Summary
[6.12.0-211.69.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-211.69.1]
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283521] {CVE-2026-72083}
- md/raid5-ppl: fix use-after-free in ppl_do_flush() (Nigel Croxon) [RHEL-278085] {CVE-2026-93262}
- KVM: s390: pci: Reject adapter interrupt forwarding if already enabled (CKI Backport Bot) [RHEL-277647] {CVE-2026-74515}
- vfio/pci: clear vdev->msi_perm after freeing it on init failure (Rodolfo Vick) [RHEL-270937] {CVE-2026-89777}
- smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (Jorge San Emeterio Villalain) [RHEL-271266] {CVE-2026-89638}
- net/handshake: Drain pending requests at net namespace exit (Xin Long) [RHEL-232133] {CVE-2026-63978}
- net/handshake: Use spin_lock_bh for hn_lock (Xin Long) [RHEL-232133]
- net/handshake: hand off the pinned file reference to accept_doit (Xin Long) [RHEL-230367] {CVE-2026-63979}
- net/handshake: Take a long-lived file reference at submit (Xin Long) [RHEL-234161] {CVE-2026-64523}
- x86/microcode: Add platform mask to Intel microcode 'old' list (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/cpu: Add platform ID to CPU matching structure (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/cpu: Add platform ID to CPU info structure (Luis Claudio R. Goncalves) [RHEL-212778]
- x86/microcode: Refactor platform ID enumeration into a helper (Luis Claudio R. Goncalves) [RHEL-212778]
- fuse: re-lock request before replacing page cache folio (Miklos Szeredi) [RHEL-226096] {CVE-2026-53388}
- sched_ext: Fix possible deadlock in the deferred_irq_workfn() (CKI Backport Bot) [RHEL-259937]
- sched_ext: Fix unsafe locking in the scx_dump_state() (CKI Backport Bot) [RHEL-259937]
- net: shaper: rework the VALID marking (again) (Jamie Bainbridge) [RHEL-231705] {CVE-2026-64027}
- net: shaper: annotate the data races (Jamie Bainbridge) [RHEL-231705]
- net: shaper: fix trivial ordering issue in net_shaper_commit() (Jamie Bainbridge) [RHEL-231705]
- net: shaper: flip the polarity of the valid flag (Jamie Bainbridge) [RHEL-231705]
- net: shaper: protect late read accesses to the hierarchy (Jamie Bainbridge) [RHEL-231705]
- net/packet: avoid fanout hook re-registration after unregister (Jamie Bainbridge) [RHEL-246967] {CVE-2026-68338}
- af_unix: Fix UAF read of tail->len in unix_stream_data_wait() (Jamie Bainbridge) [RHEL-225883] {CVE-2026-64109}
- af_unix: Cache state->msg in unix_stream_read_generic(). (Jamie Bainbridge) [RHEL-225883]
- net: gro: fix double aggregation of flush-marked skbs (Jamie Bainbridge) [RHEL-242620] {CVE-2026-68136}
- tcp: restrict SO_ATTACH_FILTER to priv users (Jamie Bainbridge) [RHEL-257741] {CVE-2026-53236}
- usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CKI Backport Bot) [RHEL-258583] {CVE-2026-80824}
- net: smc: fix splice entry lifetime imbalance in smc_rx_splice (CKI Backport Bot) [RHEL-253457] {CVE-2026-74631}
- ipv4: fib: fix route re-dump in inet_dump_fib() on multi-batch dump (Felix Maurer) [RHEL-245489]
- ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump (Felix Maurer) [RHEL-245489]
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | libperf | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | perf | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | rtla | 0:6.12.0-211.69.1.el10_2 |
| Oracle Linux · 10 | rv | 0:6.12.0-211.69.1.el10_2 |
Vulnerabilities 16
-
Critical 9.8
net/handshake: Drain pending requests at net namespace exit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->h…
-
Critical 9.8
net/handshake: hand off the pinned file reference to accept_doit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() rea…
-
Critical 9.8
net/handshake: Take a long-lived file reference at submit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() an…
-
Critical 9.8
net: gro: fix double aggregation of flush-marked skbs
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 ("net-gro: Fix GRO flush when receiving a GSO packet.") added a flush check to skb_gro_receive(), but skb_gro_receive…
-
Critical 9.8
scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE core_scsi3_emulate_pro_register_and_move() maps the PERSISTENT RESERVE OUT parameter list with transport_kmap_data_sg() …
-
High 8.8
af_unix: Fix UAF read of tail->len in unix_stream_data_wait()
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from …
-
High 8.8
KVM: s390: pci: Reject adapter interrupt forwarding if already enabled
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Reject adapter interrupt forwarding if already enabled The MPCIFC instruction doesn't allow registering adapter interrupts without first unregistering. So reject any request t…
-
High 8.8
vfio/pci: clear vdev->msi_perm after freeing it on init failure
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: clear vdev->msi_perm after freeing it on init failure vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KER…
-
High 8.4
net: smc: fix splice entry lifetime imbalance in smc_rx_splice
In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smc_rx_splice smc_rx_splice() passes pages to splice_to_pipe() before taking the references that cover the lifetime of each splice entry. In t…
-
High 7.8
fuse: re-lock request before replacing page cache folio
In the Linux kernel, the following vulnerability has been resolved: fuse: re-lock request before replacing page cache folio fuse_try_move_folio() unlocks the request on entry but does not re-lock it on the success path. This means fuse_chan_abort() can end th…
-
High 7.8
net: shaper: rework the VALID marking (again)
In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. …
-
High 7.8
net/packet: avoid fanout hook re-registration after unregister
In the Linux kernel, the following vulnerability has been resolved: net/packet: avoid fanout hook re-registration after unregister packet_set_ring() temporarily detaches a socket from packet delivery while reconfiguring its ring. It records the previous runni…
-
High 7.8
smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a …
-
High 7.8
md/raid5-ppl: fix use-after-free in ppl_do_flush()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after…
-
Unscored —
tcp: restrict SO_ATTACH_FILTER to priv users
In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SO_ATTACH_FILTER to priv users This patch restricts the use of SO_ATTACH_FILTER (cBPF) on TCP sockets to users with CAP_NET_ADMIN capability. This blocks potential side-channel …
-
Unscored —
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
In the Linux kernel, the following vulnerability has been resolved: usb: usbfs: fix use-after-free of usb_device in usbdev_release() usbdev_release() drops its reference to the struct usb_device before draining the list of completed async URBs, but that drain…