Описание
ELSA-2026-77498: kernel security update (IMPORTANT)
[4.18.0-553.172.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.172.1]
- svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187743] {CVE-2026-89530}
- packet: use consistent hard_header_len in TX_RING send path (Jamie Bainbridge) [RHEL-244539]
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Jamie Bainbridge) [RHEL-244539]
- packet: use consistent hard_header_len in non-ring send paths (Jamie Bainbridge) [RHEL-244539] {CVE-2026-74582}
- net/ip6_tunnel: Prevent perpetual tunnel growth (Jamie Bainbridge) [RHEL-244539]
- net: tunnels: annotate lockless accesses to dev->needed_headroom (Jamie Bainbridge) [RHEL-244539]
- vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232253] {CVE-2026-64115}
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
kernel-tools-libs-devel
4.18.0-553.172.1.el8_10
bpftool
4.18.0-553.172.1.el8_10
kernel-cross-headers
4.18.0-553.172.1.el8_10
kernel-headers
4.18.0-553.172.1.el8_10
kernel-tools
4.18.0-553.172.1.el8_10
kernel-tools-libs
4.18.0-553.172.1.el8_10
perf
4.18.0-553.172.1.el8_10
python3-perf
4.18.0-553.172.1.el8_10
Oracle Linux x86_64
kernel-tools-libs-devel
4.18.0-553.172.1.el8_10
bpftool
4.18.0-553.172.1.el8_10
kernel-abi-stablelists
4.18.0-553.172.1.el8_10
kernel-core
4.18.0-553.172.1.el8_10
kernel-cross-headers
4.18.0-553.172.1.el8_10
kernel-debug
4.18.0-553.172.1.el8_10
kernel-debug-devel
4.18.0-553.172.1.el8_10
kernel-debug-modules
4.18.0-553.172.1.el8_10
kernel-debug-modules-extra
4.18.0-553.172.1.el8_10
kernel-devel
4.18.0-553.172.1.el8_10
kernel-doc
4.18.0-553.172.1.el8_10
kernel-headers
4.18.0-553.172.1.el8_10
kernel-modules
4.18.0-553.172.1.el8_10
kernel-modules-extra
4.18.0-553.172.1.el8_10
kernel-tools
4.18.0-553.172.1.el8_10
kernel-tools-libs
4.18.0-553.172.1.el8_10
python3-perf
4.18.0-553.172.1.el8_10
kernel
4.18.0-553.172.1.el8_10
kernel-debug-core
4.18.0-553.172.1.el8_10
perf
4.18.0-553.172.1.el8_10
Связанные CVE
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet...
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpected packet...
In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci_transport_recv_connecting_server() returned err = 0 for a peer RST in its default switch arm: err = pkt->type == VMCI_TRANSPORT_PACKET_TYPE_RST ? 0 : -EINVAL; That made vmci_transport_recv_listen() skip vsock_remove_pending(), leaving the pending socket on the listener's pending_links with sk_state = TCP_CLOSE while destroy: still dropped the explicit reference taken before schedule_delayed_work(). One second later vsock_pending_work() observed is_pending=true and performed full cleanup: vsock_remove_pending() then the two trailing sock_put(sk) calls -- the first reached refcount 0 and __sk_freed the socket, and the second wrote into the freed object: BUG: KASAN: slab-use-after-free in refcount_warn_saturate Write of size 4 at addr ffff88800b1cac80 by task kworker Workqueue: events vsock_pending_work Treat peer RST like any other unexpe
In the Linux kernel, the following vulnerability has been resolved: v ...