Summary
[6.12.0-124.13.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-124.13.1]
- NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-127623]
- nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-127623]
- Revert 'SUNRPC: Don't allow waiting for exiting tasks' (Scott Mayhew) [RHEL-110051]
- smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124955]
- smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-124955]
- smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-124955]
- smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-124955]
- fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-124955] {CVE-2025-39819}
- ice: don't leave device non-functional if Tx scheduler config fails (Petr Oros) [RHEL-116535]
[6.12.0-124.12.1]
- tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120672]
- tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120672] {CVE-2025-39955}
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113613] {CVE-2025-39730}
[6.12.0-124.11.1]
- of_numa: fix uninitialized memory nodes causing kernel panic (Charles Mirabile) [RHEL-123154] {CVE-2025-39903}
- redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-124734]
- ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116193]
- net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116193]
- ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116189]
- redhat: enable TDX host config (Paolo Bonzini) [RHEL-27145]
- KVM/TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27145]
- x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27145]
- x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27145]
- x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27145]
- x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Consolidate relocate_kernel() function parameters (Paolo Bonzini) [RHEL-27145]
- x86/paravirt: Remove the WBINVD callback (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Use typedef for relocate_kernel_fn function prototype (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Cope with relocate_kernel() not being at the start of the page (Paolo Bonzini) [RHEL-27145]
- kexec_core: Add and update comments regarding the KEXEC_JUMP flow (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Mark machine_kexec() with __nocfi (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Fix location of relocate_kernel with -ffunction-sections (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Fix stack and handling of re-entry point for ::preserve_context (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Use correct swap page in swap_pages function (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Ensure preserve_context flag is set on return to kernel (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Disable global pages before writing to control page (Paolo Bonzini) [RHEL-27145]
- x86: Fix build regression with CONFIG_KEXEC_JUMP enabled (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Mark relocate_kernel page as ROX instead of RWX (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Clean up register usage in relocate_kernel() (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Eliminate writes through kernel mapping of relocate_kernel page (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Drop page_list argument from relocate_kernel() (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Add data section to relocate_kernel (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Move relocate_kernel to kernel .data section (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Invoke copy of relocate_kernel() instead of the original (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Copy control page into place in machine_kexec_prepare() (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Allocate PGD for x86_64 transition page tables separately (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Only swap pages for ::preserve_context mode (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Use named labels in swap_pages in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Clean up and document register use in relocate_kernel_64.S (Paolo Bonzini) [RHEL-27145]
- x86/kexec: Restore GDT on return from ::preserve_context kexec (Paolo Bonzini) [RHEL-27145]
[6.12.0-124.10.1]
- wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122880] {CVE-2025-39864}
- selftests: tls: test skb copy under mem pressure and OOB (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
- tls: make sure to abort the stream if headers are bogus (CKI Backport Bot) [RHEL-120380] {CVE-2025-39946}
- ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119079]
- ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116543]
- eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111055] {CVE-2025-38614}
[6.12.0-124.9.1]
- platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123290]
- smb: client: fix fi
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | libperf | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | perf | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | rtla | 0:6.12.0-124.13.1.el10_1 |
| Oracle Linux · 10 | rv | 0:6.12.0-124.13.1.el10_1 |
Vulnerabilities 12
-
Critical 9.8
ipv6: sr: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
Critical 9.8
scsi: lpfc: Fix buffer free/clear order in deferred receive path
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buff…
-
High 8.8
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checkin…
-
High 8.4
vsock/virtio: Validate length in packet header before skb_put()
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unf…
-
High 7.8
do_change_type(): refuse to operate on unmounted/not ours mounts
In the Linux kernel, the following vulnerability has been resolved: do_change_type(): refuse to operate on unmounted/not ours mounts Ensure that propagation settings can only be changed for mounts located in the caller's mount namespace. This change aligns pe…
-
High 7.8
NFS: Fix a race when updating an existing write
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_…
-
High 7.8
kernfs: Fix UAF in polling when open file is released
In the Linux kernel, the following vulnerability has been resolved: kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-af…
-
High 7.1
efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare
In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe…
-
Unscored —
mm: swap: fix potential buffer overflow in setup_clusters()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As maxpages might be < last_page, setup_clusters() will e…
-
Unscored —CVE-2025-39751 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ALSA: usb-audio: Validate UAC3 cluster segment descriptors
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the…
-
Unscored —
x86/vmscape: Add conditional IBPB mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing …