Описание
ELSA-2026-93413: kernel security, bug fix, and enhancement update (IMPORTANT)
[6.12.0-211.72.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
[6.12.0-211.72.1]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295608] {CVE-2026-98432}
- x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-230757] {CVE-2026-46174}
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (CKI Backport Bot) [RHEL-291348]
- netfilter: conntrack: make filtering by zone discoverable (CKI Backport Bot) [RHEL-291348]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (CKI Backport Bot) [RHEL-291348]
- netlink: specs: fix the conntrack filter type (CKI Backport Bot) [RHEL-291348]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (CKI Backport Bot) [RHEL-291348]
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277962] {CVE-2026-98364}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273184] {CVE-2026-74283}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271405] {CVE-2026-89603}
- ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF (Abhishek Rawal) [RHEL-248847] {CVE-2026-68398}
- net: sock: fix hardened usercopy panic in sock_recv_errqueue (CKI Backport Bot) [RHEL-189611] {CVE-2026-22977}
[6.12.0-211.71.1]
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290598] {CVE-2026-98725}
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291156]
- smb: client: bound dirent name against end of SMB response in cifs_filldir (Paulo Alcantara) [RHEL-278330] {CVE-2026-93787}
[6.12.0-211.70.1]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285628] {CVE-2026-90011}
- virtio-fs: avoid double-free on failed queue setup (CKI Backport Bot) [RHEL-278134] {CVE-2026-93827}
- KEYS: encrypted: fix integer overflow of datablob_len (Bruno Meneguele) [RHEL-279482] {CVE-2026-98222}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250579] {CVE-2026-80586}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236704] {CVE-2026-68169}
- KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- KVM: nVMX: Always flush vpid02 on first use (Rahul Kumar) [RHEL-270935] {CVE-2026-89932}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-270721]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-270721]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-270702]
Обновленные пакеты
Oracle Linux 10
Oracle Linux aarch64
kernel-headers
6.12.0-211.72.1.el10_2
perf
6.12.0-211.72.1.el10_2
python3-perf
6.12.0-211.72.1.el10_2
rtla
6.12.0-211.72.1.el10_2
rv
6.12.0-211.72.1.el10_2
kernel-tools
6.12.0-211.72.1.el10_2
kernel-tools-libs
6.12.0-211.72.1.el10_2
kernel-cross-headers
6.12.0-211.72.1.el10_2
kernel-tools-libs-devel
6.12.0-211.72.1.el10_2
libperf
6.12.0-211.72.1.el10_2
Oracle Linux x86_64
kernel-debug-devel
6.12.0-211.72.1.el10_2
kernel-debug-devel-matched
6.12.0-211.72.1.el10_2
kernel-devel
6.12.0-211.72.1.el10_2
kernel-devel-matched
6.12.0-211.72.1.el10_2
kernel-doc
6.12.0-211.72.1.el10_2
kernel-headers
6.12.0-211.72.1.el10_2
perf
6.12.0-211.72.1.el10_2
python3-perf
6.12.0-211.72.1.el10_2
rtla
6.12.0-211.72.1.el10_2
rv
6.12.0-211.72.1.el10_2
kernel
6.12.0-211.72.1.el10_2
kernel-abi-stablelists
6.12.0-211.72.1.el10_2
kernel-core
6.12.0-211.72.1.el10_2
kernel-debug
6.12.0-211.72.1.el10_2
kernel-debug-core
6.12.0-211.72.1.el10_2
kernel-debug-modules
6.12.0-211.72.1.el10_2
kernel-debug-modules-core
6.12.0-211.72.1.el10_2
kernel-debug-modules-extra
6.12.0-211.72.1.el10_2
kernel-debug-uki-virt
6.12.0-211.72.1.el10_2
kernel-modules
6.12.0-211.72.1.el10_2
kernel-modules-core
6.12.0-211.72.1.el10_2
kernel-modules-extra
6.12.0-211.72.1.el10_2
kernel-modules-extra-matched
6.12.0-211.72.1.el10_2
kernel-tools
6.12.0-211.72.1.el10_2
kernel-tools-libs
6.12.0-211.72.1.el10_2
kernel-uki-virt
6.12.0-211.72.1.el10_2
kernel-uki-virt-addons
6.12.0-211.72.1.el10_2
kernel-cross-headers
6.12.0-211.72.1.el10_2
kernel-tools-libs-devel
6.12.0-211.72.1.el10_2
libperf
6.12.0-211.72.1.el10_2
Ссылки на источники
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error que...
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error que...
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket er
net: sock: fix hardened usercopy panic in sock_recv_errqueue