Summary
[5.14.0-570.35.1.0.1_6.OL9]
- nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-570.35.1_6]
- s390/dasd: Remove DMA alignment (CKI Backport Bot) [RHEL-91593]
- s390/cpumf: Update CPU Measurement facility extended counter set support (CKI Backport Bot) [RHEL-103066]
- s390/topology: Improve topology detection (CKI Backport Bot) [RHEL-92100]
- s390/pai: export number of sysfs attribute files (CKI Backport Bot) [RHEL-87178]
- s390/pai: fix attr_event_free upper limit for pai device drivers (CKI Backport Bot) [RHEL-87178]
- powerpc/64s/radix/kfence: map __kfence_pool at page granularity (Mamatha Inamdar) [RHEL-92081]
- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103151] {CVE-2025-38159}
- redhat: Mark kernel incompatible with xdp-tools<1.5.4 (Felix Maurer) [RHEL-101008]
- bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CKI Backport Bot) [RHEL-101008] {CVE-2025-21867}
- arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-100603]
- arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-100603] {CVE-2025-37963}
- arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-100603] {CVE-2025-37948}
- arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-100603]
- arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-100603]
- arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-100603]
- redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-100603]
- selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Add 'vmexit' option to skip mitigation on some CPUs (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
- x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Waiman Long) [RHEL-100603]
- x86/bpf: Add IBHF call at end of classic BPF (Waiman Long) [RHEL-100603]
- x86/bpf: Call branch history clearing sequence on exit (Waiman Long) [RHEL-100603]
- arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-100603]
- arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-100603]
- x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-100603]
- x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-100603]
- x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-100603]
- x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-100603]
- x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-100603]
- selftests: Warn about skipped tests in result summary (Waiman Long) [RHEL-100603]
- x86/cpu: Fix typo in x86_match_cpu()'s doc (Waiman Long) [RHEL-100603]
- x86/cpu: Expose only stepping min/max interface (Waiman Long) [RHEL-100603]
- x86/cpu: Add CPU type to struct cpuinfo_topology (Waiman Long) [RHEL-100603]
- x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES (Waiman Long) [RHEL-100603]
- x86/cpufeatures: Rename X86_FEATURE_FAST_CPPC to have AMD prefix (Waiman Long) [RHEL-100603]
- tools/include: Sync x86 headers with the kernel sources (Waiman Long) [RHEL-100603]
- selftests: ksft: Fix finished() helper exit code on skipped tests (Waiman Long) [RHEL-100603]
- kselftest: Move ksft helper module to common directory (Waiman Long) [RHEL-100603]
- platform/x86/intel/ifs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- x86/platform/atom: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- cpufreq: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- x86/bugs: Add 'spectre_bhi=vmexit' cmdline option (Waiman Long) [RHEL-100603]
- EDAC/skx: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- EDAC/i10nm: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL (Waiman Long) [RHEL-100603]
- x86/aperfmperf: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- x86/apic: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- x86/bugs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
- EDAC/i10nm: Add Intel Grand Ridge micro-server support (Waiman Long) [RHEL-100603]
- Revert 'sch_htb: make htb_qlen_notify() idempotent' (Patrick Talbert) [RHEL-108138]
- Revert 'sch_drr: make drr_qlen_notify() idempotent' (Patrick Talbert) [RHEL-108138]
- Revert 'sch_qfq: make qfq_qlen_notify() idempote
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | libperf | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | perf | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | rtla | 0:5.14.0-570.35.1.0.1.el9_6 |
| Oracle Linux · 9 | rv | 0:5.14.0-570.35.1.0.1.el9_6 |
Vulnerabilities 9
-
Critical 9.8
tls: always refresh the queue when reading sock
In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP compacts skbs much more aggressively. This unearthed a bug in TLS where we may try to operate on an old sk…
-
High 7.8
bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() KMSAN reported a use-after-free issue in eth_skb_pkt_type()[1]. The cause of the issue was that eth_skb_pkt_type() accessed skb's…
-
High 7.8
mm/hugetlb: unshare page tables during VMA split, not before
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: unshare page tables during VMA split, not before Currently, __split_vma() triggers hugetlb page table unsharing through vm_ops->may_split(). This happens before the VMA lock and r…
-
High 7.8
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a n…
-
High 7.8
Bluetooth: hci_core: Fix use-after-free in vhci_flush()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix use-after-free in vhci_flush() syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its de…
-
High 7.5
net: fix udp gso skb_segment after pull from frag_list
In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fix udp gso fraglist segmentation after pull from frag_list") detected invalid geometry in frag_list skb…
-
Medium 5.6
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) …
-
Unscored —
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], ¶[1])', whi…
-
Unscored —CVE-2025-38380 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.