[El-errata] ELSA-2026-500121 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-500121

http://linux.oracle.com/errata/ELSA-2026-500121.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-container-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-container-debug-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-debug-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-debug-devel-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-devel-5.4.17-2136.358.2.el8uek.x86_64.rpm
kernel-uek-doc-5.4.17-2136.358.2.el8uek.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-uek-5.4.17-2136.358.2.el8uek.src.rpm

Related CVEs:

CVE-2026-43038
CVE-2026-43499
CVE-2026-46043
CVE-2026-46331
CVE-2026-64600




Description of changes:

[5.4.17-2136.358.2]
- xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong)  [Orabug: 39776792]  {CVE-2026-64600}
- net: Work around Marvell NIC TX stalls (Venkat Venkatsubra)  [Orabug: 39765820]

[5.4.17-2136.358.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini)  [Orabug: 39673871]
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon)  [Orabug: 39673871]
- KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini)  [Orabug: 39673871]
- KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu)  [Orabug: 39673871]
- KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini)  [Orabug: 39673871]
- KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack)  [Orabug: 39673871]
- KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack)  [Orabug: 39673871]
- KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan)  [Orabug: 39673871]
- KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan)  [Orabug: 39673871]
- KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan)  [Orabug: 39673871]
- KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (David Matlack)  [Orabug: 39673871]
- KVM: x86/mmu: Use a bool for direct (David Matlack)  [Orabug: 39673871]
- kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon)  [Orabug: 39673871]
- KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson)  [Orabug: 39673871]
- KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson)  [Orabug: 39673871]
- Revert "net/rds: poll eq during user-reset" (Praveen Kumar Kannoju)  [Orabug: 39659401]
- net/sched: act_pedit: fix action bind logic (Pedro Tammela)  [Orabug: 39567287]
- net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela)  [Orabug: 39567287]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)  [Orabug: 39567287]  {CVE-2026-46331}
- net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham)  [Orabug: 39567287]
- net/sched: act_pedit: rate limit datapath messages (Pedro Tammela)  [Orabug: 39567287]
- net/sched: act_pedit: check static offsets a priori (Pedro Tammela)  [Orabug: 39567287]
- net/sched: act_pedit: remove extra check for key type (Pedro Tammela)  [Orabug: 39567287]
- net/sched: simplify tcf_pedit_act (Pedro Tammela)  [Orabug: 39567287]
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela)  [Orabug: 39567287]
- net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela)  [Orabug: 39567287]
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (hkbinbin)  [Orabug: 39452261]  {CVE-2026-46043}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso)  [Orabug: 39426001]
- rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong)  [Orabug: 39426001]  {CVE-2026-43499}
- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet)  [Orabug: 39300930]  {CVE-2026-43038}
- tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil)  [Orabug: 38790406]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju)  [Orabug: 38776184]