Summary
[6.12.0-203.76.7.5]
- uek-rpm: avoid final module link in early FIPS symvers pass (Sherry Yang) [Orabug: 39563330]
- netfilter: nf_tables: unconditionally bump set->nelems before insertion (Pablo Neira Ayuso) [Orabug: 39562729] {CVE-2026-23272}
[6.12.0-203.76.7.4]
- net: bonding: fix use-after-free in bond_xmit_broadcast() (Xiang Mei) [Orabug: 39556377] {CVE-2026-31419}
- eventpoll: defer struct eventpoll free to RCU grace period (Nicholas Carlini) [Orabug: 39556391] {CVE-2026-43074}
- batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39556388] {CVE-2026-31657}
- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Muhammad Alifa Ramdhan) [Orabug: 39556386] {CVE-2026-31533}
- mptcp: fix slab-use-after-free in __inet_lookup_established (Jiayuan Chen) [Orabug: 39556381] {CVE-2026-31669}
- net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39556380] {CVE-2026-31504}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39556379] {CVE-2026-43499}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39556375] {CVE-2026-46116}
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet) [Orabug: 39556341] {CVE-2026-43037}
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-203.76.7.5.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-203.76.7.5.el10uek |
Vulnerabilities 10
-
Critical 9.8
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption The -EBUSY handling in tls_do_encryption(), introduced by commit 859054147318 ("net: tls: handle backlogging of crypto re…
-
Critical 9.8
batman-adv: hold claim backbone gateways by reference
In the Linux kernel, the following vulnerability has been resolved: batman-adv: hold claim backbone gateways by reference batadv_bla_add_claim() can replace claim->backbone_gw and drop the old gateway's last reference while readers still follow the pointer. T…
-
Critical 9.8
mptcp: fix slab-use-after-free in __inet_lookup_established
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix slab-use-after-free in __inet_lookup_established The ehash table lookups are lockless and rely on SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability during RCU read-side cri…
-
Critical 9.8
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() Oskar Kjos reported the following problem. ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written by the IPv6 receive path as struc…
-
High 7.8
netfilter: nf_tables: unconditionally bump set->nelems before insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally bump set->nelems before insertion In case that the set is full, a new element gets published then removed without waiting for the RCU grace period, while…
-
High 7.8
net: bonding: fix use-after-free in bond_xmit_broadcast()
In the Linux kernel, the following vulnerability has been resolved: net: bonding: fix use-after-free in bond_xmit_broadcast() bond_xmit_broadcast() reuses the original skb for the last slave (determined by bond_is_last_slave()) and clones it for others. Concu…
-
High 7.8
net: fix fanout UAF in packet_release() via NETDEV_UP race
In the Linux kernel, the following vulnerability has been resolved: net: fix fanout UAF in packet_release() via NETDEV_UP race `packet_release()` has a race window where `NETDEV_UP` can re-register a socket into a fanout group's `arr[]` array. The re-registra…
-
High 7.8CVE-2026-43074 Public exploit
eventpoll: defer struct eventpoll free to RCU grace period
In the Linux kernel, the following vulnerability has been resolved: eventpoll: defer struct eventpoll free to RCU grace period In certain situations, ep_free() in eventpoll.c will kfree the epi->ep eventpoll struct while it still being used by another concurr…
-
High 7.8CVE-2026-43499 Public exploit
rtmutex: Use waiter::task instead of current in remove_waiter()
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when …
-
High 7.8
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y sta…