Summary
[5.14.0-687.49.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.49.1]
- selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258014] {CVE-2026-72243}
- gfs2: Get rid of sd_async_glock_wait (Andreas Gruenbacher) [RHEL-253986]
- watchdog: fix hrtimer start when pretimeout is zero (Krzysztof Pawlinski) [RHEL-255217]
- iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256733]
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246399] {CVE-2026-63869}
- wifi: cfg80211: advance loop vars in cfg80211_merge_profile() (Izabela Bakollari) [RHEL-240350] {CVE-2026-64174}
- wifi: brcmfmac: cyw: fix heap overflow on a short auth frame (Izabela Bakollari) [RHEL-242723] {CVE-2026-72003}
- net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() (Izabela Bakollari) [RHEL-244100] {CVE-2026-72298}
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241012] {CVE-2026-68363}
- wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243302] {CVE-2026-64175}
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243366] {CVE-2026-64176}
- net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245512] {CVE-2026-23172}
- gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-252544]
- gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-252544]
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159}
- libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237156] {CVE-2026-68159}
- gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-252540]
- gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-252540]
- gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-252540]
- gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: fix infinite loop when checking ail item count before go_inval' (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Allow some glocks to be used during withdraw' (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Check for log write errors before telling dlm to unlock' (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: fix a deadlock on withdraw-during-mount' (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (6/6) (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (5/6) (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (4/6) (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (3/6) (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (2/6) (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (1/6) (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-252540]
- Revert 'gfs2: don't stop reads while withdraw in progress' (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Rename gfs2_{withdrawing_or_ => }withdrawn (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Fix usage of bio->bi_status in gfs2_end_log_write (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Asynchronous withdraw (Andreas Gruenbacher) [RHEL-252540]
- gfs2: Add clean argument to lm_unmount hook (Andreas Gruenbacher) [RHEL-252540]
- xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
- xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
- xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-232965] {CVE-2026-31663}
- xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227508] {CVE-2026-63919}
- xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236120] {CVE-2026-68426}
- xfrm: p
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.49.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.49.1.el9_8 |
Vulnerabilities 31
-
Critical 9.8
IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus I…
-
Critical 9.8
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …
-
Critical 9.8
xfrm: fix stale skb->prev after async crypto steals a GSO segment
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix stale skb->prev after async crypto steals a GSO segment skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list(…
-
Critical 9.1
RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv rxe_rcv() currently checks only that the incoming packet is at least header_size(pkt) bytes long before payload_size() is used…
-
High 8.8
ip6: vti: Use ip6_tnl.net in vti6_changelink().
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_changelink(). ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -…
-
High 8.8
xfrm: input: hold netns during deferred transport reinjection
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must…
-
High 8.8
ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().
In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) …
-
High 8.8
ice: reject out-of-range ptype in ice_parser_profile_init
In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in ice_parser_profile_init set_bit(rslt->ptype, prof->ptypes) operates on a DECLARE_BITMAP of ICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF fr…
-
High 8.8
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: fix heap overflow on a short auth frame brcmf_notify_auth_frame_rx() takes the frame length from the firmware event and copies the frame body with the management header o…
-
High 8.4
net: wwan: t7xx: fix potential skb->frags overflow in RX path
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without check…
-
High 8.4
selinux: check connect-related permissions on TCP Fast Open
In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are ch…
-
High 8.4
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes f…
-
High 8.2
netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CL…
-
High 8.1
wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index (0-3/0-7) but r…
-
High 7.8
xfrm: hold dev ref until after transport_finish NF_HOOK
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold dev ref until after transport_finish NF_HOOK After async crypto completes, xfrm_input_resume() calls dev_put() immediately on re-entry before the skb reaches transport_finish. The …
-
High 7.8
RDMA/rxe: Fix race condition in QP timer handlers
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix race condition in QP timer handlers I encontered the following warning: WARNING: drivers/infiniband/sw/rxe/rxe_task.c:249 at rxe_sched_task+0x1c8/0x238 [rdma_rxe], CPU#0: swappe…
-
High 7.8
net: ena: PHC: Fix potential use-after-free in get_timestamp
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Fix potential use-after-free in get_timestamp Move the phc->active check and resp pointer assignment to after acquiring the spinlock. Previously, phc->active was checked withou…
-
High 7.8
ALSA: timer: Fix UAF at snd_timer_user_params()
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Fix UAF at snd_timer_user_params() At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the…
-
High 7.8
ALSA: timer: Forcibly close timer instances at closing
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Forcibly close timer instances at closing When snd_timer object is freed via snd_timer_free() and still pending snd_timer_instance objects are assigned to the timer object, it tr…
-
High 7.8
xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_…
-
High 7.8
ALSA: seq: Serialize UMP output teardown with event_input
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize UMP output teardown with event_input seq_ump_process_event() borrows client->out_rfile.output without synchronizing with the first-open and last-close transition in seq_u…
-
High 7.8
RDMA/rxe: Fix a use-after-free problem in rxe_mmap
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_…
-
High 7.8
ALSA: timer: don't re-enter an instance callback that is still running
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two thr…
-
High 7.8
dm_early_create: fix freeing used table on dm_resume failure
In the Linux kernel, the following vulnerability has been resolved: dm_early_create: fix freeing used table on dm_resume failure If dm_resume fails, the kernel attempts to free table with dm_table_destroy, but the table was already instantiated with dm_swap_t…
-
High 7.6
wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap When parsing the radiotap header of an injected frame, ieee80211_parse_tx_radiotap() uses the IEEE80211_RADIOTAP_AN…
-
High 7.5
RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads atomic_write_reply() at drivers/infiniband/sw/rxe/rxe_resp.c unconditionally dereferences 8 bytes at payload_addr(pkt): value = *(u64 *)paylo…
-
High 7.5
RDMA/rxe: Reject unknown opcodes before ICRC processing
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Reject unknown opcodes before ICRC processing Even after applying commit 7244491dab34 ("RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv"), a single unauthenticated …
-
High 7.5
wifi: iwlwifi: mld: stop TX during firmware restart
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: stop TX during firmware restart When iwlwifi firmware crashes (e.g., NMI_INTERRUPT_UNKNOWN on Intel BE201/Wi-Fi 7), iwl_mld_nic_error() sets mld->fw_status.in_hw_restart t…
-
Medium 6.8
USB: serial: io_ti: fix heap overflow in get_manuf_info()
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…
-
Unscored —
wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211_merge_profile() cfg80211_merge_profile() reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MB…
-
Unscored —
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request ath9k_hif_request_firmware() re-arms an asynchronous firmware load via request_firmware_nowait(), passing hif_…