ELSA-2026-0793

[5.14.0-611.24.1]

• Disable UKI signing [Orabug: 36571828]
• Update Oracle Linux certificates (Kevin Lyons)
• Disable signing for aarch64 (Ilya Okomin)
• Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
• Update x509.genkey [Orabug: 24817676]
• Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
• Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
• Add Oracle Linux IMA certificates
• Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-611.24.1]

• gitlab-ci: use rhel9.7 builder image (Michael Hofmann)
• smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131388] {CVE-2025-39933}
• tty: n_tty: Fix buffer offsets when lookahead is used (Radostin Stoyanov) [RHEL-130039]

[5.14.0-611.23.1]

• book3s64/hash: Remove kfence support temporarily (Mamatha Inamdar) [RHEL-135574]
• xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-135714]
• xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-135714]
• inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-116121]
• inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-116121]
• inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-116121]
• inetpeer: remove create argument of inet_getpeer_v46 (Guillaume Nault) [RHEL-116121]
• ipv4/route: avoid unused-but-set-variable warning (Guillaume Nault) [RHEL-116121]
• arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-130734]
• arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-130734]
• arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-130734]
• arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-130734]
• arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long)...