Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.352.5.1]
- xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 39016499]
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 39016499]
- Revert 'xfrm: destroy xfrm_state synchronously on net exit path' (Sabrina Dubroca) [Orabug: 39016499]
- xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 39016501] {CVE-2025-40215}

[5.4.17-2136.352.5]
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (Eric Biggers) [Orabug: 38879907] {CVE-2025-40022}

[5.4.17-2136.352.4]
- arm64: pensando: Must boot Ortano kernel with spin-table (Rob Gardner) [Orabug: 38821197]

[5.4.17-2136.352.3]
- net/sched: adjust device watchdog timer to detect stopped queue at right time (Praveen Kumar Kannoju) [Orabug: 38340278]
- net/mlx5: Mark the mellanox graceful_period fix as out-of-tree change (Praveen Kumar Kannoju) [Orabug: 38252416]
- infiniband/xsigo: Replace BUG_ON with WARN_ON_ONCE. (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xsvnic_main: Remove unused functions (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_cm: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_ethtool: Remove unused variable 'priv' (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_ib: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_ib: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_verbs: Remove unused label 'out_free_pd' (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_main: Remove unused function 'xve_napi_del' (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_main: Fix mixed code warning (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xve_main: Fix misleading indentation (Siddh Raman Pant) [Orabug: 38418469]
- inifinibad/xsigo: xsvnic_main: Remove unused variable 'xsvnic_ethtool_ops' (Siddh Raman Pant) [Orabug: 38418469]
- infiniband/xsigo: xscore_impl: Remove unused label 'err_pd' (Siddh Raman Pant) [Orabug: 38418469]
- rds: Fix jiffies type in struct rds_conn_path (Siddh Raman Pant) [Orabug: 38418727]
- kernel: sysctl: Remove unused variable 'zero' (Siddh Raman Pant) [Orabug: 38418727]
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (Herbert Xu) [Orabug: 38537469] {CVE-2025-39964}
- RDMA/cm: Base cm_id destruction timeout on CMA values (Hakon Bugge) [Orabug: 38753622]
- x86/its: Build fails with CONFIG_MITIGATION_ITS=n (Alexandre Chartre) [Orabug: 38756954]

[5.4.17-2136.352.2]
- LTS tag: v5.4.302 (Sherry Yang)
- Input: pegasus-notetaker - fix potential out-of-bounds access (Seungjin Bae)
- Input: remove third argument of usb_maxpacket() (Vincent Mailhol)
- usb: deprecate the third argument of usb_maxpacket() (Vincent Mailhol)
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38737034,38786776,38787139] {CVE-2025-40271}
- pmdomain: imx: Fix reference count leak in imx_gpc_remove (Miaoqian Lin)
- pmdomain: arm: scmi: Fix genpd leak on provider registration failure (Sudeep Holla)
- net: netpoll: fix incorrect refcount handling causing incorrect cleanup (Breno Leitao) [Orabug: 38773510] {CVE-2025-68245}
- net: qede: Initialize qede_ll_ops with designated initializer (Nathan Chancellor)
- net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error (Nishanth Menon)
- ALSA: usb-audio: fix uac2 clock source at terminal parser (Rene Rebe)
- mm/page_alloc: fix hash table order logging in alloc_large_system_hash() (Isaac J. Manjarres)
- kconfig/nconf: Initialize the default locale at startup (Jakub Horky)
- kconfig/mconf: Initialize the default locale at startup (Jakub Horky)
- vsock: Ignore signal/timeout on connect() if already established (Michal Luczaj) [Orabug: 38730612] {CVE-2025-40248}
- s390/ctcm: Fix double-kfree (Aleksei Nikiforov)
- net: openvswitch: remove never-working support for setting nsh fields (Ilya Maximets) [Orabug: 38730650] {CVE-2025-40254}
- mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() (Zilin Guan)
- MIPS: Malta: Fix !EVA SOC-it PCI MMIO (Maciej W. Rozycki)
- scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() (Hamza Mahfooz) [Orabug: 38773441] {CVE-2025-68229}
- scsi: sg: Do not sleep in atomic context (Bart Van Assche) [Orabug: 38730664] {CVE-2025-40259}
- Input: cros_ec_keyb - fix an invalid memory access (Tzung-Bi Shih) [Orabug: 38730681] {CVE-2025-40263}
- be2net: pass wrb_params in case of OS2BMC (Andrey Vatoropin) [Orabug: 38730691] {CVE-2025-40264}
- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() (Abdun Nihaal) [Orabug: 38798908] {CVE-2025-68734}
- EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection (Niravkumar L Rabara)
- EDAC/altera: Handle OCRAM ECC enable after warm reset (Niravkumar L Rabara)
- spi: Try to get ACPI GPIO IRQ earlier (Hans de Goede)
- ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe (Chuang Wang) [Orabug: 38773496] {CVE-2025-68241}
- strparser: Fix signed/unsigned mismatch bug (Nate Karstens)
- gcov: add support for GCC 15 (Peter Oberparleiter)
- mm/ksm: fix flag-dropping behavior in ksm_madvise (Jakub Acs)
- ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Haein Lee) [Orabug: 38737052] {CVE-2025-40275}
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (Ian Forbes) [Orabug: 38737061] {CVE-2025-40277}
- ASoC: cs4271: Fix regulator leak on probe failure (Xu Wang)
- regulator: fixed: fix GPIO descriptor leak on register failure (Xu Wang)
- regulator: fixed: use dev_err_probe for register (Chris Morgan)
- Bluetooth: L2CAP: export l2cap_chan_hold for modules (Pauli Virtanen)
- net_sched: limit try_bulk_dequeue_skb() batches (Eric Dumazet)
- net_sched: remove need_resched() from qdisc_run() (Eric Dumazet)
- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Gal Pressman)
- net/mlx5e: Fix maxrate wraparoun