ELBA-2026-21706-1

ELBA-2026-21706-1 - kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-05-29

Description

[4.18.0-553.126.1.0.1]
- scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]

[4.18.0-553.126.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.126.1]
- crypto: af_alg - Work around empty control messages without MSG_MORE (Thomas Huth) [RHEL-175772]
- crypto: af_alg - Fix regression on empty requests (Thomas Huth) [RHEL-175772]
- crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() (Thomas Huth) [RHEL-175772]
- crypto: af_alg - remove redundant initializations of sk_family (Thomas Huth) [RHEL-175772]
- crypto: af_alg - Use bh_lock_sock in sk_destruct (Thomas Huth) [RHEL-175772]
- crypto: algif_aead - fix uninitialized ctx->init (Thomas Huth) [RHEL-175772]
- crypto: algif_aead - Only wake up when ctx->more is zero (Thomas Huth) [RHEL-175772]
- crypto: algif_aead - Do not set MAY_BACKLOG on the async path (Thomas Huth) [RHEL-175772]
- crypto: null - Remove VLA usage of skcipher (Thomas Huth) [RHEL-175772]
- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172815]
- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172815]
- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172815]
- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172815]
- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172815] {CVE-2026-31709}
- smb: client: Return a status code only as a constant in sid_to_id() (Paulo Alcantara) [RHEL-172815]
- cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172815]
- cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172815]
- smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172815]
- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174212] {CVE-2026-43190}
- md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174088] {CVE-2026-43163}
- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158}
- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174045] {CVE-2026-43158}
- can: raw: fix ro->uniq use-after-free in raw_rcv() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
- can: af_can: export can_sock_destruct() (Davide Caratti) [RHEL-170753] {CVE-2026-31532}
- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172734] {CVE-2026-43051}
- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172614] {CVE-2026-43027}
- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172566] {CVE-2026-43020}
- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165057] {CVE-2026-31408}
- Bluetooth: SCO: Fix UAF on sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408}
- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (David Marlin) [RHEL-165057] {CVE-2026-31408}
- Bluetooth: Init sk_peer_* on bt_sock_alloc (David Marlin) [RHEL-165057] {CVE-2026-31408}
- Bluetooth: Consolidate code around sk_alloc into a helper function (David Marlin) [RHEL-165057] {CVE-2026-31408}
- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171149] {CVE-2026-31685}
- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171132] {CVE-2026-31684}
- smb: client: fix mid_q_entry memleak leak with per-mid locking (Paulo Alcantara) [RHEL-164032]
- smb: client: smb: client: eliminate mid_flags field (Paulo Alcantara) [RHEL-164032]
- smb: client: add mid_counter_lock to protect the mid counter counter (Paulo Alcantara) [RHEL-164032]
- smb: client: rename server mid_lock to mid_queue_lock (Paulo Alcantara) [RHEL-164032]
- smb3: fix lock ordering potential deadlock in cifs_sync_mid_result (Paulo Alcantara) [RHEL-164032]
- smb: client: remove redundant lstrp update in negotiate protocol (Paulo Alcantara) [RHEL-164032]
- smb: client: fix race condition in negotiate timeout by using more precise timing (Paulo Alcantara) [RHEL-164032]
- smb: client: fix first command failure during re-negotiation (Paulo Alcantara) [RHEL-164032]
- smb: client: fix hang in wait_for_response() for negproto (Paulo Alcantara) [RHEL-164032]
- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166886] {CVE-2025-68183}
- selftests/bpf: Test outer map update operations in syscall program (Viktor Malik) [RHEL-152219]
- selftests/bpf: Add test cases for inner map (Viktor Malik) [RHEL-152219]
- bpf: prepare for more bpf syscall to be used from kernel and user space. (Viktor Malik) [RHEL-152219]
- bpf: Optimize the free of inner map (Viktor Malik) [RHEL-152219]
- bpf: Defer the free of inner map when necessary (Viktor Malik) [RHEL-152219]
- bpf: Set need_defer as false when clearing fd array during map free (Viktor Malik) [RHEL-152219]
- bpf: Add map and need_defer parameters to .map_fd_put_ptr() (Viktor Malik) [RHEL-152219]
- bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers (Viktor Malik) [RHEL-152219]
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166981] {CVE-2026-23455}
- ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (CKI Backport Bot) [RHEL-166960] {CVE-2025-68347}
- RDMA/umad: Reject negative data_len in ib_umad_write (Kamal Heib) [RHEL-156872] {CVE-2026-23243}
- Bluetooth: mgmt: remove NULL check in add_ext_adv_params_complete() (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (David Marlin) [RHEL-122890]
- Bluetooth: ISO: don't try to remove CIG if there are bound CIS left (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Don't double print name in add/remove adv_monitor (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() (David Marlin) [RHEL-122890]
- Bluetooth: hci_event: Fix Invalid wait context (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Fix use HCI_OP_LE_READ_BUFFER_SIZE_V2 (David Marlin) [RHEL-122890]
- Bluetooth: hci_conn: Fix crash on hci_create_cis_sync (David Marlin) [RHEL-122890]
- Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect (David Marlin) [RHEL-122890]
- Bluetooth: Fix HCIGETDEVINFO regression (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Fix hci_read_buffer_size_sync (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: fix double mgmt_pending_free() in remove_adv_monitor() (David Marlin) [RHEL-122890]
- Bluetooth: hci_conn: Fix updating ISO QoS PHY (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix possible UAFs (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: hci_sync: fix set_local_name race condition (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: hci_sync: Add helper functions to manipulate cmd_sync queue (David Marlin) [RHEL-122890]
- Bluetooth: Fix race condition in hci_cmd_sync_clear (David Marlin) [RHEL-122890]
- Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Protect mgmt_pending list with its own lock (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix sparse errors (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (David Marlin) [RHEL-122890]
- Bluetooth: Add initial implementation of CIS connections (David Marlin) [RHEL-122890]
- Bluetooth: hci_core: Fix possible buffer overflow (David Marlin) [RHEL-122890]
- Bluetooth: Keep MGMT pending queue ordered FIFO (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Remove unused mgmt_pending_find_data (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync (David Marlin) [RHEL-122890]
- Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor (David Marlin) [RHEL-122890]
- Bluetooth: MGMT: Fix possible deadlocks (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: hci_sync: Refactor remove Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: hci_sync: Refactor add Adv Monitor (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: msft: Move code snippet to correct location (David Marlin) [RHEL-122890]
- Bluetooth: msft: Clear tracked devices on resume (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: mgmt: Add MGMT Adv Monitor Device Found/Lost events (David Marlin) [RHEL-122890] {CVE-2025-39981}
- Bluetooth: msft: Handle MSFT Monitor Device Event (David Marlin) [RHEL-122890] {CVE-2025-39981}
- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157322] {CVE-2026-23270}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142093] {CVE-2025-71116}

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (x86_64)	kernel-4.18.0-553.126.1.0.1.el8_10.src.rpm	7ac89b6b698500972703331de0ba7607174963aa7566c3aa19888630aedd22e9	-	ol8_x86_64_MODRHCK
	bpftool-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	0dd74e9add8dbbed6ea3582eb4abd8649a820e3542075231eedec18eeef5883a	-	ol8_x86_64_MODRHCK
	kernel-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	9ee56de0bfe19f5c0e494a0e5c0159c228d304c2428232c999db248e9fcc3af9	-	ol8_x86_64_MODRHCK
	kernel-abi-stablelists-4.18.0-553.126.1.0.1.el8_10.noarch.rpm	59eac59ea83758d32cd6e5543d0d774515d67b0f4a3660b505593ce89ee1c2c5	-	ol8_x86_64_MODRHCK
	kernel-core-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	bf7f81006fb604faf7057c21920b335799f1ddba11bb8c79adf4fa993f446301	-	ol8_x86_64_MODRHCK
	kernel-cross-headers-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	be00fbab01eb5660bf59026e87b4b01f00f6f663f365181ad9ba085bca920886	-	ol8_x86_64_MODRHCK
	kernel-debug-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	b0081b64772f7da444af2af5b8ddafaf5296db3ea4f884af12adbe0a7fb68359	-	ol8_x86_64_MODRHCK
	kernel-debug-core-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	cbb2d91e5d2877ca2ed706f4f624c608e1c747592f77191c30bf2653dedac2d0	-	ol8_x86_64_MODRHCK
	kernel-debug-devel-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	fdb21c1c30408fcd138e87e33ae7ea1ba3a3370f96f21fcd221d667f612382b3	-	ol8_x86_64_MODRHCK
	kernel-debug-modules-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	3866e1fcbd27eac9e7c5634b321e680ff4f8b48739431da20b0a15be6907fbfd	-	ol8_x86_64_MODRHCK
	kernel-debug-modules-extra-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	1582417fd725a7dab86aebb17261e789001dd7cbb30594b3b61f903f2acc48bb	-	ol8_x86_64_MODRHCK
	kernel-devel-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	03f427758c3c375aee6bdda2abe4f753af0c5793b4f21e89e6ee7ad1930d1e4b	-	ol8_x86_64_MODRHCK
	kernel-doc-4.18.0-553.126.1.0.1.el8_10.noarch.rpm	5b174fc15adeb39f03e2a7919b845c134a9c8cd5d46a68f1f1cf21dc05ece0b3	-	ol8_x86_64_MODRHCK
	kernel-headers-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	81e648edd74b23e8c9037b78fd726dc8da646d758f9ef8495289449215c8bb9f	-	ol8_x86_64_MODRHCK
	kernel-modules-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	4f6b7718c82e1d9b773cf979624e8cd327ce73927c52e38d194a52ec8cfbab82	-	ol8_x86_64_MODRHCK
	kernel-modules-extra-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	d79d04813eb58cadafb94d631d888bbb070368deb3b55c1d686cb138cb1ab240	-	ol8_x86_64_MODRHCK
	kernel-tools-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	be2bf5d2fe1efb63ffa6ad68e61ca2c9c055165938c45e380a60d03aed870033	-	ol8_x86_64_MODRHCK
	kernel-tools-libs-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	dde404fac7d51158c3ce0ed44c9914251ef55fc80a21c615a79417fda0a3ba7a	-	ol8_x86_64_MODRHCK
	kernel-tools-libs-devel-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	9283bdbae6efa119fda4befbd74c508b2ccaa8e93e6f71f198becc601b5a1ce8	-	ol8_x86_64_MODRHCK
	perf-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	a85eace45129ea0a66f623181090ededf8680690cefd95ab716066b0a1742051	-	ol8_x86_64_MODRHCK
	python3-perf-4.18.0-553.126.1.0.1.el8_10.x86_64.rpm	e6f1cc893a944ce0e8ba91fd6759ac93870295deba76c48211e3f9c879750aff	-	ol8_x86_64_MODRHCK

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team