[El-errata] ELSA-2026-59821 Important: Oracle Linux 8 kernel security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-59821

http://linux.oracle.com/errata/ELSA-2026-59821.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-abi-stablelists-4.18.0-553.158.1.el8_10.noarch.rpm
kernel-core-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-cross-headers-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-debug-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-debug-core-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-debug-devel-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-debug-modules-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-debug-modules-extra-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-devel-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-doc-4.18.0-553.158.1.el8_10.noarch.rpm
kernel-headers-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-modules-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-modules-extra-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-tools-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-tools-libs-4.18.0-553.158.1.el8_10.x86_64.rpm
kernel-tools-libs-devel-4.18.0-553.158.1.el8_10.x86_64.rpm
perf-4.18.0-553.158.1.el8_10.x86_64.rpm
python3-perf-4.18.0-553.158.1.el8_10.x86_64.rpm

aarch64:
bpftool-4.18.0-553.158.1.el8_10.aarch64.rpm
kernel-cross-headers-4.18.0-553.158.1.el8_10.aarch64.rpm
kernel-headers-4.18.0-553.158.1.el8_10.aarch64.rpm
kernel-tools-4.18.0-553.158.1.el8_10.aarch64.rpm
kernel-tools-libs-4.18.0-553.158.1.el8_10.aarch64.rpm
kernel-tools-libs-devel-4.18.0-553.158.1.el8_10.aarch64.rpm
perf-4.18.0-553.158.1.el8_10.aarch64.rpm
python3-perf-4.18.0-553.158.1.el8_10.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-553.158.1.el8_10.src.rpm

Related CVEs:

CVE-2026-52924
CVE-2026-63886
CVE-2026-63913
CVE-2026-64189
CVE-2026-64191
CVE-2026-64276
CVE-2026-64277
CVE-2026-64320




Description of changes:

[4.18.0-553.158.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.158.1]
- nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320}
- selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800]
- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191}
- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277}
- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276}
- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913}
- netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189}
- sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400]
- sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
- sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400]
- sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
- usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088]
- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924}