[El-errata] ELSA-2026-68507 Important: Oracle Linux 10 kernel security, bug fix, and enhancement update

Errata Announcements for Oracle Linux el-errata at oss.oracle.com
Mon Sep 21 13:23:55 UTC 2026 

Oracle Linux Security Advisory ELSA-2026-68507

http://linux.oracle.com/errata/ELSA-2026-68507.html

The following updated rpms for Oracle Linux 10 have been uploaded to the Unbreakable Linux Network:

x86_64:
kernel-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-abi-stablelists-6.12.0-211.56.1.el10_2.noarch.rpm
kernel-core-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-cross-headers-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-core-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-devel-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-devel-matched-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-modules-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-modules-core-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-modules-extra-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-debug-uki-virt-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-devel-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-devel-matched-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-doc-6.12.0-211.56.1.el10_2.noarch.rpm
kernel-headers-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-modules-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-modules-core-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-modules-extra-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-modules-extra-matched-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-tools-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-tools-libs-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-tools-libs-devel-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-uki-virt-6.12.0-211.56.1.el10_2.x86_64.rpm
kernel-uki-virt-addons-6.12.0-211.56.1.el10_2.x86_64.rpm
libperf-6.12.0-211.56.1.el10_2.x86_64.rpm
perf-6.12.0-211.56.1.el10_2.x86_64.rpm
python3-perf-6.12.0-211.56.1.el10_2.x86_64.rpm
rtla-6.12.0-211.56.1.el10_2.x86_64.rpm
rv-6.12.0-211.56.1.el10_2.x86_64.rpm

aarch64:
kernel-cross-headers-6.12.0-211.56.1.el10_2.aarch64.rpm
kernel-headers-6.12.0-211.56.1.el10_2.aarch64.rpm
kernel-tools-6.12.0-211.56.1.el10_2.aarch64.rpm
kernel-tools-libs-6.12.0-211.56.1.el10_2.aarch64.rpm
kernel-tools-libs-devel-6.12.0-211.56.1.el10_2.aarch64.rpm
libperf-6.12.0-211.56.1.el10_2.aarch64.rpm
perf-6.12.0-211.56.1.el10_2.aarch64.rpm
python3-perf-6.12.0-211.56.1.el10_2.aarch64.rpm
rtla-6.12.0-211.56.1.el10_2.aarch64.rpm
rv-6.12.0-211.56.1.el10_2.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol10/SRPMS-updates/kernel-6.12.0-211.56.1.el10_2.src.rpm

Related CVEs:

CVE-2024-58007
CVE-2026-23172
CVE-2026-52971
CVE-2026-53176
CVE-2026-53192
CVE-2026-53193
CVE-2026-63869
CVE-2026-63923
CVE-2026-64029
CVE-2026-64175
CVE-2026-64176
CVE-2026-64414
CVE-2026-64456
CVE-2026-68128
CVE-2026-68143
CVE-2026-68200
CVE-2026-68294
CVE-2026-68363
CVE-2026-72102




Description of changes:

[6.12.0-211.56.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage

[6.12.0-211.56.1]
- redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518]
- hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518]
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518]
- hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518]
- hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518]
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363}
- wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175}
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176}
- net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172}
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869}
- smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105]
- time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225]
- clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519]
- configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519]
- clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519]
- arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519]
- ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519]
- redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516]
- arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516]
- nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516]
- dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516]
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045}
- octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923}
- dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102}
- net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143}
- net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294}
- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776]
- ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128}
- ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200}
- netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414}
- net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971}
- ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192}
- ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029}
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456}
- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176}
- soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007}

More information about the El-errata mailing list