Описание
ELSA-2026-43307: kernel security, bug fix, and enhancement update (IMPORTANT)
[5.14.0-687.29.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.29.1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]
[5.14.0-687.28.1]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}
[5.14.0-687.27.1]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid 'No data available' when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
kernel-cross-headers
5.14.0-687.29.1.el9_8
kernel-tools-libs-devel
5.14.0-687.29.1.el9_8
libperf
5.14.0-687.29.1.el9_8
kernel-tools
5.14.0-687.29.1.el9_8
kernel-tools-libs
5.14.0-687.29.1.el9_8
kernel-headers
5.14.0-687.29.1.el9_8
perf
5.14.0-687.29.1.el9_8
python3-perf
5.14.0-687.29.1.el9_8
rtla
5.14.0-687.29.1.el9_8
rv
5.14.0-687.29.1.el9_8
Oracle Linux x86_64
kernel
5.14.0-687.29.1.el9_8
kernel-abi-stablelists
5.14.0-687.29.1.el9_8
kernel-core
5.14.0-687.29.1.el9_8
kernel-debug
5.14.0-687.29.1.el9_8
kernel-debug-core
5.14.0-687.29.1.el9_8
kernel-debug-modules
5.14.0-687.29.1.el9_8
kernel-debug-modules-core
5.14.0-687.29.1.el9_8
kernel-debug-modules-extra
5.14.0-687.29.1.el9_8
kernel-debug-uki-virt
5.14.0-687.29.1.el9_8
kernel-modules
5.14.0-687.29.1.el9_8
kernel-modules-core
5.14.0-687.29.1.el9_8
kernel-modules-extra
5.14.0-687.29.1.el9_8
kernel-tools
5.14.0-687.29.1.el9_8
kernel-tools-libs
5.14.0-687.29.1.el9_8
kernel-uki-virt
5.14.0-687.29.1.el9_8
kernel-uki-virt-addons
5.14.0-687.29.1.el9_8
kernel-debug-devel
5.14.0-687.29.1.el9_8
kernel-debug-devel-matched
5.14.0-687.29.1.el9_8
kernel-devel
5.14.0-687.29.1.el9_8
kernel-devel-matched
5.14.0-687.29.1.el9_8
kernel-doc
5.14.0-687.29.1.el9_8
kernel-headers
5.14.0-687.29.1.el9_8
perf
5.14.0-687.29.1.el9_8
python3-perf
5.14.0-687.29.1.el9_8
rtla
5.14.0-687.29.1.el9_8
rv
5.14.0-687.29.1.el9_8
kernel-cross-headers
5.14.0-687.29.1.el9_8
kernel-tools-libs-devel
5.14.0-687.29.1.el9_8
libperf
5.14.0-687.29.1.el9_8
Ссылки на источники
Связанные уязвимости
ELSA-2026-42919: kernel security, bug fix, and enhancement update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af ("crypto: af_alg - Disallow multiple in-flight AIO requests") Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true: https://github...
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af ("crypto: af_alg - Disallow multiple in-flight AIO requests") Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true: https://github...
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user API contexts and requests allocated with sock_kmalloc() were left uninitialized, relying on callers to set fields explicitly. This resulted in the use of uninitialized data in certain error paths or when new fields are added in the future. The ACVP patches also contain two user-space interface files: algif_kpp.c and algif_akcipher.c. These too rely on proper initialization of their context structures. A particular issue has been observed with the newly added 'inflight' variable introduced in af_alg_ctx by commit: 67b164a871af ("crypto: af_alg - Disallow multiple in-flight AIO requests") Because the context is not memset to zero after allocation, the inflight variable has contained garbage values. As a result, af_alg_alloc_areq() has incorrectly returned -EBUSY randomly when the garbage value was interpreted as true: https:
crypto: af_alg - zero initialize memory allocated via sock_kmalloc