Skip to content
OpenAdvisories
Medium ELSA-2026-99015 10 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 12, 2026 · Updated Nov 12, 2026

Ecosystem: Oracle Linux

Summary

[4.18.0-553.186.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.186.1]
- net/smc: protect clcsock lifetime in smc_getname (CKI Backport Bot) [RHEL-303989] {CVE-2026-99032}
- scsi: st: Fix use-after-free race between st_remove() and st_open() (CKI Backport Bot) [RHEL-303904] {CVE-2026-99156}
- gfs2: Minor error message improvement (Andreas Gruenbacher) [RHEL-298310]
- gfs2: Don't BUG during a withdraw (Andreas Gruenbacher) [RHEL-298310]
- gfs2: Move state2str (Andreas Gruenbacher) [RHEL-298310]
- drm/amdkfd: fix SMI event cross-process information leak (Anusha Srivatsa) [RHEL-287311] {CVE-2026-97422}
- drm/amdgpu: fix buffer overflow during vBIOS update (CKI Backport Bot) [RHEL-278271] {CVE-2026-97425}
- drm/amdgpu: Bound GPIO I2C table entry count from VBIOS (CKI Backport Bot) [RHEL-278259] {CVE-2026-97493}
- drm/amdgpu/atombios: drop empty function (CKI Backport Bot) [RHEL-278259] {CVE-2026-97493}
- drm/amdkfd: Check bounds on allocate_doorbell (CKI Backport Bot) [RHEL-278229] {CVE-2026-97495}
- drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw (CKI Backport Bot) [RHEL-278226] {CVE-2026-97494}
- drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id (CKI Backport Bot) [RHEL-278208] {CVE-2026-97497}
- drm/amd/pm: bound pp_dpm_set_pp_table() memcpy (CKI Backport Bot) [RHEL-278186] {CVE-2026-97427}
- drm/amdkfd: hold event_mutex while checkpointing CRIU events (CKI Backport Bot) [RHEL-273848] {CVE-2026-74446}
- xfs, iomap: limit individual ioend chain lengths in writeback (Brian Foster) [RHEL-258946]

Fixed packages 20

ReleasePackageFixed in
Oracle Linux · 8 bpftool 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-abi-stablelists 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-core 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-cross-headers 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-debug 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-debug-core 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-debug-devel 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-debug-modules 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-debug-modules-extra 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-devel 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-doc 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-headers 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-modules 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-modules-extra 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-tools 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-tools-libs 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 kernel-tools-libs-devel 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 perf 0:4.18.0-553.186.1.el8_10
Oracle Linux · 8 python3-perf 0:4.18.0-553.186.1.el8_10

Vulnerabilities 10

  • High 7.8
    CVE-2026-74446

    drm/amdkfd: hold event_mutex while checkpointing CRIU events

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: hold event_mutex while checkpointing CRIU events kfd_criu_checkpoint_events() counts the entries in p->event_idr via kfd_get_num_events(), allocates an array sized to that count, …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-97497

    drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id allocate_sdma_queue has an option where the sdma queue id can be specified (used by CRIU). We weren't bounds-checking that val…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-99032

    net/smc: protect clcsock lifetime in smc_getname

    In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_cl…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-99156

    scsi: st: Fix use-after-free race between st_remove() and st_open()

    In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes its index from st_index_…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97422

    drm/amdkfd: fix SMI event cross-process information leak

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix SMI event cross-process information leak kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97425

    drm/amdgpu: fix buffer overflow during vBIOS update

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix buffer overflow during vBIOS update Clamp the buffer postion to write by setting the bin attribute to the maximum buffer size so that VFS layer will block the out-of-bounds ac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97427

    drm/amd/pm: bound pp_dpm_set_pp_table() memcpy

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: bound pp_dpm_set_pp_table() memcpy The powerplay path allocates hardcode_pp_table once with kmemdup(..., soft_pp_table_size). memcpy(..., size) used the sysfs store count (up to P…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97493

    drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[] or walk an absurd n…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97494

    drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw Change psp_copy_fw from void to int: return -ENODEV when drm_dev_enter fails, and -EINVAL when the image size is zero or l…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2026-97495

    drm/amdkfd: Check bounds on allocate_doorbell

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocate_doorbell allocated_doorbell has an option to set the doorbell id to a specific value (used by CRIU). This value was not bounds checked. Check to confirm i…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux