[El-errata] ELSA-2026-18153 Moderate: Oracle Linux 10 systemd security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-18153

http://linux.oracle.com/errata/ELSA-2026-18153.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
systemd-257-23.0.1.el10_2.2.x86_64.rpm
systemd-boot-unsigned-257-23.0.1.el10_2.2.x86_64.rpm
systemd-container-257-23.0.1.el10_2.2.x86_64.rpm
systemd-devel-257-23.0.1.el10_2.2.x86_64.rpm
systemd-journal-remote-257-23.0.1.el10_2.2.x86_64.rpm
systemd-libs-257-23.0.1.el10_2.2.x86_64.rpm
systemd-oomd-257-23.0.1.el10_2.2.x86_64.rpm
systemd-pam-257-23.0.1.el10_2.2.x86_64.rpm
systemd-resolved-257-23.0.1.el10_2.2.x86_64.rpm
systemd-rpm-macros-257-23.0.1.el10_2.2.noarch.rpm
systemd-udev-257-23.0.1.el10_2.2.x86_64.rpm
systemd-ukify-257-23.0.1.el10_2.2.noarch.rpm

aarch64:
systemd-257-23.0.1.el10_2.2.aarch64.rpm
systemd-boot-unsigned-257-23.0.1.el10_2.2.aarch64.rpm
systemd-container-257-23.0.1.el10_2.2.aarch64.rpm
systemd-devel-257-23.0.1.el10_2.2.aarch64.rpm
systemd-journal-remote-257-23.0.1.el10_2.2.aarch64.rpm
systemd-libs-257-23.0.1.el10_2.2.aarch64.rpm
systemd-oomd-257-23.0.1.el10_2.2.aarch64.rpm
systemd-pam-257-23.0.1.el10_2.2.aarch64.rpm
systemd-resolved-257-23.0.1.el10_2.2.aarch64.rpm
systemd-rpm-macros-257-23.0.1.el10_2.2.noarch.rpm
systemd-udev-257-23.0.1.el10_2.2.aarch64.rpm
systemd-ukify-257-23.0.1.el10_2.2.noarch.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/systemd-257-23.0.1.el10_2.2.src.rpm

Related CVEs:

CVE-2025-4598




Description of changes:

[257-23.0.1.el10_2.2]
- Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877]
- Avoid udevadm warnings when using udev valid configs [Orabug: 37503197]
- allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469]
- set "RemoveIPC=no" in logind.conf as default [Orabug: 22224874]
- Fix missing netdev for iscsi entry in fstab [Orabug: 25897792]
- udev rules: fix memory hot add and remove [Orabug: 31310273]
- Disable unprivileged BPF by default [Orabug: 32870980]
- Remove upstream references [Orabug: 33995357]
- Wait for an extra configurable time before udevd kills a worker [Orabug: 36017407]
- Removed unneeded patches from the systemd.spec
- 1004-orabug34272490-0001-core-device-ignore-DEVICE_FOUND_UDEV-bit-on-switchin.patch [Orabug: 34272490]
- 1005-orabug34272490-0002-core-device-drop-unnecessary-condition.patch [Orabug: 34272490]
- 1006-orabug34467234-shutdown-get-only-active-md-arrays.patch [Orabug: 34467234]
- 1007-orabug34868110-pstore-fixes-for-dmesg.txt-reconstruction.patch [Orabug: 34868110]
- 1008-path-drop-IN_ATTRIB-from-parent-directory-watches.patch [Orabug: 36780432]

[257-23.2]
- nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163873)
- nspawn: normalize pivot_root paths (RHEL-163873)
- udev: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev: ensure there is space for trailing NUL before calling sprintf (RHEL-163879)
- udev: ensure tag parsing stays within bounds (RHEL-163879)
- udev: fix review mixup (RHEL-163879)
- udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163879)
- udev-builtin-net-id: print cescaped bad attributes (RHEL-163879)

[257-23.1]
- ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080)
- ci: add bpftool workaround to codeql job too (RHEL-152080)
- ci: fix workaround about bpftool for codeql (RHEL-152080)
- ci: add bpftool workaround to coverity too (RHEL-152080)
- path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080)
- cgroup: port some code over to path_startswith_full() (RHEL-152080)
- path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080)
- sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080)
- core/cgroup: avoid one unnecessary strjoina() (RHEL-152080)
- core: validate input cgroup path more prudently (RHEL-152080)