Summary
[6.12.0-211.72.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-211.72.1]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295608] {CVE-2026-98432}
- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-230757] {CVE-2026-46174}
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (CKI Backport Bot) [RHEL-291348]
- netfilter: conntrack: make filtering by zone discoverable (CKI Backport Bot) [RHEL-291348]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (CKI Backport Bot) [RHEL-291348]
- netlink: specs: fix the conntrack filter type (CKI Backport Bot) [RHEL-291348]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (CKI Backport Bot) [RHEL-291348]
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277962] {CVE-2026-98364}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273184] {CVE-2026-74283}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271405] {CVE-2026-89603}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-248847] {CVE-2026-68398}
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (CKI Backport Bot) [RHEL-189611] {CVE-2026-22977}
[6.12.0-211.71.1]
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290598] {CVE-2026-98725}
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291156]
- smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara) [RHEL-278330] {CVE-2026-93787}
[6.12.0-211.70.1]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285628] {CVE-2026-90011}
- virtio-fs: avoid double-free on failed queue setup (CKI Backport Bot) [RHEL-278134] {CVE-2026-93827}
- KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279482] {CVE-2026-98222}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250579] {CVE-2026-80586}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236704] {CVE-2026-68169}
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Always flush vpid02 on first use (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-270721]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-270721]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-270702]
Fixed packages 30
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | kernel | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-abi-stablelists | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-core | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-cross-headers | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-core | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-devel-matched | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-core | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-modules-extra | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-debug-uki-virt | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-devel | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-devel-matched | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-doc | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-headers | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-modules | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-core | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-modules-extra-matched | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-tools | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-tools-libs-devel | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | kernel-uki-virt-addons | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | libperf | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | perf | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | python3-perf | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | rtla | 0:6.12.0-211.72.1.el10_2 |
| Oracle Linux · 10 | rv | 0:6.12.0-211.72.1.el10_2 |
Vulnerabilities 16
-
Critical 9.8
mptcp: options: reset DSS fields in case of unexpected size
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboptio…
-
Critical 9.8CVE-2026-98432 Public exploit
ipv4: free inet_opt and ireq_opt after an RCU grace period
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu…
-
Critical 9.1
scsi: target: iscsi: Reserve a terminator byte for the login payload
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Reserve a terminator byte for the login payload iscsi_target_check_login_request() rejects a login PDU whose DataSegmentLength exceeds MAX_KEY_VALUE_PAIRS, but the test i…
-
High 8.8
x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache Make sure resources are not improperly shared in the op cache and cause instruction corruption this way.
-
High 8.8
KVM: nVMX: Always flush vpid02 on first use
In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Always flush vpid02 on first use Make sure vpid02 is always flushed on first use by setting last_vpid=0 when allocating vpid02. nested_vmx_transition_tlb_flush() will always detect…
-
High 8.4CVE-2026-89603 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
High 8.4
virtio-fs: avoid double-free on failed queue setup
In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtio_fs_setup_vqs() allocates fs->vqs and fs->mq_map before calling virtio_find_vqs(). If virtio_find_vqs() fails, the error path frees bo…
-
High 8.1
smb: client: bound dirent name against end of SMB response in cifs_filldir
In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifs_filldir cifs_filldir() copies the entry name out of an SMB1 TRANS2_FIND_FIRST / FIND_NEXT response using a length (de.namele…
-
High 7.8
i2c: stub: Reject I2C block transfers with invalid length
In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid length The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0] as the transfer length. The existing check only clamps it to avo…
-
High 7.8CVE-2026-68398 Public exploit
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF
In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv(…
-
High 7.8
tipc: require net admin for TIPCv2 netlink mutators
In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an oper…
-
High 7.8
xfrm: hold net_device reference under RCU in bundle creation
In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pas…
-
Unscored —
net: sock: fix hardened usercopy panic in sock_recv_errqueue
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[…
-
Unscored —
mptcp: pm: userspace: fix use-after-free in get_local_id
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: userspace: fix use-after-free in get_local_id In mptcp_pm_userspace_get_local_id(), the address entry is looked up under spinlock, but its id is read after dropping the lock. A con…
-
Unscored —
KEYS: encrypted: fix integer overflow of datablob_len
In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of datablob_len encrypted_key_alloc() stores datablob_len in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16_MA…
-
Unscored —
nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() nvmet_auth_challenge() receives its output buffer as a void pointer. sizeof(*d) therefore evaluates to one with GCC and undercoun…