[El-errata] ELBA-2026-50233 Oracle Linux 9 Unbreakable Enterprise kernel bug fix update

[Errata Announcements for Oracle Linux]

Oracle Linux Bug Fix Advisory ELBA-2026-50233

http://linux.oracle.com/errata/ELBA-2026-50233.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-core-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-debug-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-devel-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-doc-5.15.0-319.201.4.2.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-container-5.15.0-319.201.4.2.el9uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-319.201.4.2.el9uek.x86_64.rpm



SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-319.201.4.2.el9uek.src.rpm



Description of changes:

[5.15.0-319.201.4.2]
- Revert "rds: Drop rds conn in connect worker if not in down state." (Vijayendra Suman)  [Orabug: 39200414]

[5.15.0-319.201.4.1]
- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson)  [Orabug: 39153095]
- vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero)  [Orabug: 39153092]
- vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas)  [Orabug: 39153077]
- vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas)  [Orabug: 39153077]
- net/mlx5: Add IFC bits for migration state (Yishai Hadas)  [Orabug: 39153077]
- vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas)  [Orabug: 39153077]
- vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas)  [Orabug: 39153077]
- vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas)  [Orabug: 39153077]

[5.15.0-319.201.4]
- bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (Michael Chan)  [Orabug: 39086190]
- net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera)  [Orabug: 39080807]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta)  [Orabug: 39065407]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta)  [Orabug: 39065407]
- IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver (Coco Li)  [Orabug: 39065407]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair)  [Orabug: 39045034]
- exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan)  [Orabug: 38567667]
- tools: perf: add comm_ignore_digit column (Stephen Brennan)  [Orabug: 38567667]
- mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka)  [Orabug: 39071712]
- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka)  [Orabug: 39071712]
- rds: Add state field to RDS trace logs. (Rohit Nair)  [Orabug: 38870357]
- i3c: Move device name assignment after i3c_bus_init (Billy Tsai)
- ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet)
- netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera)
- PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle)
- Revert "PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV" (Niklas Schnelle)
- rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin (Nokia))

[5.15.0-319.201.3]
- arm64: pensando: Add non-caching option to capmem/mmap (Rob Gardner)  [Orabug: 39017011]
- PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson)  [Orabug: 39021252]
- PCI: Batch BAR sizing operations (Alex Williamson)  [Orabug: 39021252]
- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong)  [Orabug: 39053373]

[5.15.0-319.201.2]
- LTS version: v5.15.201 (Vijayendra Suman)
- USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda)
- f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang)
- f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu)
- fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman)
- fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li)
- PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song)
- PCI: endpoint: Remove unused field in struct pci_epf_group (Christophe JAILLET)
- PCI: endpoint: Automatically create a function specific attributes group (Damien Le Moal)
- scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy)
- scsi: qla2xxx: Use named initializers for port_[d]state_str (Gleb Chesnokov)
- scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy)
- bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han)
- bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat)
- smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho)
- crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao)
- mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet)
- selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts (NGI0))
- net: dsa: free routing table on probe failure (Vladimir Oltean)
- smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara)
- btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov)
- Revert "wireguard: device: enable threaded NAPI" (Daniel Borkmann)
- gpiolib: acpi: Fix gpio count with string references (Alban Bedel)
- ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo)
- platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki)
- platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki)
- drm/tegra: hdmi: sor: Fix error: variable ‘j’ set but not used (Brahmajit Das)
- romfs: check sb_set_blocksize() return value (Deepanshu Kartikey)
- gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan)
- ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit)
- gpio: omap: do not register driver in probe() (Danilo Krummrich)
- scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy)
- scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy)
- scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy)
- nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis)
- crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao)
- crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook)
- crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum)
- LTS version: v5.15.200 (Vijayendra Suman)
- riscv: Replace function-like macro by static inline function (Björn Töpel)
- nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Varun Prakash)
- spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu)
- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao)
- spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao)
- iommu: disable SVA when CONFIG_X86 is set (Lu Baolu)
- Bluetooth: hci_event: call disconnect callback before deleting conn (Pauli Virtanen)
- gve: Correct ethtool rx_dropped calculation (Max Yuan)
- gve: Fix stats report corruption on queue count change (Debarghya Kundu)
- gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andreas Gruenbacher)
- riscv: uprobes: Add missing fence.i after building the XOL buffer (Björn Töpel)
- ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge)
- nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (YunJe Shin)
- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano)
- hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann)
- tipc: use kfree_sensitive() for session key material (Daniel Hodges)
- macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet)
- dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo)
- net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan)
- net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan)
- dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo)
- platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar)
- platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki)
- wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi)
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi)
- wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam)
- ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros)
- ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi)
- wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang)
- ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Wupeng Ma)
- HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe da Conceição Alves)
- HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu)
- netfilter: replace -EEXIST with -EBUSY (Daniel Gomez)
- ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa)
- HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou)
- HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu)
- HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (DaytonCL)
- smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (ZhangGuoDong)
- block,bfq: fix aux stat accumulation destination (shechenglong)
- net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore)
- wifi: wlcore: ensure skb headroom before skb_push (Peter Åstrand)
- wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee)
- binderfs: fix ida_alloc_max() upper bound (Carlos Llamas)
- Bluetooth: hci_qca: Fix the teardown problem for real (Thomas Gleixner)
- clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
- ARM: spear: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google))
- Documentation: Remove bogus claim about del_timer_sync() (Thomas Gleixner)
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso)
- mm/kfence: randomize the freelist on initialization (Pimyn Girgis)
- KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson)
- ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh)
- rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov)
- platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar)

[5.15.0-319.199.1]
- genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan)  [Orabug: 39001910]
- nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch)  [Orabug: 38928033]
- nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff)  [Orabug: 38928033]
- nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch)  [Orabug: 38928033]
- nvme: ensure disabling pairs with unquiesce (Keith Busch)  [Orabug: 38928033]
- ionic: Rate limit unknown xcvr type messages (Eric Joyner)  [Orabug: 38977644]