Summary
[5.14.0-687.56.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.56.1]
- ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201]
- ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201]
- ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201]
- ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201]
- redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014]
- rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014]
- nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690}
- svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530}
- nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669}
- nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663}
- nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152]
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152]
- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398}
- SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317}
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246]
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246]
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744}
- ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
- sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279]
- sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279]
- vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
- vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291}
- idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286}
- idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162}
- idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647}
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577]
- vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115}
- igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480]
[5.14.0-687.55.1]
- dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410]
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892]
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backpo
Fixed packages 29
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-abi-stablelists | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-core | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-cross-headers | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-core | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-devel-matched | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-core | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-modules-extra | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-debug-uki-virt | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-devel | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-devel-matched | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-doc | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-headers | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-modules | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-core | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-modules-extra | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-tools | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-tools-libs-devel | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | kernel-uki-virt-addons | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | libperf | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | perf | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | python3-perf | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | rtla | 0:5.14.0-687.56.1.el9_8 |
| Oracle Linux · 9 | rv | 0:5.14.0-687.56.1.el9_8 |
Vulnerabilities 38
-
Critical 9.8
netfilter: nf_conntrack_sip: don't use simple_strtoul
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: don't use simple_strtoul Replace unsafe port parsing in epaddr_len(), ct_sip_parse_header_uri(), and ct_sip_parse_request() with a new sip_parse_port() helper tha…
-
Critical 9.8
gfs2: add some missing log locking
In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but…
-
Critical 9.8
ipv6: exthdrs: refresh nh after handling HAO option
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6_parse_tlv() caches skb_network_header(skb) in nh while walking IPv6 TLVs. ipv6_dest_hao() may call pskb_expand_head() for a cloned skb,…
-
Critical 9.8
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()
In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess…
-
Critical 9.8
ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()
In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the r…
-
Critical 9.8
vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()
In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() skb_tunnel_check_pmtu() can change skb->head. Reusing old_iph afer skb_tunnel_check_pmtu() can cause an UAF. Use instea…
-
Critical 9.8
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() Sashiko found that iptunnel_pmtud_build_icmp() and iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv…
-
Critical 9.8
smb: client: fix double-free in SMB2_ioctl() replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_ioctl() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_ioctl_init() fails before the next send, cle…
-
Critical 9.8
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdi…
-
Critical 9.8
ipvs: clear IPv4 options after rebasing tunnel ICMP errors
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear IPv4 options after rebasing tunnel ICMP errors ip_vs_in_icmp() rebases an skb from the outer ICMP packet to the quoted original request before passing it to icmp_send(). However, …
-
Critical 9.8
netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe an…
-
Critical 9.8
nvme: add missing SRCU grace period in error path
In the Linux kernel, the following vulnerability has been resolved: nvme: add missing SRCU grace period in error path nvme_alloc_ns() error path at out_unlink_ns removes ns from the namespace head siblings list with list_del_rcu(&ns->siblings) but does not wa…
-
Critical 9.3
KVM: arm64: vgic: Check the interrupt is still ours before migrating it
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Check the interrupt is still ours before migrating it vgic_prune_ap_list() drops both ap_list_lock and irq_lock while migrating an interrupt to another vCPU. After reacquiri…
-
Critical 9.1
tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() In some cases, iptunnel_pmtud_check_icmp() can be called while skb transport header is not set. This triggers an out-of-…
-
High 8.8
KVM: arm64: Reassign nested_mmus array behind mmu_lock
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Reassign nested_mmus array behind mmu_lock kvm->arch.nested_mmus[] is walked under kvm->mmu_lock, including from the MMU notifier path (kvm_unmap_gfn_range() -> kvm_nested_s2_unma…
-
High 8.8
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the tunnel link netns t->net. They differ once the …
-
High 8.8
Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock is dropped t…
-
High 8.8
vxlan: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: vxlan: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns vxlan->net. They differ once th…
-
High 8.8
net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink ip6gre_changelink() and ip6erspan_changelink() operate on at most two netns, dev_net(dev) and the tunnel link netns t->n…
-
High 8.8
KVM: s390: vsie: zero stale crypto bits
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 are unchanged from whatever is in the vsie page in the crycb and…
-
High 8.2
KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a sep…
-
High 8.0
Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning…
-
High 7.9
KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabl…
-
High 7.8
tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock().
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's u…
-
High 7.8
thermal: core: Fix thermal zone device registration error path
In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone device registration error path If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal…
-
High 7.8
gfs2: Fix slab-use-after-free in qd_put
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting th…
-
High 7.8
Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free (UAF) and Null Pointer Dereference (NPD) conditions were observed in the li…
-
High 7.8
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). …
-
High 7.8
nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
In the Linux kernel, the following vulnerability has been resolved: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() Unlike IO_CMD / IO64_CMD, NVME_IOCTL_SUBMIT_IO never calls nvme_cmd_allowed(). Unprivileged callers can thus issue I/O on a partition devic…
-
High 7.8
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grac…
-
High 7.5
nvme-tcp: reject a read that transferred too few bytes
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received again…
-
High 7.5
nvme-tcp: fix host memory disclosure on R2T for a read command
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for …
-
High 7.5
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() The timestamp-only fast path dereferences the option stream as *(__be32 *)ptr, which assumes 4-byte alignment that the TCP opti…
-
High 7.1
netfilter: nf_log: validate MAC header was set before dumping it
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: validate MAC header was set before dumping it The fallback path of dump_mac_header() guards the MAC header access only with "skb->mac_header != skb->network_header", withou…
-
High 7.1
ipv6: validate extension header length before copying to cmsg
In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6_datagram_recv_specific_ctl() builds IPV6_{HOPOPTS,DSTOPTS,RTHDR} cmsgs (and their IPV6_2292* legacy counterparts) by trusting…
-
High 7.1
dm-integrity: don't increment hash_offset twice
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: don't increment hash_offset twice hash_offset is already incremented in the loop "for (i = 0; i < to_copy; i++, ts--)". Do not increment it again.
-
Unscored —
ipv6: add NULL checks for idev in SRv6 paths
In the Linux kernel, the following vulnerability has been resolved: ipv6: add NULL checks for idev in SRv6 paths __in6_dev_get() can return NULL when the device has no IPv6 configuration (e.g. MTU < IPV6_MIN_MTU or after NETDEV_UNREGISTER). Add NULL checks fo…
-
Unscored —
ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or ot…