Skip to content
OpenAdvisories
High ELSA-2026-1143 8 CVEs

Important: kernel security update (Oracle Linux 9)

Published Jan 27, 2026 · Updated Jan 27, 2026

Ecosystem: Oracle Linux

Summary

[5.14.0-611.26.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-611.26.1]
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462] {CVE-2025-68305}
- dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
- Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964] {CVE-2025-40294}
- drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}

[5.14.0-611.25.1]
- ice: Fix kernel panic due to page refcount underflow (Mohammad Heib) [RHEL-139731]
- net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487] {CVE-2025-68301}
- KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134767]
- Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138493]
- vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284] {CVE-2025-40248}
- eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035] {CVE-2025-38349}
- block: don't freeze queue for updating queue limits (Ming Lei) [RHEL-135268]
- mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}
- uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133868]
- dpll: zl3073x: Specify phase adjustment granularity for pins (Ivan Vecera) [RHEL-129504]
- dpll: add phase-adjust-gran pin attribute (Ivan Vecera) [RHEL-129504]

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 9 kernel 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-abi-stablelists 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-core 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-cross-headers 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-core 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-devel 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-devel-matched 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-modules 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-modules-core 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-modules-extra 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-debug-uki-virt 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-devel 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-devel-matched 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-doc 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-headers 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-modules 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-modules-core 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-modules-extra 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-tools 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-tools-libs 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-tools-libs-devel 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-uki-virt 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 kernel-uki-virt-addons 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 libperf 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 perf 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 python3-perf 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 rtla 0:5.14.0-611.26.1.el9_7
Oracle Linux · 9 rv 0:5.14.0-611.26.1.el9_7

Vulnerabilities 8

  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-68301

    net: atlantic: fix fragment overflow handling in RX path

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix fragment overflow handling in RX path The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17) fragments when handling large multi-descriptor packets. This…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38141

    dm: fix dm_blk_report_zones

    In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-38349

    eventpoll: don't decrement ep refcount while still holding the ep mutex

    In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. Th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38731

    drm/xe: Fix vm_bind_ioctl double free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ===…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2025-40248

    vsock: Ignore signal/timeout on connect() if already established

    In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues: 1. connec…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-40294

    Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() In the parse_adv_monitor_pattern() function, the value of the 'length' variable is currently limited to HCI_MAX_EXT_AD_LENGTH(25…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2025-68305

    Bluetooth: hci_sock: Prevent race in socket write iter and sock bind

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sock: Prevent race in socket write iter and sock bind There is a potential race condition between sock bind and socket write iter. bind may free the same cmd via mgmt_pending b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu