Описание
ELSA-2026-8921: kernel security update (IMPORTANT)
[5.14.0-611.49.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-611.49.1]
- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}
[5.14.0-611.48.1]
- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
- Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
- Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
- Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
- iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
- iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
- i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
kernel-cross-headers
5.14.0-611.49.1.el9_7
kernel-tools-libs-devel
5.14.0-611.49.1.el9_7
libperf
5.14.0-611.49.1.el9_7
kernel-headers
5.14.0-611.49.1.el9_7
perf
5.14.0-611.49.1.el9_7
python3-perf
5.14.0-611.49.1.el9_7
rtla
5.14.0-611.49.1.el9_7
rv
5.14.0-611.49.1.el9_7
kernel-tools
5.14.0-611.49.1.el9_7
kernel-tools-libs
5.14.0-611.49.1.el9_7
Oracle Linux x86_64
kernel-abi-stablelists
5.14.0-611.49.1.el9_7
kernel-core
5.14.0-611.49.1.el9_7
kernel-debug
5.14.0-611.49.1.el9_7
kernel-debug-core
5.14.0-611.49.1.el9_7
kernel-debug-modules
5.14.0-611.49.1.el9_7
kernel-debug-modules-core
5.14.0-611.49.1.el9_7
kernel-debug-modules-extra
5.14.0-611.49.1.el9_7
kernel-debug-uki-virt
5.14.0-611.49.1.el9_7
kernel-modules
5.14.0-611.49.1.el9_7
kernel-modules-core
5.14.0-611.49.1.el9_7
kernel-modules-extra
5.14.0-611.49.1.el9_7
kernel-tools
5.14.0-611.49.1.el9_7
kernel-tools-libs
5.14.0-611.49.1.el9_7
kernel-uki-virt
5.14.0-611.49.1.el9_7
kernel-uki-virt-addons
5.14.0-611.49.1.el9_7
kernel-debug-devel
5.14.0-611.49.1.el9_7
kernel-debug-devel-matched
5.14.0-611.49.1.el9_7
kernel-devel
5.14.0-611.49.1.el9_7
kernel-devel-matched
5.14.0-611.49.1.el9_7
kernel-doc
5.14.0-611.49.1.el9_7
kernel-headers
5.14.0-611.49.1.el9_7
perf
5.14.0-611.49.1.el9_7
python3-perf
5.14.0-611.49.1.el9_7
rtla
5.14.0-611.49.1.el9_7
rv
5.14.0-611.49.1.el9_7
kernel-cross-headers
5.14.0-611.49.1.el9_7
kernel-tools-libs-devel
5.14.0-611.49.1.el9_7
libperf
5.14.0-611.49.1.el9_7
kernel
5.14.0-611.49.1.el9_7
Связанные CVE
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The qla24xx_alloc_purex_item() function may return a pre-allocated item from a per-adapter pool for small allocations, instead of dynamically allocating memory with kzalloc(). An error handling path in qla2xxx_process_purls_iocb() incorrectly uses kfree() to release the item. If the item was from the pre-allocated pool, calling kfree() on it is a bug that can lead to memory corruption. Fix this by using the correct deallocation function, qla24xx_free_purex_item(), which properly handles both dynamically allocated and pre-allocated items.