Summary
[4.18.0-553.69.1_10.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.69.1_10]
- Revert 'sch_htb: make htb_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]
- Revert 'sch_drr: make drr_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]
- Revert 'sch_qfq: make qfq_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]
- Revert 'codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()' (Denys Vlasenko) [RHEL-108140]
- Revert 'sch_htb: make htb_deactivate() idempotent' (Denys Vlasenko) [RHEL-108140]
- Revert 'net/sched: Always pass notifications when child class becomes empty' (Denys Vlasenko) [RHEL-108140]
- Revert 'sch_cbq: make cbq_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]
[4.18.0-553.68.1_10]
- ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}
- md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]
- md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
- md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
- md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991]
- md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]
- md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]
- md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]
- md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]
- md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
- md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
- raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]
- md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]
- sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
- net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
- can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}
- net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}
[4.18.0-553.67.1_10]
- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
- mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
- mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
- mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
- mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
- padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}
- redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)
- ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.69.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.69.1.el8_10 |
Vulnerabilities 6
-
High 8.8
can: peak_usb: fix use after free bugs
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix use after free bugs After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_u…
-
High 7.8
padata: fix UAF in padata_reorder
In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…
-
High 7.8
ipv6: mcast: extend RCU protection in igmp6_send()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a pot…
-
High 7.8
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…
-
High 7.5
net/ipv6: release expired exception dst cached in socket
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception tabl…
-
Unscored —
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', whi…