Moderate: kernel security update (Oracle Linux 10)

[6.12.0-55.43.1.0.1]
- nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]

[6.12.0-55.43.1]
- wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122878] {CVE-2025-39864}
- igc: fix lock order in igc_ptp_reset (CKI Backport Bot) [RHEL-118667]
- igc: add lock preventing multiple simultaneous PTM transactions (CKI Backport Bot) [RHEL-118667]
- igc: cleanup PTP module if probe fails (CKI Backport Bot) [RHEL-118667]
- igc: handle the IGC_PTP_ENABLED flag correctly (CKI Backport Bot) [RHEL-118667]
- igc: move ktime snapshot into PTM retry loop (CKI Backport Bot) [RHEL-118667]
- igc: increase wait time before retrying PTM (CKI Backport Bot) [RHEL-118667]
- igc: fix PTM cycle trigger logic (CKI Backport Bot) [RHEL-118667]
- coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113363]
- cxgb4: Avoid removal of uninserted tid (CKI Backport Bot) [RHEL-112148]
- powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Mamatha Inamdar) [RHEL-103014]
- tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
- Revert 'mm/execmem: Unify early execmem_cache behaviour' (Waiman Long) [RHEL-92175]
- x86/Kconfig: only enable ROX cache in execmem when STRICT_MODULE_RWX is set (Waiman Long) [RHEL-92175]
- x86/mm/pat: don't collapse pages without PSE set (Waiman Long) [RHEL-92175]
- tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-92175]
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-92175] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-92175] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-92175]
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-92175]
- arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-92175]
- selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- mm/execmem: Unify early execmem_cache behaviour (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Add 'vmexit' option to skip mitigation on some CPUs (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-92175]
- x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-92175] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
1 VM count transitions (Waiman Long) [RHEL-92175]
- x86/bugs: Add RSB mitigation document (Waiman Long) [RHEL-92175]
- x86/bugs: Don't fill RSB on context switch with eIBRS (Waiman Long) [RHEL-92175]
- x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Waiman Long) [RHEL-92175]
- x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Waiman Long) [RHEL-92175]
- x86/bugs: Use SBPB in write_ibpb() if applicable (Waiman Long) [RHEL-92175]
- x86/bugs: Rename entry_ibpb() to write_ibpb() (Waiman Long) [RHEL-92175]
- x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Waiman Long) [RHEL-92175]
- x86/bugs: Use the cpu_smt_possible() helper instead of open-coded code (Waiman Long) [RHEL-92175]
- x86/bugs: Add AUTO mitigations for mds/taa/mmio/rfds (Waiman Long) [RHEL-92175]
- x86/bugs: Relocate mds/taa/mmio/rfds defines (Waiman Long) [RHEL-92175]
- x86/bugs: Add X86_BUG_SPECTRE_V2_USER (Waiman Long) [RHEL-92175]
- x86/bugs: Remove X86_FEATURE_USE_IBPB (Waiman Long) [RHEL-92175]
- KVM: nVMX: Always use IBPB to properly virtualize IBRS (Waiman Long) [RHEL-92175]
- x86/bugs: Use a static branch to guard IBPB on vCPU switch (Waiman Long) [RHEL-92175]
- x86/bugs: Remove the X86_FEATURE_USE_IBPB check in ib_prctl_set() (Waiman Long) [RHEL-92175]
- x86/mm: Remove X86_FEATURE_USE_IBPB checks in cond_mitigation() (Waiman Long) [RHEL-92175]
- x86/bugs: Move the X86_FEATURE_USE_IBPB check into callers (Waiman Long) [RHEL-92175]
- x86/bugs: KVM: Add support for SRSO_MSR_FIX (Waiman Long) [RHEL-92175]
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-92175]
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-92175]
- x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-92175]
- x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-92175]
- x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-92175]
- x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-92175]
- x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-92175]
- module: don't annotate ROX me