Описание
ELSA-2026-500328: Unbreakable Enterprise kernel security update (IMPORTANT)
[6.12.0-206.104.4.4]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035126] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035125] {CVE-2026-80844}
- RDMA/nldev: Fix locking when accessing mr->pd (Jason Gunthorpe) [Orabug: 40028950] {CVE-2026-74334}
- RDMA/restrack: Fix typos in the comments (Kalesh AP) [Orabug: 40028950]
- tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 40028948] {CVE-2026-74268}
- xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (Jason Xing) [Orabug: 40028941] {CVE-2026-53250}
- tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 40028939] {CVE-2026-43198}
[6.12.0-206.104.4.3]
- net: Account VLAN RPS drops (Sherry Yang) [Orabug: 40023758]
- net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den)
- net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den)
- net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier)
- Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (Pauli Virtanen)
- ALSA: seq: midi: Optimize event_input locking with RCU (Takashi Iwai)
- ALSA: seq: Don't leak the extension cell pointer in the bounce payload (HyeongJun An)
- f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng)
- media: cec: core: Fix kmemleak due to missed rc_free_device() call (Jonas Karlman)
- LoongArch: Fix acpi_package_ids[] array overflow (Bibo Mao)
- fs: fix user path of nested backing files (Baokun Li)
- Revert 'PM: sleep: Use complete() in device_pm_sleep_init()' (Sasha Levin)
- perf: Reject exited events as group leaders (Kyle Zeng)
- erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic (Geert Uytterhoeven)
- drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (Nathan Lucas)
- ipv4: start using dst_dev_rcu() (Eric Dumazet) [Orabug: 40022810] {CVE-2025-40074}
- NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 40022771] {CVE-2026-74626}
- inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 40022764] {CVE-2026-74662}
- inet: frags: save a pair of atomic operations in reassembly (Eric Dumazet) [Orabug: 40022764]
- inet: frags: change inet_frag_kill() to defer refcount updates (Eric Dumazet) [Orabug: 40022764]
- ipv4: frags: remove ipq_put() (Eric Dumazet) [Orabug: 40022764]
- inet: frags: add inet_frag_putn() helper (Eric Dumazet) [Orabug: 40022764]
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
kernel-uek
6.12.0-206.104.4.4.el10uek
kernel-uek-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-devel
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-deprecated
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-desktop
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-extra
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-usb
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-wireless
6.12.0-206.104.4.4.el10uek
kernel-uek-devel
6.12.0-206.104.4.4.el10uek
kernel-uek-doc
6.12.0-206.104.4.4.el10uek
kernel-uek-modules
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-core
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-deprecated
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-desktop
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-extra
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-extra-netfilter
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-usb
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-wireless
6.12.0-206.104.4.4.el10uek
kernel-uek-tools
6.12.0-206.104.4.4.el10uek
kernel-uek64k
6.12.0-206.104.4.4.el10uek
kernel-uek64k-core
6.12.0-206.104.4.4.el10uek
kernel-uek64k-devel
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-core
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-deprecated
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-desktop
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-extra
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-extra-netfilter
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-usb
6.12.0-206.104.4.4.el10uek
kernel-uek64k-modules-wireless
6.12.0-206.104.4.4.el10uek
Oracle Linux x86_64
kernel-uek
6.12.0-206.104.4.4.el10uek
kernel-uek-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-devel
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-core
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-deprecated
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-desktop
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-extra
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-usb
6.12.0-206.104.4.4.el10uek
kernel-uek-debug-modules-wireless
6.12.0-206.104.4.4.el10uek
kernel-uek-devel
6.12.0-206.104.4.4.el10uek
kernel-uek-doc
6.12.0-206.104.4.4.el10uek
kernel-uek-modules
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-core
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-deprecated
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-desktop
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-extra
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-extra-netfilter
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-usb
6.12.0-206.104.4.4.el10uek
kernel-uek-modules-wireless
6.12.0-206.104.4.4.el10uek
kernel-uek-tools
6.12.0-206.104.4.4.el10uek
Oracle Linux 9
Oracle Linux aarch64
kernel-uek
6.12.0-206.104.4.4.el9uek
kernel-uek-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-devel
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-deprecated
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-desktop
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-extra
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-usb
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-wireless
6.12.0-206.104.4.4.el9uek
kernel-uek-devel
6.12.0-206.104.4.4.el9uek
kernel-uek-doc
6.12.0-206.104.4.4.el9uek
kernel-uek-modules
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-core
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-deprecated
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-desktop
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-extra
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-extra-netfilter
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-usb
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-wireless
6.12.0-206.104.4.4.el9uek
kernel-uek-tools
6.12.0-206.104.4.4.el9uek
kernel-uek64k
6.12.0-206.104.4.4.el9uek
kernel-uek64k-core
6.12.0-206.104.4.4.el9uek
kernel-uek64k-devel
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-core
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-deprecated
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-desktop
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-extra
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-extra-netfilter
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-usb
6.12.0-206.104.4.4.el9uek
kernel-uek64k-modules-wireless
6.12.0-206.104.4.4.el9uek
Oracle Linux x86_64
kernel-uek
6.12.0-206.104.4.4.el9uek
kernel-uek-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-devel
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-core
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-deprecated
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-desktop
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-extra
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-usb
6.12.0-206.104.4.4.el9uek
kernel-uek-debug-modules-wireless
6.12.0-206.104.4.4.el9uek
kernel-uek-devel
6.12.0-206.104.4.4.el9uek
kernel-uek-doc
6.12.0-206.104.4.4.el9uek
kernel-uek-modules
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-core
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-deprecated
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-desktop
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-extra
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-extra-netfilter
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-usb
6.12.0-206.104.4.4.el9uek
kernel-uek-modules-wireless
6.12.0-206.104.4.4.el9uek
kernel-uek-tools
6.12.0-206.104.4.4.el9uek
Ссылки на источники
Связанные уязвимости
ELSA-2026-500329: Unbreakable Enterprise kernel security update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
