Summary
[5.14.0-687.17.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.17.1]
- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}
[5.14.0-687.16.1]
- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
- dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}
[5.14.0-687.15.1]
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}
[5.14.0-687.14.1]
- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
- ALSA: 6fire: fix use-after-free on disconnect (CKI Backpor
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.17.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.17.1.el9_8 |
Vulnerabilities 14
-
High 7.8
espintcp: remove encap socket caching to avoid reference leak
In the Linux kernel, the following vulnerability has been resolved: espintcp: remove encap socket caching to avoid reference leak The current scheme for caching the encap socket can lead to reference leaks when we try to delete the netns. The reference chain …
-
High 7.8
bpf: fix ktls panic with sockmap
In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call …
-
High 7.8
net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming the "rx-vlan-filter" feature is enabled on a net device, the 8021q module will automatically add or remo…
-
High 7.8CVE-2025-39866 Public exploit
fs: writeback: fix use-after-free in __mark_inode_dirty()
In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 5…
-
High 7.8
RDMA/umad: Reject negative data_len in ib_umad_write
In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…
-
High 7.5
nvmet: fix memory leak of bio integrity
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix memory leak of bio integrity If nvmet receives commands with metadata there is a continuous memory leak of kmalloc-128 slab or more precisely bio->bi_integrity. Since commit bf4c89…
-
Unscored —
bonding: check xdp prog when set bond mode
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip l…
-
Unscored —
block: fix resource leak in blk_register_queue() error path
In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fails after blk_mq_sysfs_register() is successful but the function later encounters an error, we need to c…
-
Unscored —
dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated for idxd is not freed if an error occurs during idxd_alloc(). To fix it, free the allocated memory in th…
-
Unscored —
bpf: Do not include stack ptr register in precision backtracking bookkeeping
In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai reported an issue ([1]) where the following warning appears in kernel dmesg: [ 60.643604] verifier backtrac…
-
Unscored —
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() f…
-
Unscored —
netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto()
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a potential access to uninit-value in nf_flow_pppoe_proto() Blamed commit forgot the Ethernet header. B…
-
Unscored —
dm: fix NULL pointer dereference in __dm_suspend()
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend …
-
Unscored —
wifi: mac80211_hwsim: fix typo in frequency notification
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: fix typo in frequency notification The NAN notification is for 5745 MHz which corresponds to channel 149 and not 5475 which is not actually a valid channel. This could r…