ELSA-2026-36957

Опубликовано: 10 июл. 2026

Источник: oracle-oval

Платформа: Oracle Linux 9

Описание

ELSA-2026-36957: kernel security update (IMPORTANT)

[5.14.0-687.24.1]

Disable UKI signing [Orabug: 36571828]
Update Oracle Linux certificates (Kevin Lyons)
Disable signing for aarch64 (Ilya Okomin)
Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
Update x509.genkey [Orabug: 24817676]
Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
Add Oracle Linux IMA certificates
Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.24.1]

KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}

[5.14.0-687.23.1]

eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
epoll: annotate racy check (Ian Kent) [RHEL-180773]
netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]

Обновленные пакеты

Oracle Linux 9

Oracle Linux aarch64

kernel-cross-headers

5.14.0-687.24.1.el9_8

kernel-tools-libs-devel

5.14.0-687.24.1.el9_8

libperf

5.14.0-687.24.1.el9_8

kernel-tools

5.14.0-687.24.1.el9_8

kernel-tools-libs

5.14.0-687.24.1.el9_8

kernel-headers

5.14.0-687.24.1.el9_8

perf

5.14.0-687.24.1.el9_8

python3-perf

5.14.0-687.24.1.el9_8

rtla

5.14.0-687.24.1.el9_8

Oracle Linux x86_64

kernel

5.14.0-687.24.1.el9_8

kernel-abi-stablelists

5.14.0-687.24.1.el9_8

kernel-core

5.14.0-687.24.1.el9_8

kernel-debug

5.14.0-687.24.1.el9_8

kernel-debug-core

5.14.0-687.24.1.el9_8

kernel-debug-modules

5.14.0-687.24.1.el9_8

kernel-debug-modules-core

5.14.0-687.24.1.el9_8

kernel-debug-modules-extra

5.14.0-687.24.1.el9_8

kernel-debug-uki-virt

5.14.0-687.24.1.el9_8

kernel-modules

5.14.0-687.24.1.el9_8

kernel-modules-core

5.14.0-687.24.1.el9_8

kernel-modules-extra

5.14.0-687.24.1.el9_8

kernel-tools

5.14.0-687.24.1.el9_8

kernel-tools-libs

5.14.0-687.24.1.el9_8

kernel-uki-virt

5.14.0-687.24.1.el9_8

kernel-uki-virt-addons

5.14.0-687.24.1.el9_8

kernel-debug-devel

5.14.0-687.24.1.el9_8

kernel-debug-devel-matched

5.14.0-687.24.1.el9_8

kernel-devel

5.14.0-687.24.1.el9_8

kernel-devel-matched

5.14.0-687.24.1.el9_8

kernel-doc

5.14.0-687.24.1.el9_8

kernel-headers

5.14.0-687.24.1.el9_8

perf

5.14.0-687.24.1.el9_8

python3-perf

5.14.0-687.24.1.el9_8

rtla

5.14.0-687.24.1.el9_8

kernel-cross-headers

5.14.0-687.24.1.el9_8

kernel-tools-libs-devel

5.14.0-687.24.1.el9_8

libperf

5.14.0-687.24.1.el9_8

Связанные CVE

CVE-2025-71066

CVE-2026-46113

CVE-2026-53359

Ссылки на источники

Связанные уязвимости

RLSA-2026:36957

rocky

15 дней назад

Important: kernel security update

RLSA-2026:36956

rocky

16 дней назад

Important: kernel security update

ELSA-2026-39083

oracle-oval

14 дней назад

ELSA-2026-39083: kernel update (IMPORTANT)

CVE-2025-71066

CVSS3: 7.5

ubuntu

6 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change zdi-disclosures@trendmicro.com says: The vulnerability is a race condition between `ets_qdisc_dequeue` and `ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. Attacker requires the capability to create new user and network namespace in order to trigger the bug. See my additional commentary at the end of the analysis. Analysis: static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, struct netlink_ext_ack *extack) { ... // (1) this lock is preventing .change handler (`ets_qdisc_change`) //to race with .dequeue handler (`ets_qdisc_dequeue`) sch_tree_lock(sch); for (i = nbands; i < oldbands; i++) { if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) list_del_init(&q->classes[i].alist); qdisc_purge_queue(q->classes[i].qdisc); } WRITE_ONCE(q->nbands, nbands); for (i = nstrict; i < q->nstrict; i++) { if (q->class...

CVE-2025-71066

CVSS3: 6.2

redhat

7 месяцев назад