[El-errata] ELSA-2026-93412 Important: Oracle Linux 9 kernel security, bug fix, and enhancement update

Wed Nov 4 12:17:02 UTC 2026

Oracle Linux Security Advisory ELSA-2026-93412

http://linux.oracle.com/errata/ELSA-2026-93412.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-abi-stablelists-5.14.0-687.64.1.el9_8.noarch.rpm
kernel-core-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-cross-headers-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-core-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-devel-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-devel-matched-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-modules-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-modules-core-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-modules-extra-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-debug-uki-virt-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-devel-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-devel-matched-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-doc-5.14.0-687.64.1.el9_8.noarch.rpm
kernel-headers-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-modules-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-modules-core-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-modules-extra-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-tools-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-tools-libs-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-tools-libs-devel-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-uki-virt-5.14.0-687.64.1.el9_8.x86_64.rpm
kernel-uki-virt-addons-5.14.0-687.64.1.el9_8.x86_64.rpm
libperf-5.14.0-687.64.1.el9_8.x86_64.rpm
perf-5.14.0-687.64.1.el9_8.x86_64.rpm
python3-perf-5.14.0-687.64.1.el9_8.x86_64.rpm
rtla-5.14.0-687.64.1.el9_8.x86_64.rpm
rv-5.14.0-687.64.1.el9_8.x86_64.rpm

aarch64:
kernel-cross-headers-5.14.0-687.64.1.el9_8.aarch64.rpm
kernel-headers-5.14.0-687.64.1.el9_8.aarch64.rpm
kernel-tools-5.14.0-687.64.1.el9_8.aarch64.rpm
kernel-tools-libs-5.14.0-687.64.1.el9_8.aarch64.rpm
kernel-tools-libs-devel-5.14.0-687.64.1.el9_8.aarch64.rpm
libperf-5.14.0-687.64.1.el9_8.aarch64.rpm
perf-5.14.0-687.64.1.el9_8.aarch64.rpm
python3-perf-5.14.0-687.64.1.el9_8.aarch64.rpm
rtla-5.14.0-687.64.1.el9_8.aarch64.rpm
rv-5.14.0-687.64.1.el9_8.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-687.64.1.el9_8.src.rpm

Related CVEs:

CVE-2026-52929
CVE-2026-53228
CVE-2026-53270
CVE-2026-64303
CVE-2026-68169
CVE-2026-72083
CVE-2026-74283
CVE-2026-74510
CVE-2026-74582
CVE-2026-80586
CVE-2026-89603
CVE-2026-90011
CVE-2026-93787
CVE-2026-93827
CVE-2026-98364
CVE-2026-98432
CVE-2026-98466
CVE-2026-98725

Description of changes:

[5.14.0-687.64.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.64.1]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (CKI Backport Bot) [RHEL-295635] {CVE-2026-98432}
- nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (Maurizio Lombardi) [RHEL-290719] {CVE-2026-98725}
- spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- spi: fsl-lpspi: replace dmaengine_terminate_all() with dmaengine_terminate_sync() (Iker Pedrosa) [RHEL-234297] {CVE-2026-64303}
- xfrm: hold net_device reference under RCU in bundle creation (Abhishek Rawal) [RHEL-277984] {CVE-2026-98364}
- entry: Fix seccomp bypass after ptrace with TSYNC (Audra Mitchell) [RHEL-271399] {CVE-2026-89603}
- smb: client: bound dirent name against end of SMB response in cifs_filldir (CKI Backport Bot) [RHEL-278331] {CVE-2026-93787}
- sctp: stream: fully roll back denied add-stream state (CKI Backport Bot) [RHEL-277123] {CVE-2026-52929}
- tipc: require net admin for TIPCv2 netlink mutators (CKI Backport Bot) [RHEL-273181] {CVE-2026-74283}
- Bluetooth: mgmt: fix UAF in pair command cancellation (CKI Backport Bot) [RHEL-254650] {CVE-2026-74510}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225993] {CVE-2026-53270}

[5.14.0-687.63.1]
- net: skbuff: propagate shared-frag marker in skb_zerocopy() (Xin Long) [RHEL-291166]
- selftests: netfilter: use KHDR_INCLUDES in CFLAGS (Phil Sutter) [RHEL-291352]
- selftests: netfilter: run conntrack_dump_flush in netns (Phil Sutter) [RHEL-291352]
- netfilter: conntrack: make filtering by zone discoverable (Phil Sutter) [RHEL-291352]
- selftests: netfilter: conntrack_dump_flush: remove unused variables and fix typo (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Fix missing return values in conntrack_dump_flush (Phil Sutter) [RHEL-291352]
- selftests: netfilter: remove unused parameter (Phil Sutter) [RHEL-291352]
- selftests: netfilter: Add missing return value (Phil Sutter) [RHEL-291352]
- selftests: netfilter: fix conntrack_dump_flush retval on unsupported kernel (Phil Sutter) [RHEL-291352]
- netfilter: report NLM_F_DUMP_FILTERED when all is filtered out (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: fix filtering for zone 0 (Phil Sutter) [RHEL-291352]
- netfilter: ctnetlink: support filtering by zone (Phil Sutter) [RHEL-291352]
- KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CKI Backport Bot) [RHEL-287053] {CVE-2026-98466}
- mptcp: pm: userspace: fix use-after-free in get_local_id (Prasenjit Mukherjee) [RHEL-236687] {CVE-2026-68169}
- mptcp: options: reset DSS fields in case of unexpected size (Prasenjit Mukherjee) [RHEL-250609] {CVE-2026-80586}
- blk-throttle: fix throtl_data leak during disk release (David Jeffery) [RHEL-250378]
- blk-throttle: fix access race during throttle policy activation (David Jeffery) [RHEL-250378]

[5.14.0-687.62.1]
- virtio-fs: avoid double-free on failed queue setup (Miklos Szeredi) [RHEL-278131] {CVE-2026-93827}
- sched/fair: Proportional newidle balance (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to update_newidle_cost() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Small cleanup to sched_balance_newidle() (Herton R. Krzesinski) [RHEL-288067]
- sched/fair: Revert max_newidle_lb_cost bump (Herton R. Krzesinski) [RHEL-288067]
- scsi: target: iscsi: Reserve a terminator byte for the login payload (CKI Backport Bot) [RHEL-285602] {CVE-2026-90011}
- scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CKI Backport Bot) [RHEL-283505] {CVE-2026-72083}
- arp: do not assume dev_hard_header() does not change skb->head (Guillaume Nault) [RHEL-271130]
- ip6_gre: make ip6gre_header() robust (Guillaume Nault) [RHEL-271130]
- ipv4: ip_gre: make ipgre_header() robust (Guillaume Nault) [RHEL-271127]
- packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244551]
- packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244551] {CVE-2026-74582}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244551]
- ipv6: sit: reload inner IPv6 header after GSO offloads (CKI Backport Bot) [RHEL-225916] {CVE-2026-53228}