[El-errata] ELBA-2026-75747-1 Oracle Linux 8 kernel bug fix update

Wed Oct 7 18:13:12 UTC 2026

Oracle Linux Bug Fix Advisory ELBA-2026-75747-1

http://linux.oracle.com/errata/ELBA-2026-75747-1.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-abi-stablelists-4.18.0-553.171.1.0.1.el8_10.noarch.rpm
kernel-core-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-cross-headers-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-debug-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-debug-core-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-debug-devel-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-debug-modules-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-debug-modules-extra-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-devel-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-doc-4.18.0-553.171.1.0.1.el8_10.noarch.rpm
kernel-headers-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-modules-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-modules-extra-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-tools-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-tools-libs-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
kernel-tools-libs-devel-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
perf-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm
python3-perf-4.18.0-553.171.1.0.1.el8_10.x86_64.rpm

SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-553.171.1.0.1.el8_10.src.rpm

Description of changes:

[4.18.0-553.171.1.0.1]
- scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]

[4.18.0-553.171.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.171.1]
- nvme/ioctl: check SUBMIT_IO with CAP_SYS_ADMIN (Chris Leech) [RHEL-269479] {CVE-2026-90227}
- s390/topology: Use zero-based numbering for containing entities (Jan Polensky) [RHEL-252199]
- s390/vfio_ccw: Implement a crw lock (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Selectively expand io_mutex (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Cancel existing workqueues (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Ensure index for read/write regions are within range (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Calculate idal length based on idaw type (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Ensure first IDAW remains constant (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Fix out of bounds check on CCW array (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Limit the number of channel program segments (Jan Polensky) [RHEL-252194]
- s390/vfio_ccw: Free all memory if cp_init() fails (Jan Polensky) [RHEL-252194]
- nvme-pci: fix mempool alloc size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756}
- nvme-pci: use max of PRP or SGL for iod size (Maurizio Lombardi) [RHEL-230386] {CVE-2022-50756}
- nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270894] {CVE-2026-89972}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270661] {CVE-2026-97417}
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259055] {CVE-2026-52972}
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Jamie Bainbridge) [RHEL-254254]
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Jamie Bainbridge) [RHEL-254254]
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Jamie Bainbridge) [RHEL-254254] {CVE-2026-74744}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-238885] {CVE-2026-68432}
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Jamie Bainbridge) [RHEL-230777] {CVE-2026-63992}
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247003] {CVE-2026-72052}
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Jamie Bainbridge) [RHEL-247023] {CVE-2026-63829}
- net: ip_gre: Accept IFLA_INFO_DATA-less configuration (Jamie Bainbridge) [RHEL-247023]
- net: ip_gre: Separate ERSPAN newlink / changelink callbacks (Jamie Bainbridge) [RHEL-247023]
- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Jamie Bainbridge) [RHEL-259654] {CVE-2026-63994}
- NFSD: Force all NFSv4.2 COPY requests to be synchronous (Roberto Bergantinos Corpas) [RHEL-266661]
- nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263413] {CVE-2026-89481}
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260589] {CVE-2026-74569}
- KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258125] {CVE-2026-80921}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (Mohammad Heib) [RHEL-225698] {CVE-2026-53230}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (Phil Sutter) [RHEL-254393] {CVE-2026-74669}
- ipvs: ensure inner headers in ICMP errors are in headroom (Phil Sutter) [RHEL-254393]
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254507] {CVE-2026-74516}
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252413] {CVE-2026-72255}
- netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250542] {CVE-2026-74746}
- RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kamal Heib) [RHEL-231374] {CVE-2023-54048}
- gfs2: add some missing log locking (Andrew Price) [RHEL-230306] {CVE-2026-53049}
- gfs2: Move gfs2_remove_from_journal to log.c (Andrew Price) [RHEL-230306] {CVE-2026-53049}
- gfs2: Fix unlikely race in gdlm_put_lock (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242}
- gfs2: Unlock fewer glocks on unmount (CKI Backport Bot) [RHEL-231267] {CVE-2025-40242}
- media: tuner: xc5000: Fix use-after-free in xc5000_release (Kate Hsuan) [RHEL-231646] {CVE-2025-39994}
- media: tunner: xc5000: Refactor firmware load (Kate Hsuan) [RHEL-231646]
- net/sched: act_ct: Only release RCU read lock after ct_ft (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
- sched: act_ct: take care of padding in struct zones_ht_key (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
- sched: act_ct: add netns into the key of tcf_ct_flow_table (Ivan Vecera) [RHEL-229652] {CVE-2026-46319}
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232580] {CVE-2026-45856}
- gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227251] {CVE-2026-45861}
- net/sched: qfq: Use cl_is_active to determine whether class is active in qfq_rm_from_ag (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105}
- net_sched: qfq: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-226861] {CVE-2026-23105}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225976] {CVE-2026-53270}
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214936] {CVE-2026-63794}

[4.18.0-553.170.1]
- keys: Do not drop the auth key's request_key_auth reference in revoke (Thomas Huth) [RHEL-270349]
- Tracing: Fix a race condition in register_trace_kprobe() (Jerome Marchand) [RHEL-214136]
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257757] {CVE-2026-72099}
- net/liquidio: drop cached VF pci_dev LUT (Izabela Bakollari) [RHEL-244368] {CVE-2026-72329}
- liquidio: Use pcie_flr() instead of reimplementing it (Izabela Bakollari) [RHEL-244368]
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252809] {CVE-2026-68299}
- RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232567] {CVE-2026-64102}

[4.18.0-553.169.1]
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (Filippo Storniolo) [RHEL-230983] {CVE-2026-64034}
- arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259308] {CVE-2026-63875}
- perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258792] {CVE-2026-74753}
- perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250500] {CVE-2026-64556}
- drm/amdgpu: Fix context pstate override handling (Jocelyn Falempe) [RHEL-236710] {CVE-2026-68273}
- drm/amdgpu: keep amdgpu_ctx_mgr in ctx structure (Jocelyn Falempe) [RHEL-236710]
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Jocelyn Falempe) [RHEL-225309]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225309]
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225309] {CVE-2026-46230}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (Jocelyn Falempe) [RHEL-225430]
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Jocelyn Falempe) [RHEL-225430] {CVE-2026-46199}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (Jocelyn Falempe) [RHEL-226024] {CVE-2026-46204}
- drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages (Jocelyn Falempe) [RHEL-226024]
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (Jocelyn Falempe) [RHEL-230330] {CVE-2025-40323}
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159}
- libceph: Amend checking to fix make W=1 build breakage (CKI Backport Bot) [RHEL-237150] {CVE-2026-68159}
- ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225932] {CVE-2026-45942}
- libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237904] {CVE-2026-68155}
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237472] {CVE-2026-68156}