Описание
ELSA-2026-93414: kernel security update (CRITICAL)
[4.18.0-553.182.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.182.1]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Davide Caratti) [RHEL-295615] {CVE-2026-98432}
[4.18.0-553.181.1]
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291583]
- smb: client: bound dirent name against end of SMB response in cifs_filldir (Jorge San Emeterio Villalain) [RHEL-278321] {CVE-2026-93787}
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283491] {CVE-2026-72083}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273171] {CVE-2026-74283}
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259350] {CVE-2026-63924}
- ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259375] {CVE-2026-63922}
- af_unix: Fix peek then tail dereference UAF in unix_stream_data_wait() (Jamie Bainbridge) [RHEL-225873] {CVE-2026-64109}
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
bpftool
4.18.0-553.182.1.el8_10
kernel-cross-headers
4.18.0-553.182.1.el8_10
kernel-headers
4.18.0-553.182.1.el8_10
kernel-tools
4.18.0-553.182.1.el8_10
kernel-tools-libs
4.18.0-553.182.1.el8_10
kernel-tools-libs-devel
4.18.0-553.182.1.el8_10
perf
4.18.0-553.182.1.el8_10
python3-perf
4.18.0-553.182.1.el8_10
Oracle Linux x86_64
bpftool
4.18.0-553.182.1.el8_10
kernel
4.18.0-553.182.1.el8_10
kernel-abi-stablelists
4.18.0-553.182.1.el8_10
kernel-core
4.18.0-553.182.1.el8_10
kernel-cross-headers
4.18.0-553.182.1.el8_10
kernel-debug
4.18.0-553.182.1.el8_10
kernel-debug-core
4.18.0-553.182.1.el8_10
kernel-debug-devel
4.18.0-553.182.1.el8_10
kernel-debug-modules
4.18.0-553.182.1.el8_10
kernel-debug-modules-extra
4.18.0-553.182.1.el8_10
kernel-devel
4.18.0-553.182.1.el8_10
kernel-doc
4.18.0-553.182.1.el8_10
kernel-headers
4.18.0-553.182.1.el8_10
kernel-modules
4.18.0-553.182.1.el8_10
kernel-modules-extra
4.18.0-553.182.1.el8_10
kernel-tools
4.18.0-553.182.1.el8_10
kernel-tools-libs
4.18.0-553.182.1.el8_10
kernel-tools-libs-devel
4.18.0-553.182.1.el8_10
perf
4.18.0-553.182.1.el8_10
python3-perf
4.18.0-553.182.1.el8_10
Связанные CVE
Связанные уязвимости
This vulnerability affects the IPv4 TCP connection handling in the Linux kernel and can lead to remote code execution. In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener loc...
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do no...
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do
In the Linux kernel, the following vulnerability has been resolved: i ...