Skip to content
OpenAdvisories
High ELSA-2025-20320 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

Published May 11, 2025 · Updated May 11, 2025

Summary

[5.15.0-308.179.6]
- net: bridge: IP defragmentation failing for jumboframes (Venkat Venkatsubra) [Orabug: 37847171]
- uek-rpm: remove .el9 from shim version (Samasth Norway Ananda) [Orabug: 37834731]
- RDS: avoid using offlined CPU during reconnect (Arumugam Kolappan) [Orabug: 37783021]
- net/mlx5e: Rely on reqid in IPsec tunnel mode (Leon Romanovsky) [Orabug: 37710815]
- net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel (Leon Romanovsky) [Orabug: 37710815]
- net/mlx5: Clear port select structure when fail to create (Mark Zhang) [Orabug: 37710815]
- net/mlx5: SF, Fix add port error handling (Chris Mi) [Orabug: 37710815]
- net/mlx5: Fix variable not being completed when function returns (Chenguang Zhao) [Orabug: 37710815]
- net/mlx5e: Keep netdev when leave switchdev for devlink set legacy only (Jianbo Liu) [Orabug: 37710815]
- net/mlx5e: Skip restore TC rules for vport rep without loaded flag (Jianbo Liu) [Orabug: 37710815]
- net/mlx5e: macsec: Maintain TX SA from encoding_sa (Dragos Tatulea) [Orabug: 37710815]
- net/mlx5e: Remove workaround to avoid syndrome for internal port (Jianbo Liu) [Orabug: 37710815]
- net/mlx5e: SD, Use correct mdev to build channel param (Tariq Toukan) [Orabug: 37710815]
- mlxsw: spectrum_acl_flex_keys: Use correct key block on Spectrum-4 (Ido Schimmel) [Orabug: 37710815]
- net/mlx5e: clear xdp features on non-uplink representors (William Tu) [Orabug: 37710815]
- net/mlx5: Fix msix vectors to respect platform limit (Parav Pandit) [Orabug: 37710815]
- mlxsw: spectrum_ipip: Fix memory leak when changing remote IPv6 address (Ido Schimmel) [Orabug: 37710815]
- mlxsw: spectrum_ptp: Add missing verification before pushing Tx header (Amit Cohen) [Orabug: 37710815]
- net/mlx5e: Don't call cleanup on profile rollback failure (Cosmin Ratiu) [Orabug: 37710815]
- net/mlx5: Fix command bitmask initialization (Shay Drory) [Orabug: 37710815]
- net/mlx5: Check for invalid vector index on EQ creation (Maher Sanalla) [Orabug: 37710815]
- mlxsw: spectrum_acl_flex_keys: Constify struct mlxsw_afk_element_inst (Christophe JAILLET) [Orabug: 37710815]
- net: Fix netns for ip_tunnel_init_flow() (Xiao Liang) [Orabug: 37710815]
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit() (Ido Schimmel) [Orabug: 37710815]
- ip_tunnel: annotate data-races around t->parms.link (Eric Dumazet) [Orabug: 37710815]
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit() (Ido Schimmel) [Orabug: 37710815]
- ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev() (Ido Schimmel) [Orabug: 37710815]
- net/mlx5e: SHAMPO, Fix overflow of hd_per_wq (Dragos Tatulea) [Orabug: 37710815]
- net/mlx5e: SHAMPO, Increase timeout to improve latency (Dragos Tatulea) [Orabug: 37710815]
- net/mlx5: Verify support for scheduling element and TSAR type (Carolina Jubran) [Orabug: 37710815]
- net/mlx5e: Enable remove flow for hard packet limit (Jianbo Liu) [Orabug: 37710815]
- net/mlx5: Use set number of max EQs (Daniel Jurgens) [Orabug: 37710815]
- net/mlx5: IFC updates for SF max IO EQs (Daniel Jurgens) [Orabug: 37710815]
- net/mlx5e: Approximate IPsec per-SA payload data bytes count (Leon Romanovsky) [Orabug: 37710815]
- net/mlx5e: Present succeeded IPsec SA bytes and packet (Leon Romanovsky) [Orabug: 37710815]
- net/mlx5: Use max_num_eqs_24b capability if set (Daniel Jurgens) [Orabug: 37710815]
- net/mlx5: IFC updates for changing max EQs (Daniel Jurgens) [Orabug: 37710815]
- net/mlx5: Correct TASR typo into TSAR (Cosmin Ratiu) [Orabug: 37710815]
- net/mlx5e: SHAMPO, Re-enable HW-GRO (Yoray Zack) [Orabug: 37710815]
- net/mlx5e: SHAMPO, Use KSMs instead of KLMs (Yoray Zack) [Orabug: 37710815]
- net/mlx5e: Fix netif state handling (Shay Drory) [Orabug: 37710815]
- net/mlx5e: RSS, Block XOR hash with over 128 channels (Carolina Jubran) [Orabug: 37710815]
- net/mlx5: Support matching on l4_type for ttc_table (Jianbo Liu) [Orabug: 37710815]
- net/mlx5: Enable SD feature (Tariq Toukan) [Orabug: 37710815]
- net/mlx5e: Block TLS device offload on combined SD netdev (Tariq Toukan) [Orabug: 37710815]
- net/mlx5e: Support per-mdev queue counter (Tariq Toukan) [Orabug: 37710815]
- net/mlx5e: Support cross-vhca RSS (Tariq Toukan) [Orabug: 37710815]
- net/mlx5e: Let channels be SD-aware (Tariq Toukan) [Orabug: 37710815]
- net/mlx5e: Connect mlx5 IPsec statistics with XFRM core (Leon Romanovsky) [Orabug: 37710815]
- xfrm: get global statistics from the offloaded device (Leon Romanovsky) [Orabug: 37710815]
- RDS: avoid queueing delayed work on an offlined cpu (Praveen Kumar Kannoju) [Orabug: 37260584] [Orabug: 37551309]
- uek-rpm/kernel-uek.spec: Set DEFAULTKERNEL correctly during %postun (Vijay Kumar) [Orabug: 37376706]

[5.15.0-308.179.5]
- net: usb: usbnet: restore usb%d name exception for local mac addresses (Dominique Martinet)
- usbnet:fix NPE during rx_complete (Ying Lu)
- bpf: Use preempt_count() directly in bpf_send_signal_common() (Hou Tao)
- jfs: fix slab-out-of-bounds read in ea_get() (Qasim Ijaz)
- serial: 8250_dma: terminate correct DMA in tx_dma_flush() (John Keeping)
- ksmbd: fix multichannel connection failure (Namjae Jeon)
- rds: Tear down the copy-from-user cache before destroying rds_wq (Hakon Bugge) [Orabug: 37716901]

[5.15.0-308.179.4]
- Check concurrency before THP creation for file mappings in fault path (Prakash Sangappa) [Orabug: 37608058]
- rds: ib: Fix NULL ptr deref in rds_ib_cq_follow_affinity (Hakon Bugge) [Orabug: 37747825]

[5.15.0-308.179.3]
- uek-rpm: Build Bluefield 3 kernel for OL9 (Dave Kleikamp) [Orabug: 37763488]
- uek-rpm: Add emb3 config and core list for OL9 (Dave Kleikamp) [Orabug: 37763488]
- udf: Fix directory iteration for longer tail extents (Jan Kara) [Orabug: 37761829]
- uek-rpm: install the perf exec dir (Stephen Brennan) [Orabug: 37757734]
- perf probe: Improve log for long event name failure (Leo Yan) [Orabug: 37752593]
- perf probe: Check group string length (Leo Yan) [Orabug: 37752593]
-

Fixed packages 18

ReleasePackageFixed in
Oracle Linux · 8 bpftool 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-container 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-container-debug 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-core 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-debug 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-debug-core 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-debug-devel 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-debug-modules 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-debug-modules-extra 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-devel 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-doc 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-modules 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek-modules-extra 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek64k 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek64k-core 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek64k-modules 0:5.15.0-308.179.6.el9uek
Oracle Linux · 8 kernel-uek64k-modules-extra 0:5.15.0-308.179.6.el9uek

Vulnerabilities 4