Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-206.104.4.4]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035126] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035125] {CVE-2026-80844}
- RDMA/nldev: Fix locking when accessing mr->pd (Jason Gunthorpe) [Orabug: 40028950] {CVE-2026-74334}
- RDMA/restrack: Fix typos in the comments (Kalesh AP) [Orabug: 40028950]
- tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 40028948] {CVE-2026-74268}
- xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (Jason Xing) [Orabug: 40028941] {CVE-2026-53250}
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 40028939] {CVE-2026-43198}

[6.12.0-206.104.4.3]
- net: Account VLAN RPS drops (Sherry Yang) [Orabug: 40023758]
- net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
- net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (Pauli Virtanen)
- ALSA: seq: midi: Optimize event_input locking with RCU (Takashi Iwai)
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (HyeongJun An)
- f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
- media: cec: core: Fix kmemleak due to missed rc_free_device() call (Jonas Karlman)
- LoongArch: Fix acpi_package_ids[] array overflow (Bibo Mao)
- fs: fix user path of nested backing files (Baokun Li)
- Revert 'PM: sleep: Use complete() in device_pm_sleep_init()' (Sasha Levin)
- perf: Reject exited events as group leaders (Kyle Zeng)
- erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic (Geert Uytterhoeven)
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (Nathan Lucas)
- ipv4: start using dst_dev_rcu() (Eric Dumazet) [Orabug: 40022810] {CVE-2025-40074}
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 40022771] {CVE-2026-74626}
- inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 40022764] {CVE-2026-74662}
- inet: frags: save a pair of atomic operations in reassembly (Eric Dumazet) [Orabug: 40022764]
- inet: frags: change inet_frag_kill() to defer refcount updates (Eric Dumazet) [Orabug: 40022764]
- ipv4: frags: remove ipq_put() (Eric Dumazet) [Orabug: 40022764]
- inet: frags: add inet_frag_putn() helper (Eric Dumazet) [Orabug: 40022764]