[El-errata] ELSA-2026-500238 Important: Oracle Linux 8 Unbreakable Enterprise kernel security update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-500238

http://linux.oracle.com/errata/ELSA-2026-500238.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-uek-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-container-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-container-debug-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-debug-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-debug-devel-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-devel-5.4.17-2136.359.3.el8uek.x86_64.rpm
kernel-uek-doc-5.4.17-2136.359.3.el8uek.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-uek-5.4.17-2136.359.3.el8uek.src.rpm

Related CVEs:

CVE-2026-31598
CVE-2026-46116
CVE-2026-52995
CVE-2026-68480




Description of changes:

[5.4.17-2136.359.3]
- Partial revert of "x86/alternatives: Optimize optimize_nops()" (Harshit Mogalapalli)  [Orabug: 39866546]
- Revert "x86/alternatives: Add alt_instr.flags" (Harshit Mogalapalli)  [Orabug: 39866546]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD))  [Orabug: 39784513]  {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner)  [Orabug: 39784513]
- x86/alternative: Support relocations in alternatives (Peter Zijlstra)  [Orabug: 39784513]
- x86/alternative: Make debug-alternative selective (Peter Zijlstra)  [Orabug: 39784513]
- x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD))  [Orabug: 39784513]
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra)  [Orabug: 39784513]
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov)  [Orabug: 39784513]
- x86/alternative: Align insn bytes vertically (Borislav Petkov)  [Orabug: 39784513]
(H. Peter Anvin (Intel))  [Orabug: 39784513]
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra)  [Orabug: 39784513]
- x86: Add insn_decode_kernel() (Peter Zijlstra)  [Orabug: 39784513]
- x86/insn: Add an insn_decode() API (Borislav Petkov)  [Orabug: 39784513]
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross)  [Orabug: 39784513]
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross)  [Orabug: 39784513]
- x86/alternative: Merge include files (Juergen Gross)  [Orabug: 39784513]
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross)  [Orabug: 39784513]
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky)  [Orabug: 39784513]
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik)  [Orabug: 39784513]
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo)  [Orabug: 39784513]
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik)  [Orabug: 39784513]
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik)  [Orabug: 39784513]
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry)  [Orabug: 39784513]
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov)  [Orabug: 39784513]
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39784513]
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra)  [Orabug: 39784513]
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo)  [Orabug: 39784513]
- net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju)  [Orabug: 39681637]

[5.4.17-2136.359.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang)  [Orabug: 39558751]
- rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed)  [Orabug: 39668203]
- rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan)  [Orabug: 39668203]
- net/rds: harden rds_rm_size (Manjunath Patil)  [Orabug: 39812534]
- rds: ib: move gc_count reset before free_percpu (Manjunath Patil)  [Orabug: 39818510]
- rds: fix lfstack_pop_all sequence reset (Manjunath Patil)  [Orabug: 39818510]

[5.4.17-2136.359.1]
- KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil)  [Orabug: 39374251]
- arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King)  [Orabug: 39374251]
- arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior)  [Orabug: 39374251]
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi)  [Orabug: 39273589]  {CVE-2026-31598}
- fs/ocfs2: fix comments mentioning i_mutex (hongnanli)  [Orabug: 39273589]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek)  [Orabug: 39460235]  {CVE-2026-46116}
- net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito)  [Orabug: 39638198] {CVE-2026-52995}
- uek: kabi: update x86_64 kABI files for a new symbol (Saeed Mirzamohammadi)  [Orabug: 39651636]
- IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang)  [Orabug: 39674348]
- IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang)  [Orabug: 39674348]
- fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang)  [Orabug: 39681044]
- mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang)  [Orabug: 39681044]
- mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang)  [Orabug: 39681044]
- xen/ovmapi: terminate values passed to xenbus_write (Joe Jin)  [Orabug: 39726701]
- xen/ovmapi: free queued events on release (Joe Jin)  [Orabug: 39726701]
- xen/ovmapi: prevent duplicate app registration (Joe Jin)  [Orabug: 39726701]
- xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin)  [Orabug: 39726701]
- xen/ovmapi: reject oversized posted event payloads (Joe Jin)  [Orabug: 39726701]
- rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye)  [Orabug: 39772651]
- rds: do not leak kernel memory to user land (Eric Dumazet)  [Orabug: 39772651]