Summary
[4.18.0-553.176.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.176.1]
- smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631}
- netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196}
- gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363]
- gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363]
- gfs2: Fix 'gfs2: Switch to wait_event in gfs2_quotad' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363]
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363]
- gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363]
- gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Rename 'gfs_recovery' workqueue to 'gfs2_recovery' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363]
- gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363]
- gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: fix infinite loop when checking ail item count before go_inval' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Allow some glocks to be used during withdraw' (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Check for log write errors before telling dlm to unlock' (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: fix a deadlock on withdraw-during-mount' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Simplify refcounting in do_xmote (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (6/6) (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Make recovery error more readable (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (5/6) (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (4/6) (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (3/6) (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (2/6) (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Force withdraw to replay journals and wait for it to finish' (1/6) (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Follow-up to flag rename in sysfs status file (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: don't stop reads while withdraw in progress' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Rename LM_FLAG_{NOEXP -> RECOVER} (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Mark the remaining process-independent glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Mark flock glock holders as GL_NOPID (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Kill gfs2_io_error_bh_wd (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Get rid of newlines in log messages (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Withdraw immediately on log write errors (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Sanitize kthread stopping (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Fix logd wakeup on I/O error (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Switch to wait_event in gfs2_quotad (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Switch to wait_event in gfs2_logd (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Remove duplicate check in do_xmote (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Remove space before newline (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Fix LM_FLAG_TRY* logic in add_to_queue (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Remove DLM_LKF_ALTCW / DLM_LKF_ALTPR code (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Further sanitize lock_dlm.c (Andreas Gruenbacher) [RHEL-129363]
- gfs2: sanitize the gdlm_ast -> finish_xmote interface (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Simplify DLM_LKF_QUECVT use (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Fix freeze consistency check in log_write_header (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Get rid of delayed withdraws (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Lift withdraw check out of gfs2_ail1_empty (Andreas Gruenbacher) [RHEL-129363]
- gfs2: don't withdraw if init_
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.176.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.176.1.el8_10 |
Vulnerabilities 9
-
Critical 9.8
sctp: keep chunk->transport in step with the list it is queued on
In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk->transport in step with the list it is queued on __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport: …
-
Critical 9.8
sctp: validate cookie AUTH state before use
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM len…
-
Critical 9.8
sctp: stop processing a packet once its association is deleted
In the Linux kernel, the following vulnerability has been resolved: sctp: stop processing a packet once its association is deleted sctp_endpoint_bh_rcv() looks the association up only when chunk->asoc is NULL, and caches the result in chunk->asoc and chunk->t…
-
Critical 9.1
smb: client: reject a tree connect response whose byte count is too small
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon() bounds its strnlen() over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 …
-
High 7.8
xfrm: espintcp: do not reuse an in-progress partial send
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: do not reuse an in-progress partial send espintcp keeps a single in-flight transmit in ctx->partial. Before building a new sk_msg, espintcp_sendmsg() first tries to flush that…
-
High 7.8
netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grac…
-
High 7.8
perf: Fix addr_filter_ranges lifetime
In the Linux kernel, the following vulnerability has been resolved: perf: Fix addr_filter_ranges lifetime Lee Jia Jie reported that since event::addr_filter_ranges is used under RCU, it should be RCU freed.
-
High 7.8
netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from…
-
Medium 6.8
USB: serial: io_ti: fix heap overflow in get_manuf_info()
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in get_manuf_info() get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which…