Описание
ELSA-2026-500394: Unbreakable Enterprise kernel security update (IMPORTANT)
[6.12.0-207.111.5.3]
- mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (Hyunwoo Kim) [Orabug: 40157478] {CVE-2026-89754}
- exec: Cleanup POSIX timers right after de_thread() (Hyunwoo Kim) [Orabug: 40157474] {CVE-2026-98260}
[6.12.0-207.111.5.2]
- PCI: Fix BAR resize for devices on a root bus (Liz Fong-Jones)
- PCI: Fix Resizable BAR restore order (Ilpo Jarvinen)
- dpll: use exact lookup for reference sync pin id (Ivan Vecera)
- Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (Hui Peng)
- ocfs2: make ocfs2_calc_xattr_init() return void (Joseph Qi)
- selinux: recheck intermediate backing files on mprotect() (Karl Mehltretter)
- selinux: preserve user SID across nested backing files (Karl Mehltretter)
- ASoC: ux500: Parenthesize MSP_{RX,TX}_CLKPOL_BIT() arguments (Sasha Levin)
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (ThangNN99)
- Bluetooth: hci_core: Print number of packets in conn->data_q (Luiz Augusto von Dentz)
- drm/msm/dsi: round the byte clock rate after reparenting to the PHY PLL (Dmitry Baryshkov)
- ALSA: bcd2000: Fix race between rawmidi and disconnect (Takashi Iwai)
- Revert 'hwmon: (emc1403) Rely on subsystem locking' (Sasha Levin)
- Revert 'hwmon: (emc1403) Drop hysteresis for low limit temperature' (Sasha Levin)
- landlock: Fix use-after-free of the source's parent directory (Norbert Szetei) [Orabug: 40132006] {CVE-2026-97594}
- landlock: Clarify documentation for the IOCTL access right (Gunther Noack) [Orabug: 40132006]
- xfrm: Fix dev use-after-free in xfrm async resumption (Dong Chenchen) [Orabug: 40131990] {CVE-2026-72463}
- xfrm: Refactor xfrm_input lock to reduce contention with RSS (Jianbo Liu) [Orabug: 40131990]
- pidfd: hold exec_update_lock around namespace ioctl (Chen Linxuan) [Orabug: 40131986] {CVE-2026-89766}
- ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source() (Eric Dumazet) [Orabug: 40131835] {CVE-2026-98101}
- ipv6: mcast: Don't hold RTNL for MCAST_ socket options. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. (Kuniyuki Iwashima) [Orabug: 40131835]
- ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). (Kuniyuki Iwashima) [Orabug: 40131835]
- net: cpsw: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao) [Orabug: 40131835]
- net: cpsw_new: Execute ndo_set_rx_mode callback in a work queue (Kevin Hao) [Orabug: 40131835]
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
kernel-uek
6.12.0-207.111.5.3.el10uek
kernel-uek-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-devel
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-deprecated
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-desktop
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-extra
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-usb
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-wireless
6.12.0-207.111.5.3.el10uek
kernel-uek-devel
6.12.0-207.111.5.3.el10uek
kernel-uek-doc
6.12.0-207.111.5.3.el10uek
kernel-uek-modules
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-core
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-deprecated
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-desktop
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-extra
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-extra-netfilter
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-usb
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-wireless
6.12.0-207.111.5.3.el10uek
kernel-uek-tools
6.12.0-207.111.5.3.el10uek
kernel-uek64k
6.12.0-207.111.5.3.el10uek
kernel-uek64k-core
6.12.0-207.111.5.3.el10uek
kernel-uek64k-devel
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-core
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-deprecated
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-desktop
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-extra
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-extra-netfilter
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-usb
6.12.0-207.111.5.3.el10uek
kernel-uek64k-modules-wireless
6.12.0-207.111.5.3.el10uek
Oracle Linux x86_64
kernel-uek
6.12.0-207.111.5.3.el10uek
kernel-uek-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-devel
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-core
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-deprecated
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-desktop
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-extra
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-usb
6.12.0-207.111.5.3.el10uek
kernel-uek-debug-modules-wireless
6.12.0-207.111.5.3.el10uek
kernel-uek-devel
6.12.0-207.111.5.3.el10uek
kernel-uek-doc
6.12.0-207.111.5.3.el10uek
kernel-uek-modules
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-core
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-deprecated
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-desktop
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-extra
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-extra-netfilter
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-usb
6.12.0-207.111.5.3.el10uek
kernel-uek-modules-wireless
6.12.0-207.111.5.3.el10uek
kernel-uek-tools
6.12.0-207.111.5.3.el10uek
Oracle Linux 9
Oracle Linux aarch64
kernel-uek
6.12.0-207.111.5.3.el9uek
kernel-uek-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-devel
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-deprecated
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-desktop
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-extra
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-usb
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-wireless
6.12.0-207.111.5.3.el9uek
kernel-uek-devel
6.12.0-207.111.5.3.el9uek
kernel-uek-doc
6.12.0-207.111.5.3.el9uek
kernel-uek-modules
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-core
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-deprecated
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-desktop
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-extra
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-extra-netfilter
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-usb
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-wireless
6.12.0-207.111.5.3.el9uek
kernel-uek-tools
6.12.0-207.111.5.3.el9uek
kernel-uek64k
6.12.0-207.111.5.3.el9uek
kernel-uek64k-core
6.12.0-207.111.5.3.el9uek
kernel-uek64k-devel
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-core
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-deprecated
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-desktop
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-extra
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-extra-netfilter
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-usb
6.12.0-207.111.5.3.el9uek
kernel-uek64k-modules-wireless
6.12.0-207.111.5.3.el9uek
Oracle Linux x86_64
kernel-uek
6.12.0-207.111.5.3.el9uek
kernel-uek-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-devel
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-core
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-deprecated
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-desktop
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-extra
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-extra-netfilter
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-usb
6.12.0-207.111.5.3.el9uek
kernel-uek-debug-modules-wireless
6.12.0-207.111.5.3.el9uek
kernel-uek-devel
6.12.0-207.111.5.3.el9uek
kernel-uek-doc
6.12.0-207.111.5.3.el9uek
kernel-uek-modules
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-core
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-deprecated
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-desktop
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-extra
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-extra-netfilter
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-usb
6.12.0-207.111.5.3.el9uek
kernel-uek-modules-wireless
6.12.0-207.111.5.3.el9uek
kernel-uek-tools
6.12.0-207.111.5.3.el9uek
Ссылки на источники
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
In the Linux kernel, the following vulnerability has been resolved: x ...
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.