Summary
[4.18.0-553.184.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.184.1]
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (Jan Polensky) [RHEL-298266] {CVE-2026-64541}
- s390/smp: Remove conditional emergency signal order code usage (Jan Polensky) [RHEL-298849]
- sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277071] {CVE-2026-52929}
- sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275359] {CVE-2026-74586}
- openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263524] {CVE-2026-89488}
- RDMA/rxe: Fix OOB in free_rd_atomic_resources() (Kamal Heib) [RHEL-256416] {CVE-2026-80863}
- RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (Kamal Heib) [RHEL-258544] {CVE-2026-80864}
- redhat: fix parallel make race between sources-rh and its inputs (Jan Stancek)
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-abi-stablelists | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-core | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-cross-headers | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-debug | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-core | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-devel | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-debug-modules-extra | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-devel | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-doc | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-headers | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-modules | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-modules-extra | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-tools | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | kernel-tools-libs-devel | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | perf | 0:4.18.0-553.184.1.el8_10 |
| Oracle Linux · 8 | python3-perf | 0:4.18.0-553.184.1.el8_10 |
Vulnerabilities 6
-
Critical 9.8
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences c…
-
Critical 9.8CVE-2026-74586 Public exploit
sctp: clear new_transport when removing a peer
In the Linux kernel, the following vulnerability has been resolved: sctp: clear new_transport when removing a peer sctp_process_asconf_param() stores a newly added peer transport in asoc->new_transport. After all parameters in the ASCONF chunk have been proce…
-
High 7.8
openvswitch: Fix CT limit teardown use-after-free
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither remo…
-
High 7.5
sctp: stream: fully roll back denied add-stream state
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, s…
-
Unscored —
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix OOB in free_rd_atomic_resources() free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the fr…
-
Unscored —
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp rxe_qp_from_attr() handles IB_QP_MAX_DEST_RD_ATOMIC outside the IB_QP_STATE path, so it holds no state_lock and runs while th…