Summary
[6.12.0-211.56.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-211.56.1]
- redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518]
- hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518]
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518]
- hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518]
- hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518]
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363}
- wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175}
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176}
- net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172}
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869}
- smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105]
- time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225]
- clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519]
- configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519]
- clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519]
- arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519]
- ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519]
- redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516]
- arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516]
- nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516]
- dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516]
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045}
- octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923}
- dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102}
- net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143}
- net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294}
- ALSA: hda/tas2781: Fix device-0 rese
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | libperf | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | perf | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | rtla | 0:6.12.0-211.56.1.el10_2 |
| Oracle Linux · 10 | rv | 0:6.12.0-211.56.1.el10_2 |
Vulnerabilities 19
-
Critical 9.8
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…
-
High 8.8
octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify rvu_mbox_handler_rep_event_notify() in drivers/net/ethernet/marvell/ octeontx2/af/rvu_rep.c queues a sender-controlled…
-
High 8.8
ice: reject out-of-range ptype in ice_parser_profile_init
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…
-
High 8.8
net: qrtr: restrict socket creation to the initial network namespace
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…
-
High 8.4
net: wwan: t7xx: fix potential skb->frags overflow in RX path
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…
-
High 8.1
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…
-
High 7.8
net: ena: PHC: Fix potential use-after-free in get_timestamp
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…
-
High 7.8
ALSA: timer: Fix UAF at snd_timer_user_params()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…
-
High 7.8
ALSA: timer: Forcibly close timer instances at closing
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…
-
High 7.8
ALSA: seq: Serialize UMP output teardown with event_input
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…
-
High 7.8
net: slip: serialize receive against buffer reallocation
In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation sl_realloc_bufs() replaces rbuff and updates buffsize while holding sl->lock. slip_receive_buf() reads those fields and writes through…
-
High 7.8
ALSA: timer: don't re-enter an instance callback that is still running
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…
-
High 7.8
dm_early_create: fix freeing used table on dm_resume failure
In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…
-
High 7.7
hwrng: virtio: clamp device-reported used.len at copy_data()
In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi-…
-
High 7.6
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…
-
High 7.5
wifi: iwlwifi: mld: stop TX during firmware restart
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…
-
High 7.5
netfilter: handle unreadable frags
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module…
-
Unscored —
soc: qcom: socinfo: Avoid out of bounds read of serial number
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db…
-
Unscored —
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…