ELSA-2026-64808-0

Опубликовано: 10 сент. 2026

Источник: oracle-oval

Платформа: Oracle Linux 9

Описание

ELSA-2026-64808-0: kernel security update (IMPORTANT)

[5.14.0-687.45.1]

Disable UKI signing [Orabug: 36571828]
Update Oracle Linux certificates (Kevin Lyons)
Disable signing for aarch64 (Ilya Okomin)
Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
Update x509.genkey [Orabug: 24817676]
Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
Add Oracle Linux IMA certificates
Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.45.1]

KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (Jon Maloy) [RHEL-234207] {CVE-2026-64287}
nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234145] {CVE-2026-64319}
smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228852] {CVE-2026-64136}
io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227107] {CVE-2026-52933}
smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226985] {CVE-2026-64384}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219614] {CVE-2026-64320}
can: bcm: extend bcm_tx_lock usage for data and timer updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}
can: bcm: add locking when updating filter and timer values (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}
can: bcm: fix locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}
can: bcm: add locking for bcm_op runtime updates (CKI Backport Bot) [RHEL-216699] {CVE-2025-38004}
netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188518] {CVE-2026-53000}

Обновленные пакеты

Oracle Linux 9

Oracle Linux aarch64

kernel-cross-headers

5.14.0-687.45.1.el9_8

kernel-tools-libs-devel

5.14.0-687.45.1.el9_8

libperf

5.14.0-687.45.1.el9_8

kernel-tools

5.14.0-687.45.1.el9_8

kernel-tools-libs

5.14.0-687.45.1.el9_8

kernel-headers

5.14.0-687.45.1.el9_8

perf

5.14.0-687.45.1.el9_8

python3-perf

5.14.0-687.45.1.el9_8

rtla

5.14.0-687.45.1.el9_8

Oracle Linux x86_64

kernel

5.14.0-687.45.1.el9_8

kernel-abi-stablelists

5.14.0-687.45.1.el9_8

kernel-core

5.14.0-687.45.1.el9_8

kernel-debug

5.14.0-687.45.1.el9_8

kernel-debug-core

5.14.0-687.45.1.el9_8

kernel-debug-modules

5.14.0-687.45.1.el9_8

kernel-debug-modules-core

5.14.0-687.45.1.el9_8

kernel-debug-modules-extra

5.14.0-687.45.1.el9_8

kernel-debug-uki-virt

5.14.0-687.45.1.el9_8

kernel-modules

5.14.0-687.45.1.el9_8

kernel-modules-core

5.14.0-687.45.1.el9_8

kernel-modules-extra

5.14.0-687.45.1.el9_8

kernel-tools

5.14.0-687.45.1.el9_8

kernel-tools-libs

5.14.0-687.45.1.el9_8

kernel-uki-virt

5.14.0-687.45.1.el9_8

kernel-uki-virt-addons

5.14.0-687.45.1.el9_8

kernel-debug-devel

5.14.0-687.45.1.el9_8

kernel-debug-devel-matched

5.14.0-687.45.1.el9_8

kernel-devel

5.14.0-687.45.1.el9_8

kernel-devel-matched

5.14.0-687.45.1.el9_8

kernel-doc

5.14.0-687.45.1.el9_8

kernel-headers

5.14.0-687.45.1.el9_8

perf

5.14.0-687.45.1.el9_8

python3-perf

5.14.0-687.45.1.el9_8

rtla

5.14.0-687.45.1.el9_8

kernel-cross-headers

5.14.0-687.45.1.el9_8

kernel-tools-libs-devel

5.14.0-687.45.1.el9_8

libperf

5.14.0-687.45.1.el9_8

Связанные CVE

Ссылки на источники

Связанные уязвимости

RLSA-2026:64808

rocky

6 дней назад

Important: kernel security update

RLSA-2026:64775

rocky

6 дней назад

Important: kernel security, bug fix, and enhancement update

ELSA-2026-64775-0

oracle-oval

6 дней назад

ELSA-2026-64775-0: kernel security, bug fix, and enhancement update (IMPORTANT)

CVE-2025-38004

CVSS3: 7.3

ubuntu

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the 'currframe' counter is then set to zero. Although this appeared to be a safe operation the updates of 'currframe' can be triggered from user space and hrtimer context in bcm_can_tx(). Anderson Nascimento created a proof of concept that triggered a KASAN slab-out-of-bounds read access which can be prevented with a spin_lock_bh. At the rework of bcm_can_tx() the 'count' variable has been moved into the protected section as this variable can be modified from both contexts too.

CVE-2025-38004

CVSS3: 7.1

redhat

больше 1 года назад