Summary
[4.18.0-553.104.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.104.1]
- Revert 'audit: Avoid excessive dput/dget in audit_context setup and reset paths' (Alexandra Hajkova) [RHEL-145856]
[4.18.0-553.103.1]
- ext4: fix use-after-free in ext4_orphan_cleanup (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673}
- ext4: lost matching-pair of trace in ext4_truncate (CKI Backport Bot) [RHEL-136000] {CVE-2022-50673}
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136904] {CVE-2025-40269}
[4.18.0-553.102.1]
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144327] {CVE-2026-22998}
- NFSv4: ensure the open stateid seqid doesn't go backwards (Scott Mayhew) [RHEL-121683]
- audit: Avoid excessive dput/dget in audit_context setup and reset paths (Waiman Long) [RHEL-140776]
- lockref: remove lockref_put_not_zero (Waiman Long) [RHEL-140776]
- lockref: stop doing cpu_relax in the cmpxchg loop (Waiman Long) [RHEL-140776]
- lockref: remove unused 'lockref_get_or_lock()' function (Waiman Long) [RHEL-140776]
- lockref: Limit number of cmpxchg loop retries (Waiman Long) [RHEL-140776]
- net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129079] {CVE-2025-40170}
- ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129004] {CVE-2025-40135}
- ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128966] {CVE-2025-40158}
- net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128966]
- net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128966]
- net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128966]
- ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128966] {CVE-2025-21766}
- net: gain ipv4 mtu when mtu is not locked (Hangbin Liu) [RHEL-128966]
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128966]
- ipv4: add RCU protection to ip4_dst_hoplimit() (Hangbin Liu) [RHEL-128966]
[4.18.0-553.101.1]
- i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141878]
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140255] {CVE-2025-68349}
- vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137692] {CVE-2025-38403}
- sched: Fix stop_one_cpu_nowait() vs hotplug (Herton R. Krzesinski) [RHEL-85625]
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.104.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.104.1.el8_10 |
Vulnerabilities 8
-
High 8.1
ipv6: use RCU in ip6_xmit()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.
-
High 8.1
ipv6: use RCU in ip6_output()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_output() Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF. We can remove rcu_read_lock()/rcu_read_unlock() pairs from ip6_finish_output2().
-
High 7.8
ext4: fix use-after-free in ext4_orphan_cleanup
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…
-
High 7.8
net: use dst_dev_rcu() in sk_setup_caps()
In the Linux kernel, the following vulnerability has been resolved: net: use dst_dev_rcu() in sk_setup_caps() Use RCU to protect accesses to dst->dev from sk_setup_caps() and sk_dst_gso_max_size(). Also use dst_dev_rcu() in ip6_dst_mtu_maybe_forward(), and ip…
-
High 7.8
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential overflow of PCM transfer buffer The PCM stream data in USB-audio driver is transferred over USB URB packet buffers, and each packet size is determined dynamical…
-
High 7.5
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid Fixes a crash when layout is null during this call stack: write_inode -> nfs4_write_inode -> pnfs_layoutcommit_inode…
-
High 7.5
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…
-
Unscored —
vsock/vmci: Clear the vmci transport packet properly when initializing it
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: Clear the vmci transport packet properly when initializing it In vmci_transport_packet_init memset the vmci_transport_packet before populating the fields to avoid any uninitialise…