ELSA-2026-77690

Описание

[6.12.0-211.64.1]

• Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
• Disable UKI signing [Orabug: 36571828]
• Update Oracle Linux certificates (Kevin Lyons)
• Disable signing for aarch64 (Ilya Okomin)
• Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
• Update x509.genkey [Orabug: 24817676]
• Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
• Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
• Add Oracle Linux IMA certificates
• Update module name for cryptographic module [Orabug: 37400433]
• Clean git history at setup stage
• Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
• Disable UKI signing [Orabug: 36571828]
• Update Oracle Linux certificates (Kevin Lyons)
• Disable signing for aarch64 (Ilya Okomin)
• Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
• Update x509.genkey [Orabug: 24817676]
• Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
• Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
• Add Oracle Linux IMA certificates
• Update module name for cryptographic module [Orabug: 37400433]
• Clean git history at setup stage

[6.12.0-211.64.1]

• ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805]
• ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805]
• ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805]
• ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805]
• udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705}
• nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690}
• svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530}
• nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676}
• nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675}
• nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669}
• nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663}
• nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134]
• nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134]
• NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398}
• SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317}
• vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268]
• macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268]
• ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744}
• ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103}
• vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970}
• vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
• vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365}
• KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360}
• vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115}
• mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709]
• mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709]
• platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709]
• igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035}

[6.12.0-211.63.1]

• netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288}
• tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024}
• Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
• Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
• nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227}
• nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972}
• s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888]
• ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132}
• netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417}
• crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972}
• wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457]
• wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457]
• wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457]
• crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457]
• futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003}
• futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469]
• futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775}
• futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778}
• futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758}
• futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776}
• futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658}
• futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469]
• compiler_types.h: add 'auto' as a macro for '__auto_type' (Waiman Long) [RHEL-263469]
• ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476}
• ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792}
• ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924}
• ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922}
• ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984}
• ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
• Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
• Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
• l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918}
• tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992}
• tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmpv6 (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994}
• vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432}
• net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052}
• net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829}
• Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
• Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
• netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320}
• KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921}
• KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
• KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
• KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
• KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
• KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
• ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
• ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
• ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
• netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255}
• netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394]
• netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394]
• netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394]
• netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078}
• netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394]
• netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394]
• netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394]
• netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394]
• netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746}
• packet: use consistent hard_header_len in TX_RING send path (Toke Hoiland-Jorgensen) [RHEL-244537]
• packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244537] {CVE-2026-74582}
• net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Hoiland-Jorgensen) [RHEL-244537]
• RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856}
• netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860}
• ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270}
• KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794}

[6.12.0-211.62.1]

• dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
• net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034}
• gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261]
• gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261]
• gve: Use generic power management (Michal Schmidt) [RHEL-219261]
• gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261]
• gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261]
• gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261]
• gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261]
• gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261]
• gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261]
• gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261]
• gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261]
• gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261]
• gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261]
• gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261]
• net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261]
• gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261]
• gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261]
• gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261]
• gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261]
• gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261]
• gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261]
• gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261]
• gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261]
• gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261]
• gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261]
• gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261]
• gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261]
• gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261]
• gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261]
• gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261]
• gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261]
• gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261]
• gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261]
• gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261]
• gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261]
• gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261]
• gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261]
• gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261]
• gve: global: fix 'for a while' typo (Michal Schmidt) [RHEL-219261]
• gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261]
• gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261]
• gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261]
• gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261]
• gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261]
• gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261]
• gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261]
• gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261]
• gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261]
• gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261]
• gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261]
• gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261]
• gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261]
• gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261]
• gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261]
• gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261]
• gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261]
• gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261]
• gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261]
• gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261]
• gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261]
• gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261]
• gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261]
• gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261]
• gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261]
• gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261]
• gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261]
• gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261]
• gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261]
• gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261]
• gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261]
• gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261]
• gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261]
• gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261]
• gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261]
• gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261]
• gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261]
• gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261]
• gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261]
• gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261]
• gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261]