Skip to content
OpenAdvisories
Medium ELSA-2025-18281 7 CVEs

Moderate: kernel security update (Oracle Linux 9)

Published Oct 20, 2025 · Updated Oct 20, 2025

Ecosystem: Oracle Linux

Summary

[5.14.0-570.55.1.0.1]
- nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-570.55.1]
- scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119115] {CVE-2025-39841}

[5.14.0-570.54.1]
- firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-113836] {CVE-2022-50087}
- SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110811]
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110811] {CVE-2025-38571}
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118256] {CVE-2025-39817}
- sunrpc: fix handling of server side tls alerts (Steve Dickson) [RHEL-111070] {CVE-2025-38566}
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (Jay Shin) [RHEL-116679]

[5.14.0-570.53.1]
- wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117578] {CVE-2025-39849}
- ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114436]
- ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114436]
- ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114436]
- nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-93610] {CVE-2025-22026}
- irdma: free iwdev->rf after removing MSI-X (CKI Backport Bot) [RHEL-111485]

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 9 kernel 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-abi-stablelists 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-core 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-cross-headers 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-core 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-devel 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-devel-matched 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules-core 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-modules-extra 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-debug-uki-virt 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-devel 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-devel-matched 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-doc 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-headers 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-modules 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-modules-core 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-modules-extra 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-tools 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-tools-libs 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-tools-libs-devel 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-uki-virt 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 kernel-uki-virt-addons 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 libperf 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 perf 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 python3-perf 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 rtla 0:5.14.0-570.55.1.0.1.el9_6
Oracle Linux · 9 rv 0:5.14.0-570.55.1.0.1.el9_6

Vulnerabilities 7

  • Critical 9.8
    CVE-2025-38566

    sunrpc: fix handling of server side tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-39841

    scsi: lpfc: Fix buffer free/clear order in deferred receive path

    In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-39849

    wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.2
    CVE-2025-38571

    sunrpc: fix client side handling of tls alerts

    In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-50087

    firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

    In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the pro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2025-39817

    efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare

    In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-22026

    nfsd: don't ignore the return code of svc_proc_register()

    In the Linux kernel, the following vulnerability has been resolved: nfsd: don't ignore the return code of svc_proc_register() Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel wil…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux