Skip to content
OpenAdvisories
High ELSA-2026-36018 11 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

Published Jul 8, 2026 · Updated Jul 8, 2026

Ecosystem: Oracle Linux

Summary

[5.14.0-687.22.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.22.1]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}

[5.14.0-687.21.1]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 9 kernel 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-abi-stablelists 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-core 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-cross-headers 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-core 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-devel 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-devel-matched 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-modules 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-modules-core 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-modules-extra 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-debug-uki-virt 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-devel 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-devel-matched 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-doc 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-headers 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-modules 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-modules-core 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-modules-extra 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-tools 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-tools-libs 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-tools-libs-devel 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-uki-virt 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 kernel-uki-virt-addons 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 libperf 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 perf 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 python3-perf 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 rtla 0:5.14.0-687.22.1.el9_8
Oracle Linux · 9 rv 0:5.14.0-687.22.1.el9_8

Vulnerabilities 11

  • Critical 9.3
    CVE-2026-46316 Public exploit

    KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

    In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.1
    CVE-2025-10263 Public exploit

    Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X…

    Arm Cortex-X925 Cortex-X3 Neoverse V3 Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2026-46155

    smb/client: fix out-of-bounds read in smb2_compound_op()

    In the Linux kernel, the following vulnerability has been resolved: smb/client: fix out-of-bounds read in smb2_compound_op() If a server sends a truncated response but a large OutputBufferLength, and terminates the EA list early, check_wsl_eas() returns succe…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.1
    CVE-2026-46244

    netfilter: nft_inner: Fix IPv6 inner_thoff desync

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: Fix IPv6 inner_thoff desync In nft_inner_parse_l2l3(), when processing inner IPv6 packets, ipv6_find_hdr() correctly computes the transport header offset traversing all …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2026-43112

    fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

    In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46116

    xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

    In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46209

    drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

    In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46227

    sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL

    In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46259

    procfs: fix missing RCU protection when reading real_parent in do_task_stat()

    In the Linux kernel, the following vulnerability has been resolved: procfs: fix missing RCU protection when reading real_parent in do_task_stat() When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which lea…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-46323

    net: gro: don't merge zcopy skbs

    In the Linux kernel, the following vulnerability has been resolved: net: gro: don't merge zcopy skbs skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-43276

    net: mana: Fix double destroy_workqueue on service rescan PCI path

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix double destroy_workqueue on service rescan PCI path While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu