[El-errata] ELSA-2026-43307 Important: Oracle Linux 9 kernel security, bug fix, and enhancement update

Tue Jul 28 11:04:59 UTC 2026

Oracle Linux Security Advisory ELSA-2026-43307

http://linux.oracle.com/errata/ELSA-2026-43307.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-abi-stablelists-5.14.0-687.29.1.el9_8.noarch.rpm
kernel-core-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-cross-headers-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-core-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-devel-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-devel-matched-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-modules-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-debug-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-devel-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-devel-matched-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-doc-5.14.0-687.29.1.el9_8.noarch.rpm
kernel-headers-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-modules-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-tools-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-tools-libs-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm
kernel-uki-virt-addons-5.14.0-687.29.1.el9_8.x86_64.rpm
libperf-5.14.0-687.29.1.el9_8.x86_64.rpm
perf-5.14.0-687.29.1.el9_8.x86_64.rpm
python3-perf-5.14.0-687.29.1.el9_8.x86_64.rpm
rtla-5.14.0-687.29.1.el9_8.x86_64.rpm
rv-5.14.0-687.29.1.el9_8.x86_64.rpm

aarch64:
kernel-cross-headers-5.14.0-687.29.1.el9_8.aarch64.rpm
kernel-headers-5.14.0-687.29.1.el9_8.aarch64.rpm
kernel-tools-5.14.0-687.29.1.el9_8.aarch64.rpm
kernel-tools-libs-5.14.0-687.29.1.el9_8.aarch64.rpm
kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.aarch64.rpm
libperf-5.14.0-687.29.1.el9_8.aarch64.rpm
perf-5.14.0-687.29.1.el9_8.aarch64.rpm
python3-perf-5.14.0-687.29.1.el9_8.aarch64.rpm
rtla-5.14.0-687.29.1.el9_8.aarch64.rpm
rv-5.14.0-687.29.1.el9_8.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-687.29.1.el9_8.src.rpm

Related CVEs:

CVE-2025-71113
CVE-2026-23110
CVE-2026-46150
CVE-2026-46215
CVE-2026-53071

Description of changes:

[5.14.0-687.29.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.29.1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]

[5.14.0-687.28.1]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}

[5.14.0-687.27.1]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]