Summary
[6.12.0-203.76.7.1]
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39474418]
[6.12.0-203.76.7]
- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39456024]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39456024]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39456024]
[6.12.0-203.76.6]
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39442660] {CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39442660]
[6.12.0-203.76.5]
- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39407652] {CVE-2026-46333}
[6.12.0-203.76.4]
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218893] {CVE-2025-54518}
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim) [Orabug: 39334587] {CVE-2026-43500}
- rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (David Howells) [Orabug: 39334587]
- rxrpc: only handle RESPONSE during service challenge (Wang Jie) [Orabug: 39334587]
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (David Howells) [Orabug: 39334587]
- rxrpc: Fix potential UAF after skb_unshare() failure (David Howells) [Orabug: 39334587]
- rxrpc: Fix re-decryption of RESPONSE packets (David Howells) [Orabug: 39334587]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334587] {CVE-2026-43284}
- bcm-hsdk-gpl: Fix build issues for HSDK 6.5.34 (Vijay Kumar) [Orabug: 39342234]
- bcm-hsdk-gpl: Update BCM HSDK GPL driver to 6.5.34 (Vijay Kumar) [Orabug: 39342234]
- minke-fan-cpld: Avoid logging 'unknown fan id' when no fan is present (arista-hpandya) [Orabug: 39335238]
- exadata: tools: perf: update column to comm_nodigit (Stephen Brennan) [Orabug: 39327035]
- perf report: Add comm_nodigit sort key (Stephen Brennan) [Orabug: 39327035]
- Revert 'tools: perf: add comm_ignore_digit column' (Stephen Brennan) [Orabug: 39327035]
- octeontx2-af: cn20k: Fix RVU AF interrupt handler (Geetha sowjanya) [Orabug: 39318904]
- octeontx2-af: Move QMEM allocations from GFP_KERNEL to ATOMIC (Sunil Goutham) [Orabug: 39318904]
- bphy-pf: CNF20Ka: poll MHABs based on cpri_mask instead of fixed count (Viswajith Murali) [Orabug: 39318904]
- octeontx2-af: Add devlink param for NIX RQ caching (Nishok A) [Orabug: 39318904]
- octeontx2-af: cn20k: Fix the RVUAF->PF mbox address (Geetha sowjanya) [Orabug: 39318904]
- octeontx2-af: Add devlink and debugfs support for NPA DWRR registers. (Anshumali Gaur) [Orabug: 39318904]
- cn20k-af: psw: Fix build warning (Srujana Challa) [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix AI review comments. (Ratheesh Kannoth) [Orabug: 39318904]
- cn20k-af: psw: add mailbox to write to PSW MSIX registers (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add debugfs support for psw (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: introduce a mailbox to program PSW mbox msix vector (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add PSW AF API Notification queue support (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add FLR handler for PSW (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: setup PSW timed polling structure tables (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW PCIe configuration (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add mailbox for PSW LF mapping (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add new mailbox for PSW doorbell configuration (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: setups PSW FID resources (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: setup PSW GID resources (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: add mailbox to get PSW capabilities (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: register PSW AF interrupts (Srujana Challa) [Orabug: 39318904]
- cn20k-af: psw: introduce PSW block (Srujana Challa) [Orabug: 39318904]
- octeontx2-af: limit max periodic timers for cn20k (Shijith Thotton) [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Make default entries as x4. (Ratheesh Kannoth) [Orabug: 39318904]
- octeonxt2-af: npc: Fix bugs (Ratheesh Kannoth) [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2_unregister_dl() after kernel reboot. (Anshumali Gaur) [Orabug: 39318904]
- octeontx2-pf: cn20ka: fix call trace in otx2vf_remove after kernel reboot. (Anshumali Gaur) [Orabug: 39318904]
- octeontx2-af: cn20k: Configure default CPT_AF_UCC_CTL for IPsec error codes (Amit Singh Tomar) [Orabug: 39318904]
- octeontx2-af: CN20k: add support for RFOE4 on half MP (Sai Krishna) [Orabug: 39318904]
- octeontx2-pf: Fix kernel crash during eswitch creation (Suman Ghosh) [Orabug: 39318904]
- octeontx2-af: Use ZERO_OR_NULL_PTR for cgxchan2link_map (Subbaraya Sundeep) [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add parser configuration for VLAN extraction (Geetha sowjanya) [Orabug: 39318904]
- octeontx2-af: Add support for single SBTAG parsing (Kiran Kumar K) [Orabug: 39318904]
- octeontx2-af: Fix SDP channel base (Geetha sowjanya) [Orabug: 39318904]
- octeontx2-af: cn20K: mcs: Add MCS DSA tag parsing configuration support (Geetha sowjanya) [Orabug: 39318904]
- octeontx2-af: Avoid any false positives for Altaf (Linu Cherian) [Orabug: 39318904]
- octeontx2-af: npc: Fix broadcast MCAM entry type on CN10K (Rakesh Kudurumalla) [Orabug: 39318904]
- octeontx2-af: cn20k: Add platform check. (Anshumali Gaur) [Orabug: 39318904]
- octeontx2-bphy-netdev: add get_link_ksettings to fix SIOCETHTOOL error (Sai Krishna) [Orabug: 39318904]
- octeontx2-af: npc: cn20k: dont free default mcam indexes (Ratheesh Kannoth) [Orabug: 39318904]
- bphy-pf: CNF20ka: Replace deprecated MSI-X API in CPRI netdev driver (Viswajith Murali) [Orabug: 39318904]
- octeontx2-af: npc: cn20k: Fix kernel warn. (Ratheesh Kannoth) [Orabug: 39318904]
-
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-203.76.7.1.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-203.76.7.1.el10uek |
Vulnerabilities 13
-
High 7.8
crypto: algif_aead - Revert to operating out-of-place
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif…
KEV May 1, 2026 -
High 7.8
net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…
KEV Oct 28, 2026 -
Critical 9.8CVE-2026-31402 Public exploit
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. This size…
-
High 8.8
xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…
-
High 7.8
net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks
In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks As Paolo said earlier [1]: "Since the blamed commit below, classify can return TC_ACT_CONSUMED while the curren…
-
High 7.8
netfilter: nf_tables: always walk all pending catchall elements
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always walk all pending catchall elements During transaction processing we might have more than one catchall element: 1 live catchall element and 1 pending element that …
-
High 7.8
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
In the Linux kernel, the following vulnerability has been resolved: crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption When decrypting data that is not in-place (src != dst), there is no need to save the high-order sequence bits…
-
High 7.8
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl When page reassignment was added to af_alg_pull_tsgl the original loop wasn't updated so it may try to reassign one more pa…
-
High 7.8
netfilter: nfnetlink_queue: make hash table per queue
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: make hash table per queue Sharing a global hash table among all queues is tempting, but it can cause crash: BUG: KASAN: slab-use-after-free in nfqnl_recv_verdict+0…
-
High 7.8
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to …
-
High 7.3
Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker t…
-
High 7.1CVE-2026-46333 Public exploit
ptrace: slightly saner 'get_dumpable()' logic
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and ma…
-
Unscored —
x86/CPU: Fix FPDSS on Zen1
In the Linux kernel, the following vulnerability has been resolved: x86/CPU: Fix FPDSS on Zen1 Zen1's hardware divider can leave, under certain circumstances, partial results from previous operations. Those results can be leaked by another, attacker thread. F…