Описание
ELSA-2026-95370: kernel security update (IMPORTANT)
[5.14.0-687.66.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.66.1]
- s390/qeth: validate user buffer length in SNMP and ARP query ioctls (Jan Polensky) [RHEL-295101] {CVE-2026-80584}
- s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-295162] {CVE-2026-80553}
- s390/zcrypt: Validate length for CCA AES cipher key requests (Jan Polensky) [RHEL-297856] {CVE-2026-68452}
- s390/zcrypt: Validate length for CCA ECC private key requests (Jan Polensky) [RHEL-297864] {CVE-2026-68451}
- net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket (Jan Polensky) [RHEL-298271] {CVE-2026-64541}
- sunrpc: wait for in-flight TLS handshake callback when cancel loses race (Olga Kornievskaia) [RHEL-283645] {CVE-2026-72221}
- sunrpc: pin svc_xprt across the asynchronous TLS handshake callback (Olga Kornievskaia) [RHEL-283259] {CVE-2026-72222}
- fs/resctrl: Fix use-after-free during unmount (Dennis Chen) [RHEL-296700] {CVE-2026-72080}
- powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak (Mamatha Inamdar) [RHEL-295113] {CVE-2026-80571}
- s390/boot: Avoid IPL parameter append past command line (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
- s390/boot: Add sized_strscpy() to enable strscpy() usage (Jan Polensky) [RHEL-292349] {CVE-2026-98403}
- sctp: clear new_transport when removing a peer (CKI Backport Bot) [RHEL-275363] {CVE-2026-74586}
- openvswitch: Fix CT limit teardown use-after-free (Timothy Redaelli) [RHEL-263551] {CVE-2026-89488}
- sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254284] {CVE-2026-74752}
- sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-263317] {CVE-2026-89479}
- sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258776] {CVE-2026-68162}
- sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254364] {CVE-2026-74588}
Обновленные пакеты
Oracle Linux 9
Oracle Linux aarch64
kernel-cross-headers
5.14.0-687.66.1.el9_8
kernel-tools-libs-devel
5.14.0-687.66.1.el9_8
libperf
5.14.0-687.66.1.el9_8
kernel-headers
5.14.0-687.66.1.el9_8
perf
5.14.0-687.66.1.el9_8
python3-perf
5.14.0-687.66.1.el9_8
rtla
5.14.0-687.66.1.el9_8
rv
5.14.0-687.66.1.el9_8
kernel-tools
5.14.0-687.66.1.el9_8
kernel-tools-libs
5.14.0-687.66.1.el9_8
Oracle Linux x86_64
kernel
5.14.0-687.66.1.el9_8
kernel-abi-stablelists
5.14.0-687.66.1.el9_8
kernel-core
5.14.0-687.66.1.el9_8
kernel-debug
5.14.0-687.66.1.el9_8
kernel-debug-core
5.14.0-687.66.1.el9_8
kernel-debug-modules
5.14.0-687.66.1.el9_8
kernel-debug-modules-core
5.14.0-687.66.1.el9_8
kernel-debug-modules-extra
5.14.0-687.66.1.el9_8
kernel-debug-uki-virt
5.14.0-687.66.1.el9_8
kernel-modules
5.14.0-687.66.1.el9_8
kernel-modules-core
5.14.0-687.66.1.el9_8
kernel-modules-extra
5.14.0-687.66.1.el9_8
kernel-tools
5.14.0-687.66.1.el9_8
kernel-tools-libs
5.14.0-687.66.1.el9_8
kernel-uki-virt
5.14.0-687.66.1.el9_8
kernel-uki-virt-addons
5.14.0-687.66.1.el9_8
kernel-debug-devel
5.14.0-687.66.1.el9_8
kernel-debug-devel-matched
5.14.0-687.66.1.el9_8
kernel-devel
5.14.0-687.66.1.el9_8
kernel-devel-matched
5.14.0-687.66.1.el9_8
kernel-doc
5.14.0-687.66.1.el9_8
kernel-headers
5.14.0-687.66.1.el9_8
perf
5.14.0-687.66.1.el9_8
python3-perf
5.14.0-687.66.1.el9_8
rtla
5.14.0-687.66.1.el9_8
rv
5.14.0-687.66.1.el9_8
kernel-cross-headers
5.14.0-687.66.1.el9_8
kernel-tools-libs-devel
5.14.0-687.66.1.el9_8
libperf
5.14.0-687.66.1.el9_8
Ссылки на источники
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_c...
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_c...
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (ne
In the Linux kernel, the following vulnerability has been resolved: n ...
