->xenblkd to NULL after kthread_stop() (Pawel Wieczorkiewicz) [Orabug: 32260256] {CVE-2020-29569}

[4.14.35-2025.404.0.el7]
- vhost scsi: Add support for LUN resets. (Mike Christie) [Orabug: 32201584]
- vhost/scsi: Use copy_to_iter() to send control queue response (Bijan Mottahedeh) [Orabug: 32201584]
- vhost scsi: add lun parser helper (Mike Christie) [Orabug: 32201584]
- scsi: sd: Allow user to configure command retries (Mike Christie) [Orabug: 32201584]
- scsi: core: Add limitless cmd retry support (Mike Christie) [Orabug: 32201584]

[4.14.35-2025.403.5.el7]
- dm crypt: Allow unaligned bio buffer lengths for skcipher devices (Sudhakar Panneerselvam) [Orabug: 32210463]
- mm: thp: make the THP mapcount atomic against __split_huge_pmd_locked() (Andrea Arcangeli) [Orabug: 32212583] {CVE-2020-29368}
- perf/core: Fix race in the perf_mmap_close() function (Jiri Olsa) [Orabug: 32233358] {CVE-2020-14351}

[4.14.35-2025.403.4.el7]
- icmp: randomize the global rate limiter (Eric Dumazet) [Orabug: 32227961] {CVE-2020-25705}
- ocfs2: initialize ip_next_orphan (Wengang Wang) [Orabug: 32159055]
- hv_netvsc: make recording RSS hash depend on feature flag (Stephen Hemminger) [Orabug: 32159975]
- hv_netvsc: record hardware hash in skb (Stephen Hemminger) [Orabug: 32159975]
- Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts (Peilin Ye) [Orabug: 32176263] {CVE-2020-28915}
- fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h (Peilin Ye) [Orabug: 32176263] {CVE-2020-28915}
- block: Fix use-after-free in blkdev_get() (Jason Yan) [Orabug: 32194608] {CVE-2020-15436}
- serial: 8250: fix null-ptr-deref in serial8250_start_tx() (Yang Yingliang) [Orabug: 32194712] {CVE-2020-15437}
- staging: rts5208: rename SG_END macro (Arnd Bergmann) [Orabug: 32218496]
- misc: rtsx: rename SG_END macro (Arnd Bergmann) [Orabug: 32218496]

[4.14.35-2025.403.3.el7]
- RDMA/umem: Move to allocate SG table from pages (Maor Gottlieb) [Orabug: 32005117]
- lib/scatterlist: Add support in dynamic allocation of SG table from pages (Maor Gottlieb) [Orabug: 32005117]
- lib/scatterlist: Add SG_CHAIN and SG_END macros for LSB encodings (Anshuman Khandual) [Orabug: 32005117]
- lib/scatterlist: Avoid potential scatterlist entry overflow (Tvrtko Ursulin) [Orabug: 32005117]
- lib/scatterlist: Fix offset type in sg_alloc_table_from_pages (Tvrtko Ursulin) [Orabug: 32005117]
- uek-rpm: Don't build emb2 kernel for mips (Dave Kleikamp) [Orabug: 32176889]
- vt: Disable KD_FONT_OP_COPY (Daniel Vetter) [Orabug: 32187748] {CVE-2020-28974}
- page_frag: Recover from memory pressure (Dongli Zhang) [Orabug: 32201999]
- xen/events: block rogue events for some time (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: defer eoi in case of excessive number of events (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: use a common cpu hotplug hook for event channels (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: switch user event channels to lateeoi model (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/pciback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/pvcallsback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/scsiback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/netback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/blkback: use lateeoi irq binding (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: add a new 'late EOI' evtchn framework (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: fix race in evtchn_fifo_unmask() (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: add a proper barrier to 2-level uevent unmasking (Juergen Gross) [Orabug: 32177538] {CVE-2020-27673}
- xen/events: avoid removing an event channel while handling it (Juergen Gross) [Orabug: 32177548]

[4.14.35-2025.403.2.el7]
- tty: make FONTX ioctl use the tty pointer they were actually passed (Linus Torvalds) [Orabug: 32122729] {CVE-2020-25668}
- vt: keyboard, extend func_buf_lock to readers (Jiri Slaby) [Orabug: 32122952] {CVE-2020-25656}
- vt: keyboard, simplify vt_kdgkbsent (Jiri Slaby) [Orabug: 32122952] {CVE-2020-25656}
- perf/core: Fix a memory leak in perf_event_parse_addr_filter() (kiyin()) [Orabug: 32131175] {CVE-2020-25704}
- perf/core: Fix bad use of igrab() (Song Liu) [Orabug: 32131175] {CVE-2020-25704}
- IB/mlx4: Adjust delayed work when a dup is observed (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add support for REJ due to timeout (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Fix starvation in paravirt mux/demux (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Separate tunnel and wire bufs parameters (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add support for MRA (Hakon Bugge) [Orabug: 32136898]
- IB/mlx4: Add and improve logging (Hakon Bugge) [Orabug: 32136898]
- xen/gntdev: fix up blockable calls to mn_invl_range_start (Michal Hocko) [Orabug: 32139244]

[4.14.35-2025.403.1.el7]
- lockdown: By default run in integrity mode. (Konrad Rzeszutek Wilk) [Orabug: 32131561]
- Revert 'iomap: Fix pipe page leakage during splicing' (George Kennedy) [Orabug: 32136519]
- kernel: add panic_on_taint (Rafael Aq