Important: kernel security update (Oracle Linux 9)

[5.14.0-687.5.3]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.5.3]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}

[5.14.0-687.5.2]
- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172543]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172543]
- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172543]
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172543]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172543] {CVE-2026-23060}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172543]
- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172543] {CVE-2026-31677}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172543]

[5.14.0-687.5.1]
- kabi: enable check-kabi (Cestmir Kalina) [RHEL-153672]
- kabi: add symbols to stablelist (Cestmir Kalina) [RHEL-153672]
- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]

[5.14.0-687.4.1]
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}

[5.14.0-687.3.1]
- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
- netfilter: nf_tables: fix use-after-free