ELBA-2026-500009

ELBA-2026-500009 - Unbreakable Enterprise kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-07-16

Description

[5.4.17-2136.357.3.3]
- xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) [Orabug: 39711602]

[5.4.17-2136.357.3.2]
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39706958]
- rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39706958] {CVE-2026-43499}

[5.4.17-2136.357.3.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon) [Orabug: 39673892]
- KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu) [Orabug: 39673892]
- KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack) [Orabug: 39673892]
- KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack) [Orabug: 39673892]
- KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan) [Orabug: 39673892]
- KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan) [Orabug: 39673892]
- KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan) [Orabug: 39673892]
- KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Stop passing 'direct' to mmu_alloc_root() (David Matlack) [Orabug: 39673892]
- KVM: x86/mmu: Use a bool for direct (David Matlack) [Orabug: 39673892]
- kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon) [Orabug: 39673892]
- KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson) [Orabug: 39673892]
- net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39680880]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39680880] {CVE-2026-46331}
- net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39680880]
- net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39680880]
- net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39680880]
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39680880]

[5.4.17-2136.357.3]
- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39619389] {CVE-2026-52943}

[5.4.17-2136.357.2]
- net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39250953] {CVE-2026-31504}
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams) [Orabug: 39429802]
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh) [Orabug: 39429802]
- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [Orabug: 39526882] {CVE-2022-50073}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
- arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39548666]
- ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 39548666]
- arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Premium definitions (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Ultra definitions (Mark Rutland) [Orabug: 39548666]
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet) [Orabug: 39300926] {CVE-2026-43037}

[5.4.17-2136.357.1]
- batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39262375] {CVE-2026-31657}
- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito) [Orabug: 39446045]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39152239]

[5.4.17-2136.356.4.1]
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463669] {CVE-2026-46243}

[5.4.17-2136.356.4]
- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39429147]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]

[5.4.17-2136.356.3]
- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39384275,39391459] {CVE-2026-46333}
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39368828,39441326] {CVE-2026-43503,CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368828] {CVE-2026-46300}

[5.4.17-2136.356.2]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39167617,39368718] {CVE-2026-31402}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985173,39368732] {CVE-2026-23216}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970455,39368774] {CVE-2026-23193}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334580,39367147] {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218897] {CVE-2025-54518}

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 7 (x86_64)	kernel-uek-5.4.17-2136.357.3.3.el7uek.src.rpm	c452af450edf4e85668cee001bdc5f172b143ba73686a98e2c7b8d276eee0bc1	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	4d69cb004031926cfc85ebd4d033f1f7ca3d5e75a3af5f245f16c0681cfe0314	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	55111be48b7c1021065dc7b3f271a8bf5723cc88e44ab441fb3cb9089586956d	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-debug-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	123c4ee1561b415d3a992a5521e0e7e78a47e2d02fe836ddedfa6a38e915516b	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	c0c52bf8b2ea52aba87338e8f0837caa96827d3a834ad2121f8e20b683d456dd	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-devel-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	197e69a79838c5c54d6385ad4dde40f89f303abd0d02c54c995a97890add786e	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-devel-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	bddfa0583f72c7f53e83d6edfa74285b5711043cd27e8e5cc64eae5b4a0f9e96	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-doc-5.4.17-2136.357.3.3.el7uek.noarch.rpm	9729eccc758fc3bf06c4a9a9d42548d97b33988570557e5b5f87ebe3b20cb6ff	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-tools-5.4.17-2136.357.3.3.el7uek.x86_64.rpm	0983524dc1c3006e50c2f8f36a989468b713489cc673ed26b96bc1fcd3eef5bd	-	ol7_x86_64_UEKR6_ELS
Oracle Linux 8 (aarch64)	kernel-uek-5.4.17-2136.357.3.3.el8uek.src.rpm	4c3c7958ba4e6dadd54f2d63e1621cd7ea00fda36b454c70aa5a5d96d1272bf8	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.357.3.3.el8uek.src.rpm	4c3c7958ba4e6dadd54f2d63e1621cd7ea00fda36b454c70aa5a5d96d1272bf8	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	0fb1e3705d0b4259b5f1cf72a5de6b6c52e2f657d4625814be60b51580acff62	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	0fb1e3705d0b4259b5f1cf72a5de6b6c52e2f657d4625814be60b51580acff62	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	4a28996752369ee4f9889a49af34adfb1f4b5a9f451f1abf28a3c1ec5e10673c	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	4a28996752369ee4f9889a49af34adfb1f4b5a9f451f1abf28a3c1ec5e10673c	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-devel-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	63720af8d70ae2adeda197805b623880f210a6ee328cb77882621023554142a2	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-devel-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	63720af8d70ae2adeda197805b623880f210a6ee328cb77882621023554142a2	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-devel-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	4cd90d3b273784ea1a8f3cca9066d6f51060d176a9c45532fe8d06970b1e730e	-	ol8_aarch64_baseos_latest
	kernel-uek-devel-5.4.17-2136.357.3.3.el8uek.aarch64.rpm	4cd90d3b273784ea1a8f3cca9066d6f51060d176a9c45532fe8d06970b1e730e	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-doc-5.4.17-2136.357.3.3.el8uek.noarch.rpm	354683d58282b490c7bee98e77ad170642c78ddc5e0daf5b486544365a5d3e4e	-	ol8_aarch64_baseos_latest
	kernel-uek-doc-5.4.17-2136.357.3.3.el8uek.noarch.rpm	354683d58282b490c7bee98e77ad170642c78ddc5e0daf5b486544365a5d3e4e	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	kernel-uek-5.4.17-2136.357.3.3.el8uek.src.rpm	4c3c7958ba4e6dadd54f2d63e1621cd7ea00fda36b454c70aa5a5d96d1272bf8	-	ol8_x86_64_UEKR6
	kernel-uek-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	14a5a807d53a8b90386d6ca2419b8d46e1947880f7c6b1503ab27b4b9a5bc6fb	-	ol8_x86_64_UEKR6
	kernel-uek-container-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	7a1f3d8b7b18b2526f9abd5c2b54d6954dae9b736711737cedeb5df34e62607b	-	ol8_x86_64_UEKR6
	kernel-uek-container-debug-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	752205ae19d197a39d76bb9809ad6e9678ac4dcbf23f8fb840b9395c253620c8	-	ol8_x86_64_UEKR6
	kernel-uek-debug-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	92ddd11a249d7bd2c8484854cfcc4cacf037156c4232cc20d9a9db306d444a34	-	ol8_x86_64_UEKR6
	kernel-uek-debug-devel-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	b7b7577fa138135465db20b1a497d1f1b6d7bd4ef4057a0f3ba2add1e2532214	-	ol8_x86_64_UEKR6
	kernel-uek-devel-5.4.17-2136.357.3.3.el8uek.x86_64.rpm	54959bd8d333af78d210d46222f66c20611b55037415eb5583779d6ae68ed975	-	ol8_x86_64_UEKR6
	kernel-uek-doc-5.4.17-2136.357.3.3.el8uek.noarch.rpm	354683d58282b490c7bee98e77ad170642c78ddc5e0daf5b486544365a5d3e4e	-	ol8_x86_64_UEKR6

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team