ELSA-2026-87805

Описание

[5.14.0-687.60.1]

• Disable UKI signing [Orabug: 36571828]
• Update Oracle Linux certificates (Kevin Lyons)
• Disable signing for aarch64 (Ilya Okomin)
• Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
• Update x509.genkey [Orabug: 24817676]
• Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
• Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
• Add Oracle Linux IMA certificates
• Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.60.1]

• xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536}
• ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448}
• ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202}
• calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
• calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
• netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063}
• xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530}
• vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299}
• ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481}
• rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029]

[5.14.0-687.59.1]

• net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987]
• ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999}
• smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631}
• exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
• perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
• smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633}
• strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747]
• xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697]
• xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697]
• xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697]
• bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032}
• net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528]
• tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024}
• ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572}
• inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590}
• ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
• usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958}
• usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429]
• usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962}
• usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963}
• usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961}
• USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956}
• USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957}
• USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928}
• USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899}
• Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
• openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
• openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
• Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
• Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
• xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935}