Summary
[5.14.0-687.52.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.52.1]
- pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121}
- mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938]
- smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561]
- smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561]
- smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561]
- smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561]
- smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561]
- smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561]
- smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561]
- smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561]
- smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561]
- smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561]
- smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561]
- smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561]
- smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561]
- smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561]
- smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539}
- ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714}
- drm/amdgpu/userq: fix access to stale wptr mapping (Jose Exposito) [RHEL-225416] {CVE-2026-46311}
- drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Jose Exposito) [RHEL-225416]
- drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266}
- drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273}
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267}
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964]
- drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964]
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257}
- drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098}
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jose Exposito) [RHEL-225299]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jose Exposito) [RHEL-225299]
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225299] {CVE-2026-46230}
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jose Exposito) [RHEL-250107] {CVE-2025-40323}
- drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108}
- drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jose Exposito) [RHEL-225443]
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jose Exposito) [RHEL-225443] {CVE-2026-46199}
- netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912}
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203}
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.52.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.52.1.el9_8 |
Vulnerabilities 17
-
Critical 9.8
ipvs: do not propagate one-packet flag to synced conns
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connect…
-
High 8.8
drm/amdgpu/vce: fix integer overflow in image size
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions (e.g. 65536×65536) cause 32-bit integer overflow,…
-
High 7.8
fbcon: Set fb_display[i]->mode to NULL when the mode is released
In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0…
-
High 7.8
drm/amdgpu/userq: fix access to stale wptr mapping
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly. This fixes the security issue of unmap t…
-
High 7.8
netfilter: nf_queue: hold bridge skb->dev while queued
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only ho…
-
High 7.8
drm/xe/eustall: Fix drm_dev_put called before stream disable in close
In the Linux kernel, the following vulnerability has been resolved: drm/xe/eustall: Fix drm_dev_put called before stream disable in close In xe_eu_stall_stream_close(), drm_dev_put() is called before the stream is disabled and its resources are freed. If this…
-
High 7.8
drm/virtio: use uninterruptible resv lock for plane updates
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtio_gpu_cursor_plane_update() and virtio_gpu_resource_flush() lock the framebuffer BO's dma_resv via virtio_gpu_array_lock_resv(…
-
High 7.8CVE-2026-68121 Public exploit
pppoe: reload header pointer after dev_hard_header()
In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after dev_hard_header() pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate th…
-
High 7.8
drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation total_cwsr_size was computed in 32-bit before being used as a BO/SVM allocation size. With large ctx_save_restore_area_size and …
-
High 7.8
drm/xe: Hold a dma-buf reference for imported BOs
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Hold a dma-buf reference for imported BOs An imported dma-buf BO is created as a ttm_bo_type_sg BO whose reservation object is the exporter's dma_buf->resv. The importer, however, onl…
-
High 7.8
drm/amdgpu: Fix context pstate override handling
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferenc…
-
High 7.5
smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available
In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available The logic off managing recv credits by counting posted recv_io and granted credits is racy. That's because the peer might …
-
High 7.1
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
-
High 7.1
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.
-
High 7.1
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
-
High 7.1
accel/ivpu: Add buffer overflow check in MS get_info_ioctl
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS get_info_ioctl Add validation that the info size returned from the metric stream info query is not exceeded when checked against the allocated buff…
-
Unscored —
drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
In the Linux kernel, the following vulnerability has been resolved: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists Unconditionally whitelisting OA registers is a security violation. Set RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that …