[El-errata] ELSA-2026-63014-0 Important: Oracle Linux 8 kernel security, bug fix, and enhancement update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2026-63014-0

http://linux.oracle.com/errata/ELSA-2026-63014-0.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-abi-stablelists-4.18.0-553.159.1.el8_10.noarch.rpm
kernel-core-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-cross-headers-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-debug-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-debug-core-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-debug-devel-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-debug-modules-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-debug-modules-extra-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-devel-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-doc-4.18.0-553.159.1.el8_10.noarch.rpm
kernel-headers-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-modules-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-modules-extra-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-tools-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-tools-libs-4.18.0-553.159.1.el8_10.x86_64.rpm
kernel-tools-libs-devel-4.18.0-553.159.1.el8_10.x86_64.rpm
perf-4.18.0-553.159.1.el8_10.x86_64.rpm
python3-perf-4.18.0-553.159.1.el8_10.x86_64.rpm

aarch64:
bpftool-4.18.0-553.159.1.el8_10.aarch64.rpm
kernel-cross-headers-4.18.0-553.159.1.el8_10.aarch64.rpm
kernel-headers-4.18.0-553.159.1.el8_10.aarch64.rpm
kernel-tools-4.18.0-553.159.1.el8_10.aarch64.rpm
kernel-tools-libs-4.18.0-553.159.1.el8_10.aarch64.rpm
kernel-tools-libs-devel-4.18.0-553.159.1.el8_10.aarch64.rpm
perf-4.18.0-553.159.1.el8_10.aarch64.rpm
python3-perf-4.18.0-553.159.1.el8_10.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-553.159.1.el8_10.src.rpm

Related CVEs:

CVE-2024-57849
CVE-2025-71132
CVE-2026-45970
CVE-2026-53185
CVE-2026-53391
CVE-2026-53392
CVE-2026-53397
CVE-2026-53399
CVE-2026-63800
CVE-2026-64018
CVE-2026-64268
CVE-2026-64298
CVE-2026-68480
CVE-2026-74581




Description of changes:

[4.18.0-553.159.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.159.1]
- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581}
- powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144]
- powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144]
- RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392}
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480}
- x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492]
(Waiman Long) [RHEL-230492]
- smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
- net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970}
- s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849}
- RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045]