Unbreakable Enterprise kernel bug fix update (NA) (Oracle Linux 8)

[5.15.0-318.199.3.2.1]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39071316]

[5.15.0-318.199.3.2]
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39057366]
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 39057366] {CVE-2026-23209}
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) [Orabug: 39057346] {CVE-2026-23111}
- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39055945]

[5.15.0-318.199.3.1]
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch) [Orabug: 39026355]
- nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff) [Orabug: 39026355]
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch) [Orabug: 39026355]
- nvme: ensure disabling pairs with unquiesce (Keith Busch) [Orabug: 39026355]

[5.15.0-318.199.3]
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen)
- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202}
- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao)
- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao)
- x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper)
- KVM: x86: Don't snapshot 'max' TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500]
- KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500]
- sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860}
- Revert 'net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn' (Sharath Srinivasan) [Orabug: 38937481]
- Revert 'net/rds: expand kref coverage to rds_notifier->n_conn' (Sharath Srinivasan) [Orabug: 38937481]

[5.15.0-318.199.2]
- drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591]
- arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823]
- procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() (Al Viro) [Orabug: 38945002]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749]
- Revert 'IB/mlx5: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923519]
- Revert 'IB/core: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923519]
- Revert 'IB/core: Fix off-by-one attr index in setup_hw_port_stats' (Sharath Srinivasan) [Orabug: 38923519]
- drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496]

[5.15.0-318.199.1]
- LTS version: v5.15.199 (Vijayendra Suman)
- wifi: cfg80211: init wiphy_work before allocating rfkill fails (Edward Adam Davis) [Orabug: 39004275] {CVE-2025-22119}
- wifi: cfg80211: fully move wiphy work to unbound workqueue (Johannes Berg)
- wifi: cfg80211: cancel wiphy_work before freeing wiphy (Miri Korenblit) [Orabug: 39004414] {CVE-2025-21979}
- wifi: cfg80211: fix wiphy delayed work queueing (Johannes Berg)
- wifi: cfg80211: use system_unbound_wq for wiphy work (Johannes Berg)
- team: Move team device type change at the end of team_port_add (Nikola Z. Ivanov)
- pinctrl: meson: mark the GPIO controller as sleeping (Bartosz Golaszewski)
- mptcp: avoid dup SUB_CLOSED events after disconnect (Matthieu Baerts)
- writeback: fix 100% CPU usage when dirtytime_expire_interval is 0 (Laveesh Bansal)
- drm/imx/tve: fix probe device leak (Johan Hovold)
- pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver (Bartosz Golaszewski)
- net/sched: act_ife: convert comma to semicolon (Chen Ni)
- btrfs: prevent use-after-free on page private data in btrfs_subpage_clear_uptodate() (Jp Kobryn)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak (Marc Kleine-Budde)
- genirq/irq_sim: Initialize work context pointers properly (Gyeyoung Baek)
- HID: uclogic: Add NULL check in uclogic_input_configured() (Henry Martin) [Orabug: 39004242] {CVE-2025-38007}
- HID: uclogic: Correct devm device reference for hidinput input_dev name (Rahul Rameshbabu)
- wifi: mac80211: move TDLS work to wiphy work (Johannes Berg)
- wifi: mac80211: use wiphy work for sdata->work (Johannes Berg)
- wifi: cfg80211: add a work abstraction with special semantics (Johannes Berg)
- Bluetooth: Fix hci_suspend_sync crash (Ying Hsu)
- net: stmmac: make sure that ptp_rate is not 0 before configuring EST (Alexis Lothore)
- usbnet: Fix using smp_processor_id() in preemptible code warnings (Zqiang) [Orabug: 38649206] {CVE-2025-40164}
- NFSD: fix race between nfsd registration and exports_proc (Maninder Singh) [Orabug: 38158712] {CVE-2025-38232}
- ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} (Luis Henriques)
- espintcp: fix skb leaks (Sabrina Dubroca) [Orabug: 38094997] {CVE-2025-38057}
- fs/ntfs3: Initialize allocated memory before use (Bartlomiej Kubik)
- ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency (Namjae Jeon)
- drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED (Gaosheng Cui)
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Pedro Demarchi Gomes) [Orabug: 38773375] {CVE-2025-68211}
- mm/pagewalk: add w