ELBA-2026-500455

ELBA-2026-500455 - Unbreakable Enterprise kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-10-21

Description

[5.4.17-2136.360.3.2]
- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40182411]

[5.4.17-2136.360.3.1]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167664] {CVE-2026-98432}
- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167666] {CVE-2026-99999}
- netfilter: nfnetlink_queue: unbreak SCTP traffic (Antonio Ojea) [Orabug: 40167666]
- net: add inline function skb_csum_is_sctp (Xin Long) [Orabug: 40167666]
- vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 40166458] {CVE-2026-74580}

[5.4.17-2136.360.3]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
- sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
- pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}

[5.4.17-2136.360.2]
- Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39764468]

[5.4.17-2136.360.1]
- x86/alternatives: Guard struct alt_instr kABI layout (Saeed Mirzamohammadi) [Orabug: 39860383]
- crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
- crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
- crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
- KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug: 39273524] {CVE-2026-31588}
- xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}

[5.4.17-2136.359.3]
- Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546]
- Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39866546]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
(H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju) [Orabug: 39681637]

[5.4.17-2136.359.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39558751,39919265] {CVE-2026-74684}
- rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed) [Orabug: 39668203]
- rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan) [Orabug: 39668203]
- net/rds: harden rds_rm_size (Manjunath Patil) [Orabug: 39812534]
- rds: ib: move gc_count reset before free_percpu (Manjunath Patil) [Orabug: 39818510]
- rds: fix lfstack_pop_all sequence reset (Manjunath Patil) [Orabug: 39818510]

[5.4.17-2136.359.1]
- KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil) [Orabug: 39374251]
- arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King) [Orabug: 39374251]
- arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior) [Orabug: 39374251]
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026-31598}
- fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235] {CVE-2026-46116}
- net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug: 39621716,39638198] {CVE-2026-52995}
- uek: kabi: update x86_64 kABI files for a new symbol (Saeed Mirzamohammadi) [Orabug: 39651636]
- IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang) [Orabug: 39674348]
- IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang) [Orabug: 39674348]
- fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681044]
- mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- xen/ovmapi: terminate values passed to xenbus_write (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: free queued events on release (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: prevent duplicate app registration (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: reject oversized posted event payloads (Joe Jin) [Orabug: 39726701]
- rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye) [Orabug: 39772651]
- rds: do not leak kernel memory to user land (Eric Dumazet) [Orabug: 39772651]

[5.4.17-2136.358.2]
- xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776792] {CVE-2026-64600}
- net: Work around Marvell NIC TX stalls (Venkat Venkatsubra) [Orabug: 39765820]

[5.4.17-2136.358.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673871,39686461] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39460223,39673871] {CVE-2026-46113}
- KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon) [Orabug: 39673871]
- KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [Orabug: 39673871]
- KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu) [Orabug: 39673871]
- KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini) [Orabug: 39673871]
- KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack) [Orabug: 39673871]
- KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack) [Orabug: 39673871]
- KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan) [Orabug: 39673871]
- KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan) [Orabug: 39673871]
- KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan) [Orabug: 39673871]
- KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Stop passing 'direct' to mmu_alloc_root() (David Matlack) [Orabug: 39673871]
- KVM: x86/mmu: Use a bool for direct (David Matlack) [Orabug: 39673871]
- kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon) [Orabug: 39673871]
- KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson) [Orabug: 39673871]
- Revert 'net/rds: poll eq during user-reset' (Praveen Kumar Kannoju) [Orabug: 39659401]
- net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39567287,39680880] {CVE-2026-46331}
- net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452261] {CVE-2026-46043}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39426001,39751168] {CVE-2026-43499,CVE-2026-53163}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39426001,39706958] {CVE-2026-43499}
- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300930] {CVE-2026-43038}
- tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil) [Orabug: 38790406]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38776184]

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 7 (x86_64)	kernel-uek-5.4.17-2136.360.3.2.el7uek.src.rpm	d5be47e17e551c7856868d6c1669f053cc68ce99e5f889290a411bc0f5bbef8c	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	ce481cdb833634e1054e0c0867c5012ab4ae21ebb06b0549296f5b450bcb2092	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	370b82cca65e9e95ed8e45a6ebab3dc3fa58903e6e1a1a119b777fad8c7cc6f0	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-debug-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	e094a17fb8d4053b0a1b3072cabaf2096159f84b72a3d2cb88c60d156efe4cb1	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	927ee1a1c16e25c9193fdaf4ee16295b4bb02c498eeb65f150aa66bf5286e101	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-devel-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	a60b4775095ec12283ebb036a27e0cb8860c47e17d823ded5277ef9cd7815596	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-devel-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	4987a757cd5796119826ae2e679d4918defa782b3a20686e142f92d157143971	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-doc-5.4.17-2136.360.3.2.el7uek.noarch.rpm	17afda0a1a7a8fc8afa16a59048c2cb77d0b8ecc8daa58dce5d504a865e4eff1	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-tools-5.4.17-2136.360.3.2.el7uek.x86_64.rpm	9c238e39c3cc14c4654f3340700cd66f2a442ad1cdf950f53c8e38a1bca9c6c8	-	ol7_x86_64_UEKR6_ELS
Oracle Linux 8 (aarch64)	kernel-uek-5.4.17-2136.360.3.2.el8uek.src.rpm	1064e95a54f596c764923a4c884cc80a9ee69aaadc86880d583f0f2cdec6489c	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.360.3.2.el8uek.src.rpm	1064e95a54f596c764923a4c884cc80a9ee69aaadc86880d583f0f2cdec6489c	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	ba3b2e4f7063d0b60e0292767b6f1de5738eeaae1c9e4d176de76f484b6b7a03	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	ba3b2e4f7063d0b60e0292767b6f1de5738eeaae1c9e4d176de76f484b6b7a03	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	045b246e7eb41d721e0aa46a1d77fe69c9b87e6d51ba41507fb9fb54725f4113	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	045b246e7eb41d721e0aa46a1d77fe69c9b87e6d51ba41507fb9fb54725f4113	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-devel-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	22c9d476658e7fd0cb7b24d63fb8eba058da021d2a78f283c38badb3313225a9	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-devel-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	22c9d476658e7fd0cb7b24d63fb8eba058da021d2a78f283c38badb3313225a9	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-devel-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	e7debdfc5231bf36f179f4582e03b48452cdb74fee8b9aa05ffa4d3e0664d094	-	ol8_aarch64_baseos_latest
	kernel-uek-devel-5.4.17-2136.360.3.2.el8uek.aarch64.rpm	e7debdfc5231bf36f179f4582e03b48452cdb74fee8b9aa05ffa4d3e0664d094	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-doc-5.4.17-2136.360.3.2.el8uek.noarch.rpm	d60acaa976c17626efc1f234b0e1548c644b103f9bc8d00672d437ee9e140f42	-	ol8_aarch64_baseos_latest
	kernel-uek-doc-5.4.17-2136.360.3.2.el8uek.noarch.rpm	d60acaa976c17626efc1f234b0e1548c644b103f9bc8d00672d437ee9e140f42	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	kernel-uek-5.4.17-2136.360.3.2.el8uek.src.rpm	1064e95a54f596c764923a4c884cc80a9ee69aaadc86880d583f0f2cdec6489c	-	ol8_x86_64_UEKR6
	kernel-uek-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	7cb31e186834e9ff4a3ebca620a9eaca0b8ff4f2e7dabc567ba6c2ba555faaa8	-	ol8_x86_64_UEKR6
	kernel-uek-container-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	8d96ee334a63c724f7fb1fa8844a781e28779e3296fe66a7ca9c26caf05a8e85	-	ol8_x86_64_UEKR6
	kernel-uek-container-debug-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	5ce8b169a2fc10e9e927bb03e7eff46e84e28b7480465659811d516b1cf774f0	-	ol8_x86_64_UEKR6
	kernel-uek-debug-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	4a55499f66a23ed95b21a356945b6944bcfc3a7dc265e3504d9597e14e0aecaf	-	ol8_x86_64_UEKR6
	kernel-uek-debug-devel-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	26cd905aa554f75148a6b8ac5711f3ea15ece6bea88f1322fa451fbc66e45085	-	ol8_x86_64_UEKR6
	kernel-uek-devel-5.4.17-2136.360.3.2.el8uek.x86_64.rpm	65a9d79c3927f34939340fec802e854b7b2ab0b5fbe05f05c817755126fda76d	-	ol8_x86_64_UEKR6
	kernel-uek-doc-5.4.17-2136.360.3.2.el8uek.noarch.rpm	d60acaa976c17626efc1f234b0e1548c644b103f9bc8d00672d437ee9e140f42	-	ol8_x86_64_UEKR6

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team