Summary
[6.12.0-211.34.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-211.34.1]
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]
[6.12.0-211.33.1]
- futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}
[6.12.0-211.32.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}
[6.12.0-211.31.1]
- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]
- eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776]
- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180776]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}
- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}
- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]
[6.12.0-211.30.1]
- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}
- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]
- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]
- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]
- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}
- drm/gem:
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | libperf | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | perf | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | rtla | 0:6.12.0-211.34.1.el10_2 |
| Oracle Linux · 10 | rv | 0:6.12.0-211.34.1.el10_2 |
Vulnerabilities 28
-
Critical 9.8
mptcp: fix a race in mptcp_pm_del_add_timer()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. A…
-
Critical 9.8
smb: client: fix potential cfid UAF in smb2_query_info_compound
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential cfid UAF in smb2_query_info_compound When smb2_query_info_compound() retries, a previously allocated cfid may have been freed in the first attempt. Because cfid was…
-
High 7.8
espintcp: remove encap socket caching to avoid reference leak
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain …
-
High 7.8
bpf: fix ktls panic with sockmap
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call …
-
High 7.8
ftrace: Fix UAF when lookup kallsym after ftrace disabled
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix UAF when lookup kallsym after ftrace disabled The following issue happens with a buggy module: BUG: unable to handle page fault for address: ffffffffc05d0218 PGD 1bd66f067 P4D 1bd…
-
High 7.8
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remo…
-
High 7.8CVE-2025-39866 Public exploit
fs: writeback: fix use-after-free in __mark_inode_dirty()
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 5…
-
High 7.8CVE-2026-23111 Public exploit
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() nft_map_catchall_activate() has an inverted element activity check compared to its non-catchall counterpart nft…
-
High 7.8
RDMA/umad: Reject negative data_len in ib_umad_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…
-
High 7.5
nvmet: fix memory leak of bio integrity
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89…
-
High 7.5
Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"
In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that pynfs COMP6 now leaves the connection or lease in a strange state, which causes CLOSE9 to hang indefin…
-
High 7.3
KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop Move the conditional loading of hardware DR6 with the guest's DR6 value out of the core .vcpu_run() loop to fix a bug…
-
Unscored —
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller val…
-
Unscored —
block: fix resource leak in blk_register_queue() error path
In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to c…
-
Unscored —
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in th…
-
Unscored —
bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()
In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_percpu_elem() helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit…
-
Unscored —
ring-buffer: Do not trigger WARN_ON() due to a commit_overrun
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mapped buffer the reader page is just swapped out with the last page written in the write buffer. If the re…
-
Unscored —
phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug
In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug The qmp_usb_iomap() helper function currently returns the raw result of devm_ioremap() for non-exclusive mappings. Since devm_ioremap() may retu…
-
Unscored —
bpf: Do not include stack ptr register in precision backtracking bookkeeping
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtrac…
-
Unscored —
ACPICA: fix acpi operand cache leak in dswstate.c
In the Linux kernel, the following vulnerability has been resolved: ACPICA: fix acpi operand cache leak in dswstate.c ACPICA commit 987a3b5cf7175916e2a4b6ea5b8e70f830dfe732 I found an ACPI cache leak in ACPI early termination and boot continuing case. When ea…
-
Unscored —
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. B…
-
Unscored —
xfrm: Duplicate SPI Handling
In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expecte…
-
Unscored —
PCI/AER: Avoid NULL pointer dereference in aer_ratelimit()
In the Linux kernel, the following vulnerability has been resolved: PCI/AER: Avoid NULL pointer dereference in aer_ratelimit() When platform firmware supplies error information to the OS, e.g., via the ACPI APEI GHES mechanism, it may identify an error source…
-
Unscored —
dm: fix NULL pointer dereference in __dm_suspend()
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend …
-
Unscored —
block: Remove queue freezing from several sysfs store callbacks
In the Linux kernel, the following vulnerability has been resolved: block: Remove queue freezing from several sysfs store callbacks Freezing the request queue from inside sysfs store callbacks may cause a deadlock in combination with the dm-multipath driver a…
-
Unscored —CVE-2026-23002 Public exploit
lib/buildid: use __kernel_read() for sleepable context
In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to u…
-
Unscored —
wifi: mac80211_hwsim: fix typo in frequency notification
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could r…
-
Unscored —
ice: Fix PTP NULL pointer dereference during VSI rebuild
In the Linux kernel, the following vulnerability has been resolved: ice: Fix PTP NULL pointer dereference during VSI rebuild Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp…