Summary
[5.4.17-2136.351.3.1]
- fs/proc: fix uaf in proc_readdir_de() (Wei Yang) [Orabug: 38787139] {CVE-2025-40271}
[5.4.17-2136.351.3]
- Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38715366]
- fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38702507]
- uek-rpm: Replace check-kabi tool with kabi (Yifei Liu) [Orabug: 38673382]
- uek-rpm: Introduce check function for uek-rpm/tools/kabi (Yifei Liu) [Orabug: 38673382]
[5.4.17-2136.351.2]
- uek-rpm: kabi: Remove the kabi protection for debug kernels (Yifei Liu) [Orabug: 38609548]
- rds: Add smp_rmb before reading c_destroy_in_prog (Hakon Bugge) [Orabug: 38352486]
- uio_hv_generic: Set event for all channels on the device (Long Li)
- ata: libata-scsi: Fix system suspend for a security locked drive (Niklas Cassel)
- HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 (Zhang Heng)
[5.4.17-2136.351.1]
- scsi: megaraid_sas: Fix concurrent access to ISR between IRQ polling and real interrupt (Sumit Saxena) [Orabug: 38630482]
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-container | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-container-debug | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:5.4.17-2136.351.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:5.4.17-2136.351.3.1.el7uek |
Vulnerabilities 1
-
High 7.8CVE-2025-40271 Public exploit
fs/proc: fix uaf in proc_readdir_de()
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix uaf in proc_readdir_de() Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the…