Summary
[6.12.0-124.43.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-124.43.1]
- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot) [RHEL-142253] {CVE-2025-39818}
- drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttila) [RHEL-122272] {CVE-2025-38703}
[6.12.0-124.42.1]
- dpll: zl3073x: Fix ref frequency setting (Ivan Vecera) [RHEL-139828]
- dpll: Prevent duplicate registrations (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Specify phase adjustment granularity for pins (Ivan Vecera) [RHEL-139828]
- dpll: add phase-adjust-gran pin attribute (Ivan Vecera) [RHEL-139828]
- dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139828]
- dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139828]
- dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139828]
- dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139828]
- dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139828]
- dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139828]
- dpll: add reference sync get/set (Ivan Vecera) [RHEL-139828]
- dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139828]
- dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139828]
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143548] {CVE-2025-71085}
- usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137370] {CVE-2025-39760}
- sched_ext: Fix scx_kick_pseqs corruption on concurrent scheduler loads (Phil Auld) [RHEL-124637]
- sched_ext: Allocate scx_kick_cpus_pnt_seqs lazily using kvzalloc() (Phil Auld) [RHEL-124637]
[6.12.0-124.41.1]
- vfs: check dentry is still valid in get_link() (Ian Kent) [RHEL-134853]
- efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150116] {CVE-2026-23156}
- KVM: x86: Apply runtime updates to current CPUID during KVM_SET_CPUID{,2} (Igor Mammedov) [RHEL-148458]
- printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148303]
- printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148303]
- printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148303]
- printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148303]
- printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148303]
- printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148303]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147270] {CVE-2026-23097}
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137992]
- io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137992]
- io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137992] {CVE-2025-38106}
- io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137992]
- gpio: cdev: Fix resource leaks on errors in lineinfo_changed_notify() (CKI Backport Bot) [RHEL-145597] {CVE-2025-40249}
- gpio: cdev: make sure the cdev fd is still active before emitting events (CKI Backport Bot) [RHEL-145597] {CVE-2025-40249}
- macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144128] {CVE-2026-23001}
- dm: use READ_ONCE in dm_blk_report_zones (Benjamin Marzinski) [RHEL-137953]
- dm: fix unlocked test for dm_suspended_md (Benjamin Marzinski) [RHEL-137953]
- dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137953] {CVE-2025-38141}
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | libperf | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | perf | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | rtla | 0:6.12.0-124.43.1.el10_1 |
| Oracle Linux · 10 | rv | 0:6.12.0-124.43.1.el10_1 |
Vulnerabilities 10
-
High 7.8
io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() syzbot reports: BUG: KASAN: slab-use-after-free in getrusage+0x1109/0x1a60 Read of size 8 at addr ffff88810de2d2c8 by ta…
-
High 7.8
dm: fix dm_blk_report_zones
In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was never called. Also, it is possible that md->zone_revalidate_map will change while calling this functi…
-
High 7.8
drm/xe: Make dma-fences compliant with the safe access rules
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace cl…
-
High 7.8
HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save
In the Linux kernel, the following vulnerability has been resolved: HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KAS…
-
High 7.8
gpio: cdev: make sure the cdev fd is still active before emitting events
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final call to fput() on a file descriptor, the release action may be deferred and scheduled on a work queue. …
-
High 7.8CVE-2026-23001 Public exploit
macvlan: fix possible UAF in macvlan_forward_source()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…
-
High 7.5
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is tri…
-
Unscored —
usb: core: config: Prevent OOB read in SS endpoint companion parsing
In the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buf…
-
Unscored —
migrate: correct lock ordering for hugetlb file folios
In the Linux kernel, the following vulnerability has been resolved: migrate: correct lock ordering for hugetlb file folios Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2…
-
Unscored —
efivarfs: fix error propagation in efivar_entry_get()
In the Linux kernel, the following vulnerability has been resolved: efivarfs: fix error propagation in efivar_entry_get() efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitial…