Skip to content
OpenAdvisories
Medium ELSA-2026-6153 8 CVEs

Moderate: kernel security update (Oracle Linux 9)

Published Mar 30, 2026 · Updated Mar 30, 2026

Ecosystem: Oracle Linux

Summary

[5.14.0-611.45.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-611.45.1]
- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150403] {CVE-2026-23204}
- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150403]
- iommu: Skip PASID validation for devices without PASID capability (Eder Zulian) [RHEL-95264]

[5.14.0-611.44.1]
- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152551]
- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154395]
- cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154395]
- smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
- smb/client: fix memory leak in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
- smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-154395]
- bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152383] {CVE-2026-23171}
- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CKI Backport Bot) [RHEL-150477] {CVE-2026-23144}
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150226]
- macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150226] {CVE-2026-23209}
- dpll: zl3073x: Fix output pin phase adjustment sign (CKI Backport Bot) [RHEL-149764]
- scsi: s390: zfcp: Ensure synchronous unit_add (CKI Backport Bot) [RHEL-143736]

[5.14.0-611.43.1]
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150422] {CVE-2026-23193}
- ALSA: aloop: Fix racy access at PCM trigger (CKI Backport Bot) [RHEL-150130] {CVE-2026-23191}
- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146421] {CVE-2025-38180}
- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146421] {CVE-2025-38323}
- drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttila) [RHEL-125460] {CVE-2025-40096}

Fixed packages 29

ReleasePackageFixed in
Oracle Linux · 9 kernel 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-abi-stablelists 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-core 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-cross-headers 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-core 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-devel 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-devel-matched 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-modules 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-modules-core 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-modules-extra 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-debug-uki-virt 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-devel 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-devel-matched 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-doc 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-headers 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-modules 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-modules-core 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-modules-extra 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-tools 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-tools-libs 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-tools-libs-devel 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-uki-virt 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 kernel-uki-virt-addons 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 libperf 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 perf 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 python3-perf 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 rtla 0:5.14.0-611.45.1.el9_7
Oracle Linux · 9 rv 0:5.14.0-611.45.1.el9_7

Vulnerabilities 8

  • High 8.8
    CVE-2026-23193

    scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

    In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() In iscsit_dec_session_usage_count(), the function calls complete() while holding the sess->session_usage_lock. Simi…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-38180

    net: atm: fix /proc/net/atm/lec handling

    In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev_lec[] changes. It appears it had dev_put() calls without prior dev_hold(), leading to imbalance and U…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2025-40096

    drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

    In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on su…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23171

    bonding: fix use-after-free due to enslave fail after slave array update

    In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-23191

    ALSA: aloop: Fix racy access at PCM trigger

    In the Linux kernel, the following vulnerability has been resolved: ALSA: aloop: Fix racy access at PCM trigger The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since b…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-23209

    macvlan: fix error recovery in macvlan_common_newlink()

    In the Linux kernel, the following vulnerability has been resolved: macvlan: fix error recovery in macvlan_common_newlink() valis provided a nice repro to crash the kernel: ip link add p1 type veth peer p2 ip link set address 00:00:00:00:00:20 dev p1 ip link …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.1
    CVE-2026-23204

    net/sched: cls_u32: use skb_header_pointer_careful()

    In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: use skb_header_pointer_careful() skb_header_pointer() does not fully validate negative @offset values. Use skb_header_pointer_careful() instead. GangMin Kim provided a rep…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-23144

    mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure

    In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux