[El-errata] New Ksplice updates for UEKR7 5.15.0 on OL8 and OL9 (ELSA-2026-500377)

Wed Oct 28 07:20:16 UTC 2026

Synopsis: ELSA-2026-500377 can now be patched using Ksplice
CVEs: CVE-2025-38653 CVE-2025-68794 CVE-2026-64564 CVE-2026-64581 CVE-2026-64582 CVE-2026-68476 CVE-2026-72323 CVE-2026-74582 CVE-2026-74662 CVE-2026-74668 CVE-2026-80789 CVE-2026-80792 CVE-2026-80793 CVE-2026-80809 CVE-2026-80840 CVE-2026-80842 CVE-2026-80843 CVE-2026-80863 CVE-2026-80977 CVE-2026-89478 CVE-2026-89482 CVE-2026-89494 CVE-2026-89495 CVE-2026-89515 CVE-2026-89532 CVE-2026-89538 CVE-2026-89542 CVE-2026-89548 CVE-2026-89563 CVE-2026-89603 CVE-2026-89653 CVE-2026-89673 CVE-2026-89674 CVE-2026-89696 CVE-2026-89783 CVE-2026-90248 CVE-2026-90307 CVE-2026-90413 CVE-2026-90414 CVE-2026-98260 CVE-2026-98432 CVE-2026-99999

Users with Oracle Linux Premier Support can now use Ksplice to patch
against the latest Oracle Linux Security Advisory, ELSA-2026-500377.
More information about this errata can be found at
https://linux.oracle.com/errata/ELSA-2026-500377.html

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running UEKR7 5.15.0 on
OL8 and OL9 install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y

DESCRIPTION

* CVE-2025-38653: Use-after-free in /proc filesystem.

Orabug: 39768459

* CVE-2025-68794: Out-of-bounds memory access in block layer driver.

* CVE-2026-64564: Use-after-free in SCTP address deletion.

Orabug: 39830606

* CVE-2026-64581: Use-after-free in XFRM driver.

* CVE-2026-64582: Use-after-free in RDMA RXE mmap.

Orabug: 39839301

* CVE-2026-68476: Use-after-free in IPVS forwarding.

* CVE-2026-72323: Use-after-free in TCP/IP networking driver.

* CVE-2026-74582: Out-of-bounds write in AF_PACKET send.

* CVE-2026-74662: Use-after-free in IPv4 fragment reassembly.

* CVE-2026-74668: Out-of-bounds memory access in Packet socket driver.

* CVE-2026-80789: Remote resource exhaustion in NVMe-over-Fabrics driver.

* CVE-2026-80792: Use-after-free in IPv6 output.

* CVE-2026-80793: Soft-lockup in IPv4 networking stack.

* CVE-2026-80809: Kernel panic in OCFS2 filesystem.

* CVE-2026-80840: Stale control block in IPv6 segment routing.

* CVE-2026-80842: Use-after-free in bridge multicast.

* CVE-2026-80843: Memory leak in XFRM driver.

* CVE-2026-80863: Out-of-bounds write in RDMA RXE.

* CVE-2026-80977: Shared zerocopy state corruption in skb_tx_error.

* CVE-2026-89478: Use-after-free in SCTP packet handling.

* CVE-2026-89482: Out-of-bounds access in NVMe/TCP C2HData handling.

* CVE-2026-89494: Out-of-bounds access in OCFS2 DLM lock migration.

* CVE-2026-89495: Out-of-bounds access in OCFS2 DLM migration.

* CVE-2026-89515: Information leak in SCSI DMA padding.

* CVE-2026-89532: Out-of-bounds access in RPC-over-RDMA chunks.

* CVE-2026-89538: Malformed token handling in SUNRPC Kerberos unwrap.

* CVE-2026-89542: Out-of-bounds access in SUNRPC Kerberos unwrap.

* CVE-2026-89548: Use-after-free in SUNRPC cache cleaner.

* CVE-2026-89563: Use-after-free in IPv6 tunnel transmit.

* CVE-2026-89603: Seccomp bypass after ptrace.

* CVE-2026-89653: Out-of-bounds write in Ceph MDS map handling.

* CVE-2026-89673: Information leak in NFSD flexfile device encoding.

* CVE-2026-89674: Out-of-bounds write in NFSD flexfile layout encoding.

* CVE-2026-89696: NULL pointer dereference in NFSD foreign filehandles.

* CVE-2026-89783: Out-of-bounds write in IPv6 XFRM.

* CVE-2026-90248: Unintended classifier removal in traffic control.

* CVE-2026-90307: Information leak in SRP request handling.

* CVE-2026-90413: Out-of-bounds read in iSER login handling.

* CVE-2026-90414: Out-of-bounds read in iSER PDU handling.

* CVE-2026-98260: Use-after-free during POSIX timer cleanup on exec.

* CVE-2026-98432: Use-after-free in IPv4 networking stack.

Orabug: 40167661

* CVE-2026-99999: Out-of-bounds memory access in IPv4 networking stack.

Orabug: 40167656

* Information disclosure in vhost-scsi.

* Reference count leak in vhost-scsi.

* Write-tracking bypass due to stale KVM MMIO cache.

* Note: Oracle has determined some CVEs are not applicable.

The kernel is not affected by the following CVEs
since the code under consideration is not compiled.

CVE-2024-58094, CVE-2024-58095, CVE-2026-72023, CVE-2026-74647,
CVE-2026-80547, CVE-2026-80548, CVE-2026-80552, CVE-2026-80553,
CVE-2026-80555, CVE-2026-80562, CVE-2026-80583, CVE-2026-80768,
CVE-2026-80794, CVE-2026-80795, CVE-2026-80796, CVE-2026-80797,
CVE-2026-80798, CVE-2026-80799, CVE-2026-80800, CVE-2026-80801,
CVE-2026-80802, CVE-2026-80803, CVE-2026-80807, CVE-2026-80823,
CVE-2026-80826, CVE-2026-80831, CVE-2026-80832, CVE-2026-80846,
CVE-2026-80848, CVE-2026-80921

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: This is a digitally signed message part
URL: <http://oss.oracle.com/pipermail/el-errata/attachments/20261028/f504e1f3/attachment.sig>