Summary
[5.4.17-2136.360.3]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
- sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
- pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}
[5.4.17-2136.360.2]
- Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39764468]
[5.4.17-2136.360.1]
- x86/alternatives: Guard struct alt_instr kABI layout (Saeed Mirzamohammadi) [Orabug: 39860383]
- crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
- crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
- crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
- KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug: 39273524] {CVE-2026-31588}
- xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}
[5.4.17-2136.359.3]
- Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546]
- Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39866546]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
(H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju) [Orabug: 39681637]
[5.4.17-2136.359.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39558751,39919265] {CVE-2026-74684}
- rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed) [Orabug: 39668203]
- rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan) [Orabug: 39668203]
- net/rds: harden rds_rm_size (Manjunath Patil) [Orabug: 39812534]
- rds: ib: move gc_count reset before free_percpu (Manjunath Patil) [Orabug: 39818510]
- rds: fix lfstack_pop_all sequence reset (Manjunath Patil) [Orabug: 39818510]
[5.4.17-2136.359.1]
- KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil) [Orabug: 39374251]
- arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King) [Orabug: 39374251]
- arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior) [Orabug: 39374251]
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-container | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-container-debug | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:5.4.17-2136.360.3.el8uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:5.4.17-2136.360.3.el7uek |
Vulnerabilities 13
-
Critical 9.1
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() In DecodeQ931(), the UserUserIE code path reads a 16-bit length from the packet, then decrements it by 1 to skip the protoc…
-
High 8.8
KVM: x86: Use scratch field in MMIO fragment to hold small write values
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use scratch field in MMIO fragment to hold small write values When exiting to userspace to service an emulated MMIO write, copy the to-be-written value to a scratch field in the MMI…
-
High 8.8
crypto: ecc - Fix carry overflow in vli multiplication
In the Linux kernel, the following vulnerability has been resolved: crypto: ecc - Fix carry overflow in vli multiplication The carry flag calculation fails when r01.m_high is saturated (0xFFFFFFFFFFFFFFFF) and addition of lower bits overflows. The condition (…
-
High 8.8CVE-2026-74469 Public exploit
sctp: prevent peer transport count overflow
In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count …
-
High 8.6
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but st…
-
High 8.6
inet: frags: strip GSO state from fragments before reassembly
In the Linux kernel, the following vulnerability has been resolved: inet: frags: strip GSO state from fragments before reassembly A virtio_net_hdr (tun/tap, or AF_PACKET with PACKET_VNET_HDR) can mark an IPv4 or IPv6 fragment as GSO; nothing relates gso_type …
-
High 7.8CVE-2026-68121 Public exploit
pppoe: reload header pointer after dev_hard_header()
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate th…
-
High 7.8CVE-2026-81000 Public exploit
net: tun: bound receive headroom
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…
-
High 7.5
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
In the Linux kernel, the following vulnerability has been resolved: tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member h…
-
High 7.5
crypto: pcrypt - restore callback for non-parallel fallback
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() ret…
-
Unscored —
xfrm: clear trailing padding in build_polexpire()
In the Linux kernel, the following vulnerability has been resolved: xfrm: clear trailing padding in build_polexpire() build_expire() clears the trailing padding bytes of struct xfrm_user_expire after setting the hard field via memset_after(), but the analogou…
-
Unscored —
crypto: drbg - Fix returning success on failure in CTR_DRBG
In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTR_DRBG drbg_ctr_generate() sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it.
-
Unscored —CVE-2026-80844 Public exploit
xfrm: ah6: validate routing header segments_left
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…