Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-324.217.5.3]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035523] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035522] {CVE-2026-80844}
- tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 40035388] {CVE-2026-74268}
- RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe (Bjoern Doebel) [Orabug: 40035390] {CVE-2026-74378}
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 40035386] {CVE-2026-43198}
- net: af_key: zero aligned sockaddr tail in PF_KEY exports (Zhengchuan Liang) [Orabug: 40035384] {CVE-2026-43088}

[5.15.0-324.217.5.2]
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39974835] {CVE-2026-80590}

[5.15.0-324.217.5.1]
- crypto: qat: restore misc workqueue lifecycle (Manjunath Patil) [Orabug: 39937535]
- LTS version: v5.15.217 (Vijayendra Suman)
- ring-buffer: Use current_context for safe per-CPU buffer swap (Tengda Wu)
- ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() (Steven Rostedt)
- jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Easwar Hariharan)
- drm/virtio: Unlock reservations on dma_resv_reserve_fences() error (Dmitry Osipenko)
- drm/vmwgfx: Reserve fence slots on buffer objects in cotables (Zack Rusin)
- udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf() (Robert Mader)
- binfmt_misc: use exe_file_deny_write_access() for the interpreter clone (Christian Brauner)
- net/x25: fix use-after-free of the socket by its timers (Baul Lee)
- net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG (Siddharth Vadapalli)
- af_packet: Don't send zero-byte data in tpacket_snd(). (Eric Dumazet)
- ASoC: xilinx: formatter_pcm: pass aud_drv_data to irq handlers (Rosen Penev)
- net: packet: fix wrong transport_header when sending VLAN-tagged frame (Wei Fang)
- netfilter: ipset: fix list type element drift bug (Florian Westphal)
- netfilter: flowtable: publish GC-visible tuple last (Jeremy Jean)
- netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path (Alexey Velichayshiy)
- netfilter: ipset: fix refcount race between list:set GC and swap (Xiang Mei (Microsoft))
- crypto: ccm - Set rfc4309 maxauthsize from child (Herbert Xu)
- arm64: tegra: Add EL2 virtual timer interrupt for Tegra194 (Jon Hunter)
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice (Daming Li)
- net/smc: rdma write inline if qp has sufficient inline space (Guangguan Wang)
- net: atlantic: free stranded TX buffers on ring deinit (Yangyu Chen)
- net/sched: act_ct: fix sk_buff leak when the header checks reject a packet (Hyunjung Ko)
- openvswitch: move key and ovs_cb update out of handle_fragments (Xin Long)
- net: sched: use skb_ip_totlen and iph_totlen (Xin Long)
- openvswitch: use skb_ip_totlen in conntrack (Xin Long)
- net: add a couple of helpers for iph tot_len (Xin Long)
- mm/ptdump: always stabilise against page table freeing using init_mm (Lorenzo Stoakes (ARM))
- sched/psi: Shut down rtpoll_timer in psi_cgroup_free() (Tejun Heo)
- drm/amd/pm: fix torn gpu metrics reads (Yang Wang)
- ice: wait for reset completion in ice_resume() (Aaron Ma)
- jiffies: Define secs_to_jiffies() (Easwar Hariharan)
- can: gs_usb: gs_usb_receive_bulk_callback(): resubmit URB on skb allocation failure (Marc Kleine-Budde)
- i2c: iproc: reset bus after timeout if START_BUSY is stuck (Jonas Gorski)
- i2c: bcm-iproc: remove printout on handled timeouts (Wolfram Sang)
- i2c: imx: Fix slave registration race and error handling (Liem)
- binfmt_misc: restore write access when removing an entry (Christian Brauner)
- fs: don't block write during exec on pre-content watched files (Amir Goldstein)
- fsnotify: opt-in for permission events at file open time (Amir Goldstein)
- ice: fix memory leak in ice_lbtest_prepare_rings() (Dawei Feng)
- scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write (Ibrahim Hashimov)
- scsi: scsi_debug: Rename zone type constants (Damien Le Moal)
- scsi: sd: sd_zbc: Return early in sd_zbc_check_zoned_characteristics() (Damien Le Moal)
- scsi: sd: sd_zbc: Introduce struct zoned_disk_info (Bart Van Assche)
- scsi: sd: sd_zbc: Use logical blocks as unit when querying zones (Damien Le Moal)
- scsi: sd: sd_zbc: Improve source code documentation (Bart Van Assche)
- net: pktgen: fix proc entry use-after-free (Chengfeng Ye)
- net: pktgen: fix code style (WARNING: Block comments) (Peter Seiderer)
- igc: remove napi_synchronize() in igc_down() (David Carlier)
- wifi: libertas_tf: fix use-after-free in lbtf_free_adapter() (Maoyi Xie)
- ksmbd: reject repeated SMB2 NEGOTIATE requests (Namjae Jeon)
- ksmbd: conn lock to serialize smb2 negotiate (Namjae Jeon)
- mm/vmstat: fold stranded per-cpu node stats when a node comes online (Gregory Price)
- ksmbd: validate minimum PDU size for transform requests (Namjae Jeon)
- smb/server: fix minimum SMB2 PDU size (ChenXiaoSong)
- smb/server: fix minimum SMB1 PDU size (ChenXiaoSong)
- ksmbd: rename smb2_get_msg to smb_get_msg (Namjae Jeon)
- super: fix emergency thaw deadlock on frozen block devices (Christian Brauner)
- ftrace: Add global mutex to serialize trace_parser access (Tengda Wu)
- net/sched: serialize qdisc_rtab_list against concurrent get/put (Aldo Ariel Panzardo)
- ksmbd: defer destroy_previous_session() until after NTLM authentication (James Montgomery)
- libceph: fix two unsafe bare decodes in decode_lockers() (Pavitra Jha)
- ceph: fix hanging __ceph_get_caps() with stale mds_wanted (Max Kellermann)
- ceph: print cluster fsid and client global_id in all debug logs (Xiubo Li)
- ceph: rename _to_client() to _to_fs_client() (Xiubo Li)
- libceph: add doutc and *_client debug macros support (Xiubo Li)
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (Xiang Mei)
- libceph: Amend checking to fix make W=1 build breakage (Andy Shevchenko)
- ceph: avoid fs reclaim whi