Skip to content
OpenAdvisories
High ELSA-2026-98099 10 CVEs

Important: kernel security update (Oracle Linux 8)

Published Nov 11, 2026 · Updated Nov 11, 2026

Ecosystem: Oracle Linux

Summary

[4.18.0-553.185.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.185.1]
- scsi: libiscsi: Validate the task named by a management response (CKI Backport Bot) [RHEL-298434] {CVE-2026-99152}
- scsi: libiscsi: Validate the ITT reflected in a Reject PDU (CKI Backport Bot) [RHEL-298485] {CVE-2026-99153}
- s390/boot: Avoid IPL parameter append past command line (CKI Backport Bot) [RHEL-292341] {CVE-2026-98403}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-237021] {CVE-2026-68398}
- ALSA: seq: midi: Replace scoped_guard(rcu) with explicit rcu_read_lock (Jaroslav Kysela) [RHEL-282910]
- ALSA: seq: midi: Serialize input teardown with event_input (Jaroslav Kysela) [RHEL-282910]
- ALSA: seq: midi: Optimize event_input locking with RCU (Jaroslav Kysela) [RHEL-282910] {CVE-2026-90207}
- ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-282910]
- ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF (CKI Backport Bot) [RHEL-276104] {CVE-2026-98116}
- openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263792] {CVE-2026-68123}
- net: bridge: mcast: fix use-after-free of a master VLAN's multicast context (CKI Backport Bot) [RHEL-258677] {CVE-2026-80842}
- Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254633] {CVE-2026-74510}
- net/smc: Fix build errors after TCP ULP revert (Jan Polensky) [RHEL-227557] {CVE-2026-46330}
- libsubcmd: Fix use-after-free for realloc(..., 0) (Jan Polensky) [RHEL-227557] {CVE-2026-46330}
- Revert 'net/smc: Introduce TCP ULP support' (Jan Polensky) [RHEL-227557] {CVE-2026-46330}

Fixed packages 20

ReleasePackageFixed in
Oracle Linux · 8 bpftool 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-abi-stablelists 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-core 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-cross-headers 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-debug 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-debug-core 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-debug-devel 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-debug-modules 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-debug-modules-extra 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-devel 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-doc 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-headers 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-modules 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-modules-extra 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-tools 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-tools-libs 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 kernel-tools-libs-devel 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 perf 0:4.18.0-553.185.1.el8_10
Oracle Linux · 8 python3-perf 0:4.18.0-553.185.1.el8_10

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-68123

    openvswitch: fix GSO userspace truncation underflow

    In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-99153

    scsi: libiscsi: Validate the ITT reflected in a Reject PDU

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that copy to find the task to c…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-46330

    Revert "net/smc: Introduce TCP ULP support"

    In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The impl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-68398 Public exploit

    ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

    In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tp_recv() runs in the L2TP UDP-encap softirq RX path: l2tp_udp_encap_recv() -> l2tp_recv_common() -> pppol2tp_recv(…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2026-74510

    Bluetooth: mgmt: fix UAF in pair command cancellation

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix UAF in pair command cancellation The pairing completion and authentication failure callbacks look up the pending MGMT_OP_PAIR_DEVICE command by walking hdev->mgmt_pending…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-90207

    ALSA: seq: midi: Serialize input teardown with event_input

    In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with event_input snd_midi_input_event() must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming o…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-98116

    ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

    In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation with an mmap_count check performed under the PCM str…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-99152

    scsi: libiscsi: Validate the task named by a management response

    In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that the index resolved: case I…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-80842

    net: bridge: mcast: fix use-after-free of a master VLAN's multicast context

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: fix use-after-free of a master VLAN's multicast context br_multicast_toggle_one_vlan() clears BR_VLFLAG_MCAST_ENABLED under br->multicast_lock before stopping a VLAN's mul…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-98403

    s390/boot: Avoid IPL parameter append past command line

    In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size to…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux