Skip to content
OpenAdvisories
High ELSA-2026-50094 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

Published Feb 6, 2026 · Updated Feb 6, 2026

Ecosystem: Oracle Linux

Summary

[6.12.0-107.59.3.4]
- mptcp: fix a race in mptcp_pm_del_add_timer() (Eric Dumazet) [Orabug: 38932996] {CVE-2025-40257}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Kuniyuki Iwashima) [Orabug: 38932973] {CVE-2025-40149}
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38932955] {CVE-2025-40258}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38932939]

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 9 kernel-uek 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-devel 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-deprecated 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-desktop 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra-netfilter 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-usb 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-wireless 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-devel 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-doc 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-deprecated 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-desktop 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-extra 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-extra-netfilter 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-usb 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-modules-wireless 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek-tools 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-devel 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-core 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-deprecated 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-desktop 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra-netfilter 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-usb 0:6.12.0-107.59.3.4.el10uek
Oracle Linux · 9 kernel-uek64k-modules-wireless 0:6.12.0-107.59.3.4.el10uek

Vulnerabilities 4

  • Critical 9.8
    CVE-2025-40257

    mptcp: fix a race in mptcp_pm_del_add_timer()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. A…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2025-40258

    mptcp: fix race condition in mptcp_schedule_work()

    In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40149

    tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().

    In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's u…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2025-68209

    mlx5: Fix default values in create CQ

    In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux