Skip to content
OpenAdvisories
High ELSA-2026-50259 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

Published May 9, 2026 · Updated May 9, 2026

Ecosystem: Oracle Linux

Summary

[6.12.0-201.74.2.3]
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim) [Orabug: 39342689] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells) [Orabug: 39342689]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie) [Orabug: 39342689]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells) [Orabug: 39342689]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells) [Orabug: 39342689]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells) [Orabug: 39342689]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39342689] {CVE-2026-43284}

Fixed packages 35

ReleasePackageFixed in
Oracle Linux · 9 kernel-uek 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-devel 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-deprecated 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-desktop 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-extra-netfilter 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-usb 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-debug-modules-wireless 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-devel 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-doc 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-deprecated 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-desktop 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-extra 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-extra-netfilter 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-usb 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-modules-wireless 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek-tools 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-devel 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-core 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-deprecated 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-desktop 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-extra-netfilter 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-usb 0:6.12.0-201.74.2.3.el10uek
Oracle Linux · 9 kernel-uek64k-modules-wireless 0:6.12.0-201.74.2.3.el10uek

Vulnerabilities 2

  • High 8.8
    CVE-2026-43284 Public exploit EPSS 94%

    xfrm: esp: avoid in-place decrypt on shared skb frags

    In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-43500 Public exploit EPSS 94%

    rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux