[El-errata] ELSA-2026-94485 Moderate: Oracle Linux 8 cockpit security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-94485

http://linux.oracle.com/errata/ELSA-2026-94485.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
cockpit-310.10-1.0.1.el8_10.x86_64.rpm
cockpit-bridge-310.10-1.0.1.el8_10.x86_64.rpm
cockpit-doc-310.10-1.0.1.el8_10.noarch.rpm
cockpit-system-310.10-1.0.1.el8_10.noarch.rpm
cockpit-ws-310.10-1.0.1.el8_10.x86_64.rpm

aarch64:
cockpit-310.10-1.0.1.el8_10.aarch64.rpm
cockpit-bridge-310.10-1.0.1.el8_10.aarch64.rpm
cockpit-doc-310.10-1.0.1.el8_10.noarch.rpm
cockpit-system-310.10-1.0.1.el8_10.noarch.rpm
cockpit-ws-310.10-1.0.1.el8_10.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/cockpit-310.10-1.0.1.el8_10.src.rpm

Related CVEs:

CVE-2026-76235
CVE-2026-91147




Description of changes:

[310.10-1.0.1]
- Fixed cockpit_ws_t selinux issue for tmpfs [Orabug: 36013589]
- Move update-motd out of cockpit_ws_t context [Orabug: 36013589]
- Update documentation links [Orabug: 34706402]
- Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110]
- Remove duplicate reference to server in cockpit [Orabug: 33862832]
- Update documentation links [Orabug: 32795691]
- Make documentation links point to Oracle Linux information [Orabug: 30271413] [Orabug: 32013095]
- Fix rendering of hwinfo page on systems with some empty memory slots [Orabug: 32826970]

[310.10]
- Remove recommends on subscription-manager-cockpit if applicable

[310.10-1]
- ws: don't crash when urlroot has no trailing slash (RHEL-262904) [CVE-2026-91147]
- ws: Free language string also when it comes from the cookie (RHEL-244631) [CVE-2026-76235]
- packagekit: Sanitize markdown urls [CVE-2026-91148]