Описание
ELSA-2026-500573: Unbreakable Enterprise kernel security update (IMPORTANT)
[5.4.17-2136.361.4]
- vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193932]
[5.4.17-2136.361.3]
- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180571]
- drbd: fix 'LOGIC BUG' in drbd_al_begin_io_nonblock() (Lars Ellenberg) [Orabug: 39130967] {CVE-2026-23356}
- rds: cong: fix race while clearing rs_cong_mask (Anand Khoje) [Orabug: 39519861]
- hugetlbfs: hold trunc_rwsem during hugepage migration (Stephen Brennan) [Orabug: 39541934]
- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40165812] {CVE-2026-99999}
- netfilter: nfnetlink_queue: unbreak SCTP traffic (Antonio Ojea) [Orabug: 40165812]
- net: add inline function skb_csum_is_sctp (Xin Long) [Orabug: 40165812]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40165790] {CVE-2026-98432}
- vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917526] {CVE-2026-74580}
[5.4.17-2136.361.2]
- ionic: serialize hardware timestamp Tx queue access (Joe Dobosenski) [Orabug: 40061822]
[5.4.17-2136.361.1]
- net/mlx5: Set parent device before health polling (Manjunath Patil) [Orabug: 39208695]
[5.4.17-2136.360.3]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
- sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
- pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}
[5.4.17-2136.360.2]
- Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39764468]
[5.4.17-2136.360.1]
- x86/alternatives: Guard struct alt_instr kABI layout (Saeed Mirzamohammadi) [Orabug: 39860383]
- crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
- crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
- crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
- KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug: 39273524] {CVE-2026-31588}
- xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}
[5.4.17-2136.359.3]
- Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546]
- Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39866546]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480} (H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju) [Orabug: 39681637]
[5.4.17-2136.359.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39558751,39919265] {CVE-2026-74684}
- rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed) [Orabug: 39668203]
- rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan) [Orabug: 39668203]
- net/rds: harden rds_rm_size (Manjunath Patil) [Orabug: 39812534]
- rds: ib: move gc_count reset before free_percpu (Manjunath Patil) [Orabug: 39818510]
- rds: fix lfstack_pop_all sequence reset (Manjunath Patil) [Orabug: 39818510]
[5.4.17-2136.359.1]
- KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil) [Orabug: 39374251]
- arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King) [Orabug: 39374251]
- arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior) [Orabug: 39374251]
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026-31598}
- fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235] {CVE-2026-46116}
- net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug: 39621716,39638198] {CVE-2026-52995}
- uek: kabi: update x86_64 kABI files for a new symbol (Saeed Mirzamohammadi) [Orabug: 39651636]
- IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang) [Orabug: 39674348]
- IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang) [Orabug: 39674348]
- fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681044]
- mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- xen/ovmapi: terminate values passed to xenbus_write (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: free queued events on release (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: prevent duplicate app registration (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: reject oversized posted event payloads (Joe Jin) [Orabug: 39726701]
- rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye) [Orabug: 39772651]
- rds: do not leak kernel memory to user land (Eric Dumazet) [Orabug: 39772651]
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
kernel-uek
5.4.17-2136.361.4.el8uek
kernel-uek-debug
5.4.17-2136.361.4.el8uek
kernel-uek-debug-devel
5.4.17-2136.361.4.el8uek
kernel-uek-devel
5.4.17-2136.361.4.el8uek
kernel-uek-doc
5.4.17-2136.361.4.el8uek
Oracle Linux x86_64
kernel-uek
5.4.17-2136.361.4.el8uek
kernel-uek-container
5.4.17-2136.361.4.el8uek
kernel-uek-container-debug
5.4.17-2136.361.4.el8uek
kernel-uek-debug
5.4.17-2136.361.4.el8uek
kernel-uek-debug-devel
5.4.17-2136.361.4.el8uek
kernel-uek-devel
5.4.17-2136.361.4.el8uek
kernel-uek-doc
5.4.17-2136.361.4.el8uek
Oracle Linux 7
Oracle Linux x86_64
kernel-uek
5.4.17-2136.361.4.el7uek
kernel-uek-container
5.4.17-2136.361.4.el7uek
kernel-uek-container-debug
5.4.17-2136.361.4.el7uek
kernel-uek-debug
5.4.17-2136.361.4.el7uek
kernel-uek-debug-devel
5.4.17-2136.361.4.el7uek
kernel-uek-devel
5.4.17-2136.361.4.el7uek
kernel-uek-doc
5.4.17-2136.361.4.el7uek
kernel-uek-tools
5.4.17-2136.361.4.el7uek
Связанные уязвимости
ELSA-2026-500397: Unbreakable Enterprise kernel security update (IMPORTANT)
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log extents. The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case. Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put(). Fix: Do not crash the kernel for a condition that is h...
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log extents. The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case. Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put(). Fix: Do not crash the kernel for a condition that is h...
In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log extents. The implcations are that during an active resync, mutual exclusivity of resync versus application IO is not guaranteed. And a potential crash at this point may not realizs that these extents could have been target of in-flight IO and would need to be resynced just in case. Also, once the request completes, it will give up activity log references it does not even hold, which will trigger a BUG_ON(refcnt == 0) in lc_put(). Fix: Do not crash the kernel for a condition that
