[El-errata] ELSA-2026-93925 Important: Oracle Linux 8 bind security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-93925

http://linux.oracle.com/errata/ELSA-2026-93925.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bind-9.11.36-18.el8_10.x86_64.rpm
bind-chroot-9.11.36-18.el8_10.x86_64.rpm
bind-devel-9.11.36-18.el8_10.i686.rpm
bind-devel-9.11.36-18.el8_10.x86_64.rpm
bind-export-devel-9.11.36-18.el8_10.i686.rpm
bind-export-devel-9.11.36-18.el8_10.x86_64.rpm
bind-export-libs-9.11.36-18.el8_10.i686.rpm
bind-export-libs-9.11.36-18.el8_10.x86_64.rpm
bind-libs-9.11.36-18.el8_10.i686.rpm
bind-libs-9.11.36-18.el8_10.x86_64.rpm
bind-libs-lite-9.11.36-18.el8_10.i686.rpm
bind-libs-lite-9.11.36-18.el8_10.x86_64.rpm
bind-license-9.11.36-18.el8_10.noarch.rpm
bind-lite-devel-9.11.36-18.el8_10.i686.rpm
bind-lite-devel-9.11.36-18.el8_10.x86_64.rpm
bind-pkcs11-9.11.36-18.el8_10.x86_64.rpm
bind-pkcs11-devel-9.11.36-18.el8_10.i686.rpm
bind-pkcs11-devel-9.11.36-18.el8_10.x86_64.rpm
bind-pkcs11-libs-9.11.36-18.el8_10.i686.rpm
bind-pkcs11-libs-9.11.36-18.el8_10.x86_64.rpm
bind-pkcs11-utils-9.11.36-18.el8_10.x86_64.rpm
bind-sdb-9.11.36-18.el8_10.x86_64.rpm
bind-sdb-chroot-9.11.36-18.el8_10.x86_64.rpm
bind-utils-9.11.36-18.el8_10.x86_64.rpm
python3-bind-9.11.36-18.el8_10.noarch.rpm

aarch64:
bind-9.11.36-18.el8_10.aarch64.rpm
bind-chroot-9.11.36-18.el8_10.aarch64.rpm
bind-devel-9.11.36-18.el8_10.aarch64.rpm
bind-export-devel-9.11.36-18.el8_10.aarch64.rpm
bind-export-libs-9.11.36-18.el8_10.aarch64.rpm
bind-libs-9.11.36-18.el8_10.aarch64.rpm
bind-libs-lite-9.11.36-18.el8_10.aarch64.rpm
bind-license-9.11.36-18.el8_10.noarch.rpm
bind-lite-devel-9.11.36-18.el8_10.aarch64.rpm
bind-pkcs11-9.11.36-18.el8_10.aarch64.rpm
bind-pkcs11-devel-9.11.36-18.el8_10.aarch64.rpm
bind-pkcs11-libs-9.11.36-18.el8_10.aarch64.rpm
bind-pkcs11-utils-9.11.36-18.el8_10.aarch64.rpm
bind-sdb-9.11.36-18.el8_10.aarch64.rpm
bind-sdb-chroot-9.11.36-18.el8_10.aarch64.rpm
bind-utils-9.11.36-18.el8_10.aarch64.rpm
python3-bind-9.11.36-18.el8_10.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/bind-9.11.36-18.el8_10.src.rpm

Related CVEs:

CVE-2026-19630
CVE-2026-19662
CVE-2026-94300




Description of changes:

[32:9.11.36-18]
- CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG
  UDP message replay

[32:9.11.36-17]
- CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages
  processing of crafted DNS messages

[32:9.11.36-16.17]
- Backport additional checks for the RDATASET_ATTR_ANCIENT flag when
  looking for rdatasetheaders. Functions find_deepest_zonecut() and
  cache_findzonecut() would otherwise pickup headers with the ancient
  flag set, which other threads may attempt to free in the timespan between
  unlocking the read lock and locking the write lock, causing
  need_header_update() and update_header() to work with invalidated data.
  (RHEL-257162)
- Fix CVE-2026-19662. The patch for CVE-2026-11622, which added reference
  counting to rdatasetheaders within rbtdb, introduced a regression where
  under certain timing conditions concurrent recursive queries could cause
  named to crash due to use-after-free.