[El-errata] ELSA-2026-500137 Important: Oracle Linux 9 Unbreakable Enterprise kernel security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-500137

http://linux.oracle.com/errata/ELSA-2026-500137.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-core-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-debug-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-debug-core-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-debug-devel-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-debug-modules-extra-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-devel-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-doc-5.15.0-322.203.3.4.5.el9uek.noarch.rpm
kernel-uek-modules-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-modules-extra-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-container-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm
kernel-uek-container-debug-5.15.0-322.203.3.4.5.el9uek.x86_64.rpm



SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-uek-5.15.0-322.203.3.4.5.el9uek.src.rpm

Related CVEs:

CVE-2026-64531
CVE-2026-64561
CVE-2026-68480




Description of changes:

[5.15.0-322.203.3.4.5]
- KVM: x86/mmu: Stop needlessly making MMU pages available for TDP MMU faults (David Matlack)  [Orabug: 39832946]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)  [Orabug: 39832946]  {CVE-2026-64561}
- KVM: x86/mmu: Rename __direct_map() to direct_map() (David Matlack)  [Orabug: 39832946]
- KVM: x86/mmu: Split out TDP MMU page fault handling (David Matlack)  [Orabug: 39832946]
- KVM: Rename mmu_notifier_* to mmu_invalidate_* (Chao Peng)  [Orabug: 39832946]
- KVM: x86/mmu: Document the "rules" for using host_pfn_mapping_level() (Sean Christopherson)  [Orabug: 39832946]
- KVM: x86/mmu: Rename pte_list_{destroy,remove}() to show they zap SPTEs (Sean Christopherson)  [Orabug: 39832946]
- KVM: x86/mmu: Directly "destroy" PTE list when recycling rmaps (Sean Christopherson)  [Orabug: 39832946]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39784615]  {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner)  [Orabug: 39784615]
- x86/alternative: Support relocations in alternatives (Peter Zijlstra)  [Orabug: 39784615]
- x86/alternative: Make debug-alternative selective (Peter Zijlstra)  [Orabug: 39784615]
- x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD))  [Orabug: 39784615]
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra)  [Orabug: 39784615]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39819205]
- net: openvswitch: reject oversized nested action attrs (Asim Viladi Oglu Manizada)  [Orabug: 39819143]  {CVE-2026-64531}