Summary
[4.18.0-553.170.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.170.1]
- keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349]
- Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136]
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099}
- net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329}
- liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368]
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299}
- RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102}
[4.18.0-553.169.1]
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034}
- arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875}
- perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753}
- perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556}
- drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273}
- drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710]
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309]
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430]
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204}
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024]
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323}
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159}
- libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159}
- ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942}
- libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155}
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156}
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.170.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.170.1.el8_10 |
Vulnerabilities 13
-
Critical 9.8
libceph: refresh auth->authorizer_buf{,_len} after authorizer update
In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cach…
-
Critical 9.8
libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to overflow the allocation; it …
-
Critical 9.3
net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer In mana_hwc_rx_event_handler(), resp->response.hwc_msg_id is read from DMA-coherent memory and bounds-checked, then mana_hwc_h…
-
High 7.8
fbcon: Set fb_display[i]->mode to NULL when the mode is released
In the Linux kernel, the following vulnerability has been resolved: fbcon: Set fb_display[i]->mode to NULL when the mode is released Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0…
-
High 7.8
ext4: fix e4b bitmap inconsistency reports
In the Linux kernel, the following vulnerability has been resolved: ext4: fix e4b bitmap inconsistency reports A bitmap inconsistency issue was observed during stress tests under mixed huge-page workloads. Ext4 reported multiple e4b bitmap check failures like…
-
High 7.8
arm64: tlb: Flush walk cache when unsharing PMD tables
In the Linux kernel, the following vulnerability has been resolved: arm64: tlb: Flush walk cache when unsharing PMD tables When huge_pmd_unshare() is called to unshare a PMD table, the tlb_unshare_pmd_ptdesc() function sets tlb->unshared_tables=true but the a…
-
High 7.8
perf/core: Detach event groups during remove_on_exec
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the conte…
-
High 7.8
drm/amdgpu: Fix context pstate override handling
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix context pstate override handling There are several problems in the context pstate handling code. The most serious ones are potential use-after-free and NULL pointer dereferenc…
-
High 7.8
perf: Reject exited events as group leaders
In the Linux kernel, the following vulnerability has been resolved: perf: Reject exited events as group leaders perf_event_remove_on_exec() sets remove-on-exec events to the EXIT state and detaches their group relationships. The event's file descriptor can re…
-
High 7.5
libceph: Reject monmaps advertising zero monitors
In the Linux kernel, the following vulnerability has been resolved: libceph: Reject monmaps advertising zero monitors A message of type CEPH_MSG_MON_MAP contains a monmap that is sent from a monitor to the client. This monmap contains information about the ex…
-
High 7.1
drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.
-
High 7.1
drm/amdgpu/vcn4: Prevent OOB reads when parsing IB
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB Rewrite the IB parsing to use amdgpu_ib_get_value() which handles the bounds checks.
-
High 7.1
drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg.