Описание
ELSA-2026-38491: kernel security, bug fix, and enhancement update (IMPORTANT)
[5.14.0-687.25.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.25.1]
- futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
kernel-cross-headers
5.14.0-687.25.1.el9_8
kernel-tools-libs-devel
5.14.0-687.25.1.el9_8
libperf
5.14.0-687.25.1.el9_8
kernel-tools-libs
5.14.0-687.25.1.el9_8
kernel-headers
5.14.0-687.25.1.el9_8
perf
5.14.0-687.25.1.el9_8
python3-perf
5.14.0-687.25.1.el9_8
rtla
5.14.0-687.25.1.el9_8
rv
5.14.0-687.25.1.el9_8
kernel-tools
5.14.0-687.25.1.el9_8
Oracle Linux x86_64
kernel
5.14.0-687.25.1.el9_8
kernel-abi-stablelists
5.14.0-687.25.1.el9_8
kernel-core
5.14.0-687.25.1.el9_8
kernel-debug
5.14.0-687.25.1.el9_8
kernel-debug-core
5.14.0-687.25.1.el9_8
kernel-debug-modules
5.14.0-687.25.1.el9_8
kernel-debug-modules-core
5.14.0-687.25.1.el9_8
kernel-debug-modules-extra
5.14.0-687.25.1.el9_8
kernel-debug-uki-virt
5.14.0-687.25.1.el9_8
kernel-modules
5.14.0-687.25.1.el9_8
kernel-modules-core
5.14.0-687.25.1.el9_8
kernel-modules-extra
5.14.0-687.25.1.el9_8
kernel-tools
5.14.0-687.25.1.el9_8
kernel-tools-libs
5.14.0-687.25.1.el9_8
kernel-uki-virt
5.14.0-687.25.1.el9_8
kernel-uki-virt-addons
5.14.0-687.25.1.el9_8
kernel-debug-devel
5.14.0-687.25.1.el9_8
kernel-debug-devel-matched
5.14.0-687.25.1.el9_8
kernel-devel
5.14.0-687.25.1.el9_8
kernel-devel-matched
5.14.0-687.25.1.el9_8
kernel-doc
5.14.0-687.25.1.el9_8
kernel-headers
5.14.0-687.25.1.el9_8
perf
5.14.0-687.25.1.el9_8
python3-perf
5.14.0-687.25.1.el9_8
rtla
5.14.0-687.25.1.el9_8
rv
5.14.0-687.25.1.el9_8
kernel-cross-headers
5.14.0-687.25.1.el9_8
kernel-tools-libs-devel
5.14.0-687.25.1.el9_8
libperf
5.14.0-687.25.1.el9_8
Ссылки на источники
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments. Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket. However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the corre...
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments. Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket. However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the corre...
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments. Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket. However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the cor
