Summary
[6.12.0-205.92.4.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39844842]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 39844812] {CVE-2026-68480}
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson) [Orabug: 39844799] {CVE-2026-64561}
[6.12.0-205.92.4.1]
- net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada) [Orabug: 39816011] {CVE-2026-64531}
- Revert 'arm64: acpi: Enable ACPI CCEL support' (Will Deacon) [Orabug: 39812699]
- virtio_pci: fix vq info pointer lookup via wrong index (Ammar Faizi) [Orabug: 39812697]
- xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) [Orabug: 39812085]
[6.12.0-205.92.4]
- f2fs: fix incorrect FI_NO_EXTENT handling in __destroy_extent_node() (Yongpeng Yang)
- ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams (Ji'an Zhou)
- MIPS: smp: report dying CPU to RCU in stop_this_cpu() (Jonas Jelonek)
- LoongArch: Report dying CPU to RCU in stop_this_cpu() (Huacai Chen)
- Revert 'net: bonding: fix use-after-free in bond_xmit_broadcast()' (Kevin Berry)
- block: fix handling of dead zone write plugs (Damien Le Moal)
- Bluetooth: MGMT: Fix backward compatibility with userspace (Luiz Augusto von Dentz)
- Revert 'PCI: qcom: Advertise Hotplug Slot Capability with no Command Completion support' (Sasha Levin)
- apparmor: fix use-after-free in rawdata dedup loop (Ruslan Valiyev)
- mmc: dw_mmc-rockchip: Add missing private data for very old controllers (Heiko Stuebner)
- sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long)
- net: ipv6: Make udp_tunnel6_xmit_skb() void (Petr Machata)
- dm cache policy smq: check allocation under invalidate lock (Guangshuo Li)
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)
- locking/mutex: Remove wakeups from under mutex::wait_lock (Peter Zijlstra)
- ksmbd: fix out-of-bounds read in smb_check_perm_dacl() (Hem Parekh)
- ipv4: account for fraggap on the paged allocation path (Wongi Lee) [Orabug: 39738617]
- inet: add indirect call wrapper for getfrag() calls (Eric Dumazet) [Orabug: 39738617]
- net/mlx5: Add vhca_id_type support to IPsec alias creation (Patrisious Haddad) [Orabug: 39653091]
- net/mlx5: Add vhca_id_type bit to alias context (Patrisious Haddad) [Orabug: 39653091]
- scripts/sorttable: Fix endianness handling in build-time mcount sort (Vasily Gorbik) [Orabug: 39489132]
- scripts/sorttable: Allow matches to functions before function entry (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Steven Rostedt) [Orabug: 39489132]
- ftrace: Check against is_kernel_text() instead of kaslr_offset() (Steven Rostedt) [Orabug: 39489132]
- ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Steven Rostedt) [Orabug: 39489132]
- ftrace: Do not over-allocate ftrace memory (Guenter Roeck) [Orabug: 39489132]
- ftrace: Have ftrace pages output reflect freed pages (Steven Rostedt) [Orabug: 39489132]
- ftrace: Update the mcount_loc check of skipped entries (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Zero out weak functions in mcount_loc table (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Always use an array for the mcount_loc sorting (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Have mcount rela sort use direct values (Steven Rostedt) [Orabug: 39489132]
- arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Use a structure of function pointers for elf helpers (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Move code from sorttable.h into sorttable.c (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Use uint64_t for mcount sorting (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Add helper functions for Elf_Sym (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Add helper functions for Elf_Shdr (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Add helper functions for Elf_Ehdr (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Convert Elf_Sym MACRO over to a union (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Replace Elf_Shdr Macro with a union (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Convert Elf_Ehdr to union (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Make compare_extable() into two functions (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Have the ORC code use the _r() functions to read (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Remove unneeded Elf_Rel (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Remove unused write functions (Steven Rostedt) [Orabug: 39489132]
- scripts/sorttable: Remove unused macro defines (Steven Rostedt) [Orabug: 39489132]
- xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang) [Orabug: 39262397] {CVE-2026-31663}
- xfrm: hold device only for the asynchronous decryption (Jianbo Liu) [Orabug: 39262397]
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (Hyunwoo Kim) [Orabug: 39531622] {CVE-2026-46316}
- fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681042]
- mm: enforce resource limits for reserved VA mappings (Jianfeng Wang) [Orabug: 39681042]
- ipv6: account for fraggap on the paged allocation path (Wongi Lee) [Orabug: 39686467] {CVE-2026-53362}
- xen/ovmapi: terminate values passed to xenbus_write (Joe Jin) [Orabug: 39726311]
- xen/ovmapi: free queued events on release (Joe Jin) [Orabug: 39726311]
- xen/ovmapi: prevent duplicate app registration (Joe Jin) [Orabug: 39726311]
- xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin) [Orabug: 39726311]
- xen/
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-205.92.4.2.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-205.92.4.2.el10uek |
Vulnerabilities 21
-
High 7.8
ipv6: account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are com…
KEV Aug 27, 2026 -
Critical 9.3CVE-2026-46316 Public exploit
KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry vgic_its_invalidate_cache() walks the per-ITS translation cache with xa_for_each() and drops the cache's r…
-
High 8.8CVE-2026-53359 Public exploit
KVM: x86: Fix shadow paging use-after-free due to unexpected role
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch betw…
-
High 8.8CVE-2026-64561 Public exploit
KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e. for an invalid and/or obsolete root, after making MMU pages available for the…
-
High 7.8
net: dev_ioctl: take ops lock in hwtstamp lower paths
In the Linux kernel, the following vulnerability has been resolved: net: dev_ioctl: take ops lock in hwtstamp lower paths ndo hwtstamp callbacks are expected to run under the per-device ops lock. Make the lower get/set paths consistent with the rest of ndo in…
-
High 7.8
xfrm: hold dev ref until after transport_finish NF_HOOK
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …
-
High 7.8CVE-2026-46242 Public exploit
eventpoll: fix ep_remove struct eventpoll / struct file UAF
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_…
-
High 7.8CVE-2026-46331 Public exploit
net/sched: fix pedit partial COW leading to page cache corruption
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix pedit partial COW leading to page cache corruption tcf_pedit_act() computes the COW range for skb_ensure_writable() once before the key loop using tcfp_off_max_hint, but the hi…
-
High 7.8CVE-2026-52943 Public exploit
net: skbuff: fix missing zerocopy reference in pskb_carve helpers
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix missing zerocopy reference in pskb_carve helpers pskb_carve_inside_header() and pskb_carve_inside_nonlinear() both copy the old skb_shared_info header into a new buffer via m…
-
High 7.8CVE-2026-64531 Public exploit
net: openvswitch: reject oversized nested action attrs
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbeh…
-
High 7.3
virtio-pci: Fix result size returned for the admin command completion
In the Linux kernel, the following vulnerability has been resolved: virtio-pci: Fix result size returned for the admin command completion The result size returned by virtio_pci_admin_dev_parts_get() is 8 bytes larger than the actual result data size. This occ…
-
Medium 5.5
macsec: sync features on RTM_NEWLINK
In the Linux kernel, the following vulnerability has been resolved: macsec: sync features on RTM_NEWLINK Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES: netdev_lock include/linux/netdevice.h:2761 [inline] netdev_lock_ops include/net/netdev_l…
-
Unscored —
net: prevent a NULL deref in rtnl_create_link()
In the Linux kernel, the following vulnerability has been resolved: net: prevent a NULL deref in rtnl_create_link() At the time rtnl_create_link() is running, dev->netdev_ops is NULL, we must not use netdev_lock_ops() or risk a NULL deref if CONFIG_NET_SHAPER…
-
Unscored —
team: replace team lock with rtnl lock
In the Linux kernel, the following vulnerability has been resolved: team: replace team lock with rtnl lock syszbot reports various ordering issues for lower instance locks and team lock. Switch to using rtnl lock for protecting team device, similar to bonding…
-
Unscored —
net/mlx5: HWS, fix complex rules rehash error flow
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, fix complex rules rehash error flow Moving rules from matcher to matcher should not fail. However, if it does fail due to various reasons, the error flow should allow the kerne…
-
Unscored —
net/mlx5: Fix IPsec cleanup over MPV device
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventually disable blocking events notifier, among those events are IPsec MPV events from IB to core. So before…
-
Unscored —
md: avoid repeated calls to del_gendisk
In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23rdev-lifetime: Oops: general protection fault, probably for non-canonical address 0xdead000000000122 RI…
-
Unscored —
net/mlx5: Fix double unregister of HCA_PORTS component
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix double unregister of HCA_PORTS component Clear hca_devcom_comp in device's private data after unregistering it in LAG teardown. Otherwise a slightly lagging second pass through …
-
Unscored —
net/mlx5: Fix crash when moving to switchdev mode
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix crash when moving to switchdev mode When moving to switchdev mode when the device doesn't support IPsec, we try to clean up the IPsec resources anyway which causes the crash bel…
-
Unscored —
md: fix array_state=clear sysfs deadlock
In the Linux kernel, the following vulnerability has been resolved: md: fix array_state=clear sysfs deadlock When "clear" is written to array_state, md_attr_store() breaks sysfs active protection so the array can delete itself from its own sysfs store method.…
-
Unscored —
x86/bugs: Make Safe-RET robust against interrupt injection
In the Linux kernel, the following vulnerability has been resolved: x86/bugs: Make Safe-RET robust against interrupt injection An attacker injecting interrupts while the Safe-RET mitigation executes on machines affected by SRSO can neutralize the safe return …