Описание
ELSA-2026-95212: kernel security, bug fix, and enhancement update (IMPORTANT)
[4.18.0-553.184.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
[4.18.0-553.184.1]
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (Jan Polensky) [RHEL-298266] {CVE-2026-64541}
- s390/smp: Remove conditional emergency signal order code usage (Jan Polensky) [RHEL-298849]
- sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277071] {CVE-2026-52929}
- sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275359] {CVE-2026-74586}
- openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263524] {CVE-2026-89488}
- RDMA/rxe: Fix OOB in free_rd_atomic_resources() (Kamal Heib) [RHEL-256416] {CVE-2026-80863}
- RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (Kamal Heib) [RHEL-258544] {CVE-2026-80864}
- redhat: fix parallel make race between sources-rh and its inputs (Jan Stancek)
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
kernel-tools-libs-devel
4.18.0-553.184.1.el8_10
bpftool
4.18.0-553.184.1.el8_10
kernel-cross-headers
4.18.0-553.184.1.el8_10
kernel-headers
4.18.0-553.184.1.el8_10
kernel-tools
4.18.0-553.184.1.el8_10
kernel-tools-libs
4.18.0-553.184.1.el8_10
perf
4.18.0-553.184.1.el8_10
python3-perf
4.18.0-553.184.1.el8_10
Oracle Linux x86_64
kernel-tools-libs-devel
4.18.0-553.184.1.el8_10
bpftool
4.18.0-553.184.1.el8_10
kernel
4.18.0-553.184.1.el8_10
kernel-abi-stablelists
4.18.0-553.184.1.el8_10
kernel-core
4.18.0-553.184.1.el8_10
kernel-cross-headers
4.18.0-553.184.1.el8_10
kernel-debug
4.18.0-553.184.1.el8_10
kernel-debug-core
4.18.0-553.184.1.el8_10
kernel-debug-devel
4.18.0-553.184.1.el8_10
kernel-debug-modules
4.18.0-553.184.1.el8_10
kernel-debug-modules-extra
4.18.0-553.184.1.el8_10
kernel-devel
4.18.0-553.184.1.el8_10
kernel-doc
4.18.0-553.184.1.el8_10
kernel-headers
4.18.0-553.184.1.el8_10
kernel-modules
4.18.0-553.184.1.el8_10
kernel-modules-extra
4.18.0-553.184.1.el8_10
kernel-tools
4.18.0-553.184.1.el8_10
kernel-tools-libs
4.18.0-553.184.1.el8_10
perf
4.18.0-553.184.1.el8_10
python3-perf
4.18.0-553.184.1.el8_10
Ссылки на источники
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
In the Linux kernel, the following vulnerability has been resolved: sctp: stream: fully roll back denied add-stream state When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions.
