Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

Fixed packages 35

Vulnerabilities 15

• High 7.8
  CVE-2026-31431 Exploited Public exploit EPSS 98%

  crypto: algif_aead - Revert to operating out-of-place

  In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux Alpine
  Apr 22, 2026

  KEV May 1, 2026
• Critical 9.8
  CVE-2026-23240

  tls: Fix race condition in tls_sw_cancel_work_tx()

  In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 10, 2026
• High 8.8
  CVE-2026-43284 Public exploit EPSS 94%

  xfrm: esp: avoid in-place decrypt on shared skb frags

  In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 8, 2026
• High 8.1
  CVE-2025-40135

  ipv6: use RCU in ip6_xmit()

  In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6_xmit() Use RCU in ip6_xmit() in order to use dst_dev_rcu() to prevent possible UAF.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Nov 12, 2025
• High 7.8
  CVE-2026-23004 Public exploit

  dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()

  In the Linux kernel, the following vulnerability has been resolved: dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 25, 2026
• High 7.8
  CVE-2026-23243

  RDMA/umad: Reject negative data_len in ib_umad_write

  In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_write ib_umad_write computes data_len from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP heade…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 18, 2026
• High 7.8
  CVE-2026-23273

  macvlan: observe an RCU grace period in macvlan_common_newlink() error path

  In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlan_common_newlink() error path valis reported that a race condition still happens after my prior patch. macvlan_common_newlink() might have made @…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 20, 2026
• High 7.8
  CVE-2026-31413 Public exploit

  bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR maybe_fork_scalars() is called for both BPF_AND and BPF_OR when the source operand is a constant. When dst has signed range …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 12, 2026
• High 7.8
  CVE-2026-43500 Public exploit EPSS 94%

  rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  May 11, 2026
• High 7.3
  CVE-2025-54518

  Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker t…

  AMD AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics AMD Ryzen™ 7020 Series Processors with Radeon™ Graphics AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics Debian Ubuntu Alpine
  May 15, 2026
• Unscored —
  CVE-2026-23249

  xfs: check for deleted cursors when revalidating two btrees

  In the Linux kernel, the following vulnerability has been resolved: xfs: check for deleted cursors when revalidating two btrees The free space and inode btree repair functions will rebuild both btrees at the same time, after which it needs to evaluate both bt…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2026
• Unscored —
  CVE-2026-23250

  xfs: check return value of xchk_scrub_create_subord

  In the Linux kernel, the following vulnerability has been resolved: xfs: check return value of xchk_scrub_create_subord Fix this function to return NULL instead of a mangled ENOMEM, then fix the callers to actually check for a null pointer and return ENOMEM. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2026
• Unscored —
  CVE-2026-23251

  xfs: only call xf{array,blob}_destroy if we have a valid pointer

  In the Linux kernel, the following vulnerability has been resolved: xfs: only call xf{array,blob}_destroy if we have a valid pointer Only call the xfarray and xfblob destructor if we have a valid pointer, and be sure to null out that pointer afterwards. Note …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2026
• Unscored —
  CVE-2026-23443

  ACPI: processor: Fix previous acpi_processor_errata_piix4() fix

  In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: Fix previous acpi_processor_errata_piix4() fix After commi f132e089fe89 ("ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()"), device pointers ma…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 3, 2026
• Unscored —
  CVE-2026-31411

  net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

  In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() Reproducer available at [1]. The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc pointer from msg->vcc and …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 8, 2026