Summary
[4.18.0-553.158.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.158.1]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320}
- selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800]
- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276}
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189}
- sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400]
- sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
- sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400]
- sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
- usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088]
- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924}
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.158.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.158.1.el8_10 |
Vulnerabilities 8
-
Critical 9.8CVE-2026-52924 Public exploit
sctp: purge outqueue on stale COOKIE-ECHO handling
In the Linux kernel, the following vulnerability has been resolved: sctp: purge outqueue on stale COOKIE-ECHO handling sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, …
-
Critical 9.8
scsi: target: iscsi: Validate CHAP_R length before base64 decode
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Validate CHAP_R length before base64 decode chap_server_compute_hash() allocates client_digest as kzalloc(chap->digest_size) and then, for BASE64-encoded responses, passe…
-
Critical 9.1
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-b…
-
High 8.2
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…
-
High 7.8
netfilter: ipset: fix race between dump and ip_set_list resize
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_list resize The release path of ip_set_dump_do() and ip_set_dump_done() read inst->ip_set_list via ip_set_ref_netlink(), a plain rcu_derefer…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count rmi_f30_map_gpios() allocates gpioled_key_map with min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but rmi_f3…
-
High 7.8
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
In the Linux kernel, the following vulnerability has been resolved: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count rmi_f3a_initialize() takes the GPIO count from the device query register (f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..1…