Summary
[4.18.0-553.178.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.178.1]
- selinux: avoid sk_socket dereference in selinux_sctp_bind_connect() (Ondrej Mosnacek) [RHEL-243220] {CVE-2026-72242}
- ipv4: validate checksum_start before completing checksum (Davide Caratti) [RHEL-280584] {CVE-2026-99999}
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (Jorge San Emeterio Villalain) [RHEL-271260] {CVE-2026-89638}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250583] {CVE-2026-80586}
- net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270897] {CVE-2026-81003}
- net/packet: avoid fanout hook re-registration after unregister (Jamie Bainbridge) [RHEL-246978] {CVE-2026-68338}
- net/packet: fix a race in packet_set_ring() and packet_notifier() (Jamie Bainbridge) [RHEL-246978]
- net/packet: annotate accesses to po->bind (Jamie Bainbridge) [RHEL-246978]
- net: gro: fix double aggregation of flush-marked skbs (Jamie Bainbridge) [RHEL-242641] {CVE-2026-68136}
- tcp: restrict SO_ATTACH_FILTER to priv users (Jamie Bainbridge) [RHEL-257722] {CVE-2026-53236}
- net: use sk_is_tcp() in more places (Jamie Bainbridge) [RHEL-257722]
- fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226080] {CVE-2026-53388}
- fuse: release pipe buf after last use (Miklos Szeredi) [RHEL-226080] {CVE-2026-53388}
- fuse: fix page stealing (Miklos Szeredi) [RHEL-226080] {CVE-2026-53388}
- ipvs: reload ip header after head reallocation (Phil Sutter) [RHEL-263780] {CVE-2026-68476}
- net/sched: serialize qdisc_rtab_list against concurrent get/put (CKI Backport Bot) [RHEL-266389] {CVE-2026-68138}
- net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260491] {CVE-2026-68140}
- writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() (CKI Backport Bot) [RHEL-260517] {CVE-2026-64378}
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258546] {CVE-2026-80824}
[4.18.0-553.177.1]
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270905] {CVE-2026-89777}
- ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263644] {CVE-2026-68202}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254200] {CVE-2026-80590}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233134] {CVE-2026-64572}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225459] {CVE-2026-64114}
- xfs: bounds-check buffer log item's dirty bitmap (CKI Backport Bot) [RHEL-253365] {CVE-2026-80536}
- fuse: re-lock request before returning from fuse_ref_folio() (CKI Backport Bot) [RHEL-234242] {CVE-2026-64266}
[4.18.0-553.176.1]
- smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271288] {CVE-2026-89631}
- netfilter: flowtable: hold reference on ct until flow is released (CKI Backport Bot) [RHEL-280060] {CVE-2026-98320}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271853] {CVE-2026-93817}
- USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191034] {CVE-2026-53195}
- USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191034] {CVE-2026-53196}
- gfs2: a minor finish_xmote cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Minor run_queue fixes (Andreas Gruenbacher) [RHEL-129363]
- gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: only apply DLM_LKF_VALBLK if sb_lvbptr is not NULL (Alexander Aring) [RHEL-129363]
- gfs2: Fix 'gfs2: Switch to wait_event in gfs2_quotad' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Use wait_event_freezable_timeout() for freezable kthread (Andreas Gruenbacher) [RHEL-129363]
- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-129363]
- gfs2: low-memory forced flush fixes (Andreas Gruenbacher) [RHEL-129363]
- gfs2: add missing withdraw locking (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Disable GL_NOPID (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Rename 'gfs_recovery' workqueue to 'gfs2_recovery' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Clean up SDF_JOURNAL_LIVE flag handling (Andreas Gruenbacher) [RHEL-129363]
- gfs2: No longer thaw filesystems during a withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: gfs2_freeze_unlock cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Refcounting fix in gfs2_thaw_super (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Minor gfs2_{freeze,thaw}_super cleanup (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Withdraw immediately in gfs2_trans_add_meta (Andreas Gruenbacher) [RHEL-129363]
- gfs2: New gfs2_withdraw_helper (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Clean up properly during a withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Simplify do_promote (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Rename gfs2_{gl_dq_holders => withdraw_glocks} (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: fix infinite loop when checking ail item count before go_inval' (Andreas Gruenbacher) [RHEL-129363]
- gfs2: introduce new gfs2_glock_assert_withdraw (Andreas Gruenbacher) [RHEL-129363]
- gfs2: Get rid of GLF_INVALIDATE_IN_PROGRESS (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Allow some glocks to be used during withdraw' (Andreas Gruenbacher) [RHEL-129363]
- Revert 'gfs2: Check for log write errors before telling dlm to unlock' (Andreas Gruenbach
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.178.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.178.1.el8_10 |
Vulnerabilities 13
-
Critical 9.8
net: gro: fix double aggregation of flush-marked skbs
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive…
-
Critical 9.8
ipvs: reload ip header after head reallocation
In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation __ip_vs_get_out_rt() calls skb_ensure_writable() which may reallocate skb->head.
-
Critical 9.8
mptcp: options: reset DSS fields in case of unexpected size
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…
-
Critical 9.3CVE-2026-99999 Public exploit
ipv4: validate checksum_start before completing checksum
In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of…
-
High 8.8
net/iucv: fix use-after-free of a severed iucv_path
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When th…
-
High 8.1
net/iucv: filter frames in afiucv_hs_rcv() by ingress device
In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is …
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs()
In the Linux kernel, the following vulnerability has been resolved: writeback: fix race between cgroup_writeback_umount() and inode_switch_wbs() When a container exits, the following BUG_ON() is occasionally triggered: ========================================…
-
High 7.8CVE-2026-68138 Public exploit
net/sched: serialize qdisc_rtab_list against concurrent get/put
In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdisc_rtab_list against concurrent get/put qdisc_get_rtab() and qdisc_put_rtab() mutate the process-global singly linked list qdisc_rtab_list and a plain non-atomic 'int …
-
High 7.8
net/packet: avoid fanout hook re-registration after unregister
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous runni…
-
High 7.8
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a …
-
Unscored —
tcp: restrict SO_ATTACH_FILTER to priv users
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel …
-
Unscored —
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…