Summary
[5.14.0-687.42.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.42.1]
- net: ipv6: clear suppressed fib6 rule result (Paolo Abeni) [RHEL-246347] {CVE-2026-74581}
- s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245333]
- s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245333]
- s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245333]
- s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245333]
- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232111] {CVE-2026-64191}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231440] {CVE-2026-64277}
- netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230679] {CVE-2026-53131}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230236] {CVE-2026-64276}
- netfilter: xt_policy: fix strict mode inbound policy matching (CKI Backport Bot) [RHEL-228843] {CVE-2026-52920}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227673] {CVE-2026-64189}
- netfilter: conntrack_irc: fix possible out-of-bounds read (CKI Backport Bot) [RHEL-225252] {CVE-2026-53268}
- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (CKI Backport Bot) [RHEL-189901] {CVE-2025-68211}
- crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-166118]
- sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212398]
- sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212398]
- sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212398]
- sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212398]
- zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191439] {CVE-2026-53185}
- ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189965] {CVE-2026-23003}
- netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CKI Backport Bot) [RHEL-189532] {CVE-2026-43114}
- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188198] {CVE-2026-52924}
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.42.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.42.1.el9_8 |
Vulnerabilities 13
-
Critical 9.8CVE-2026-52924 Public exploit
sctp: purge outqueue on stale COOKIE-ECHO handling
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …
-
Critical 9.8
net: ipv6: clear suppressed fib6 rule result
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule sup…
-
Critical 9.4
netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipa…
-
Critical 9.4
netfilter: require Ethernet MAC header before using eth_hdr()
In the Linux kernel, the following vulnerability has been resolved: netfilter: require Ethernet MAC header before using eth_hdr() `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`…
-
High 8.3
netfilter: xt_policy: fix strict mode inbound policy matching
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_policy: fix strict mode inbound policy matching match_policy_in() walks sec_path entries from the last transform to the first one, but strict policy matching needs to consume in…
-
High 8.2
netfilter: conntrack_irc: fix possible out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack_irc: fix possible out-of-bounds read When parsing fails after we've matched the command string we should bail out instead of trying to match a different command. This hel…
-
High 7.8
zram: fix use-after-free in zram_bvec_write_partial()
In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() pass…
-
High 7.8
netfilter: ipset: fix race between dump and ip_set_list resize
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…
-
High 7.8
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
Unscored —
ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
In the Linux kernel, the following vulnerability has been resolved: ksm: use range-walk function to jump over holes in scan_get_next_rmap_item Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highl…