[El-errata] ELSA-2026-87805 Important: Oracle Linux 9 kernel security, bug fix, and enhancement update

Tue Oct 27 22:44:57 UTC 2026

Oracle Linux Security Advisory ELSA-2026-87805

http://linux.oracle.com/errata/ELSA-2026-87805.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-abi-stablelists-5.14.0-687.60.1.el9_8.noarch.rpm
kernel-core-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-cross-headers-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-core-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-devel-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-devel-matched-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-modules-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-debug-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-devel-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-devel-matched-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-doc-5.14.0-687.60.1.el9_8.noarch.rpm
kernel-headers-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-modules-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-tools-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-tools-libs-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpm
kernel-uki-virt-addons-5.14.0-687.60.1.el9_8.x86_64.rpm
libperf-5.14.0-687.60.1.el9_8.x86_64.rpm
perf-5.14.0-687.60.1.el9_8.x86_64.rpm
python3-perf-5.14.0-687.60.1.el9_8.x86_64.rpm
rtla-5.14.0-687.60.1.el9_8.x86_64.rpm
rv-5.14.0-687.60.1.el9_8.x86_64.rpm

aarch64:
kernel-cross-headers-5.14.0-687.60.1.el9_8.aarch64.rpm
kernel-headers-5.14.0-687.60.1.el9_8.aarch64.rpm
kernel-tools-5.14.0-687.60.1.el9_8.aarch64.rpm
kernel-tools-libs-5.14.0-687.60.1.el9_8.aarch64.rpm
kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.aarch64.rpm
libperf-5.14.0-687.60.1.el9_8.aarch64.rpm
perf-5.14.0-687.60.1.el9_8.aarch64.rpm
python3-perf-5.14.0-687.60.1.el9_8.aarch64.rpm
rtla-5.14.0-687.60.1.el9_8.aarch64.rpm
rv-5.14.0-687.60.1.el9_8.aarch64.rpm

SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates/kernel-5.14.0-687.60.1.el9_8.src.rpm

Related CVEs:

CVE-2025-22063
CVE-2025-38147
CVE-2026-64481
CVE-2026-68202
CVE-2026-68299
CVE-2026-68448
CVE-2026-80530
CVE-2026-80536

Description of changes:

[5.14.0-687.60.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.60.1]
- xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536}
- ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448}
- ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202}
- calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063}
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530}
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299}
- ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481}
- rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029]

[5.14.0-687.59.1]
- net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987]
- ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999}
- smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631}
- exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633}
- strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747]
- xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697]
- xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697]
- xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697]
- bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032}
- net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528]
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958}
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429]
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962}
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963}
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961}
- USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956}
- USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957}
- USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928}
- USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899}
- Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
- openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935}