Summary
[5.14.0-687.51.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.51.1]
- net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844}
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846}
- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534}
- af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005}
- smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383}
- RHEL: revert 'block: only zero non-PI metadata tuples in bio_integrity_prep' (Jeff Moyer) [RHEL-189969] {CVE-2026-23007}
- block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053}
- blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802}
- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261}
- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634]
- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634]
- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634]
- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634]
- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634]
- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006}
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134}
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218}
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267}
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212}
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970}
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324}
- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634]
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998}
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665}
- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416}
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351}
- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206}
- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634]
- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-4
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.51.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.51.1.el9_8 |
Vulnerabilities 13
-
Critical 9.8
smb: client: fix double-free in SMB2_flush() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_flush() replay SMB2_flush() keeps its response buffer bookkeeping across replay attempts. If a replayable flush response is received and the retry then fa…
-
Critical 9.8
nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally.…
-
Critical 9.8CVE-2026-64564 Public exploit
sctp: don't free the ASCONF's own transport in DEL-IP processing
In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, se…
-
Critical 9.1
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read In qla2x00_status_entry(), the FWI2 status path advances sense_data and shrinks par_sense_len by rsp_info_len: if (IS_FWI2_CAPAB…
-
High 8.8
mac802154: llsec: add skb_cow_data() before in-place crypto
In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb_cow_data() before in-place crypto llsec_do_encrypt_unauth(), llsec_do_encrypt_auth(), llsec_do_decrypt_unauth(), and llsec_do_decrypt_auth() all perform in-place cry…
-
High 7.8
af_unix: Drop all SCM attributes for SOCKMAP.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the …
-
High 7.8
blk-cgroup: fix UAF in __blkcg_rstat_flush()
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix UAF in __blkcg_rstat_flush() When multiple blkgs in the same blkcg are released concurrently, a use-after-free can occur. The race happens when one blkg's __blkcg_rstat_flush(…
-
High 7.8
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
In the Linux kernel, the following vulnerability has been resolved: block: don't overwrite bip_vcnt in bio_integrity_copy_user() bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max…
-
High 7.8
ALSA: timer: drain a slave's callback before its master detaches it
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: drain a slave's callback before its master detaches it snd_timer_close_locked() drains the closing instance's own in-flight callback (IFLG_CALLBACK) before freeing it, but not it…
-
High 7.8
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control In snd_sof_update_control(), firmware-provided cdata->num_elems is checked against local_cdata->data->size but never against t…
-
High 7.8CVE-2026-81000 Public exploit
net: tun: bound receive headroom
In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…
-
Unscored —CVE-2026-23007 Public exploit
block: zero non-PI portion of auto integrity buffer
In the Linux kernel, the following vulnerability has been resolved: block: zero non-PI portion of auto integrity buffer The auto-generated integrity buffer for writes needs to be fully initialized before being passed to the underlying block device, otherwise …
-
Unscored —CVE-2026-80844 Public exploit
xfrm: ah6: validate routing header segments_left
In the Linux kernel, the following vulnerability has been resolved: xfrm: ah6: validate routing header segments_left AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger…