Summary
[5.15.0-316.196.4.2]
- xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca)
- usb: raw-gadget: cap raw_io transfer length to KMALLOC_MAX_SIZE (Gopi Krishna Menon)
- ext4: clear i_state_flags when alloc inode (Haibo Chen)
- ext4: align max orphan file size with e2fsprogs limit (Baokun Li)
- PM: runtime: Do not clear needs_force_resume with enabled runtime PM (Rafael J. Wysocki)
- net: enetc: fix build warning when PAGE_SIZE is greater than 128K (Wei Fang)
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Xiang Mei)
- block: fix comment for op_is_zone_mgmt() to include RESET_ALL (shechenglong)
- fuse: fix readahead reclaim deadlock (Joanne Koong)
- i40e: validate ring_len parameter against hardware-specific values (Gregory Herrero)
- fs/ntfs3: fix mount failure for sparse runs in run_unpack() (Konstantin Komarov)
- xfrm: delete x->tunnel as we delete x (Sabrina Dubroca) [Orabug: 38933003] {CVE-2025-40215}
- mptcp: fix race condition in mptcp_schedule_work() (Eric Dumazet) [Orabug: 38932997] {CVE-2025-40258}
- mlx5: Fix default values in create CQ (Akiva Goldberger) [Orabug: 38932992]
- sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [Orabug: 38932991] {CVE-2025-38566}
- sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [Orabug: 38932988] {CVE-2025-38571}
Fixed packages 19
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-core | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-devel | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules | 0:5.15.0-316.196.4.2.el9uek |
| Oracle Linux · 8 | kernel-uek64k-modules-extra | 0:5.15.0-316.196.4.2.el9uek |
Vulnerabilities 5
-
Critical 9.8
sunrpc: fix handling of server side tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kv…
-
Critical 9.8
mptcp: fix race condition in mptcp_schedule_work()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount …
-
High 8.2
sunrpc: fix client side handling of tls alerts
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kv…
-
High 7.8
xfrm: delete x->tunnel as we delete x
In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (…
-
Unscored —
mlx5: Fix default values in create CQ
In the Linux kernel, the following vulnerability has been resolved: mlx5: Fix default values in create CQ Currently, CQs without a completion function are assigned the mlx5_add_cq_to_tasklet function by default. This is problematic since only user CQs created…