ELSA-2026-0445

ELSA-2026-0445 - kernel security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-01-12

Description

[5.14.0-611.20.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-611.20.1]
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124607] {CVE-2025-39806}
- sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134001] {CVE-2025-40240}
- selftests/landlock: Add a new test for setuid() (Stepan Horacek) [RHEL-132712]
- selftests/landlock: Split signal_scoping_threads tests (Stepan Horacek) [RHEL-132712]
- landlock: Always allow signals between threads of the same process (Stepan Horacek) [RHEL-132712]
- landlock: Prepare to add second errata (Stepan Horacek) [RHEL-132712]
- landlock: Add the errata interface (Stepan Horacek) [RHEL-132712]
- selftests/landlock: Test signal scoping for threads (Stepan Horacek) [RHEL-132712]
- selftests/landlock: Test signal scoping (Stepan Horacek) [RHEL-132712]
- landlock: Add signal scoping (Stepan Horacek) [RHEL-132712]

[5.14.0-611.19.1]
- scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-133543]
- scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-133543]
- audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119176] {CVE-2025-39840}

[5.14.0-611.18.1]
- NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-134237]
- redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
- redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)

[5.14.0-611.17.1]
- smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126165]
- smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124917]
- mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119150] {CVE-2025-39883}

Related CVEs

CVE-2025-39806

CVE-2025-39840

CVE-2025-39883

CVE-2025-40240

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_aarch64_appstream
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_aarch64_baseos_latest
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_aarch64_codeready_builder
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_aarch64_u7_baseos_patch
	kernel-cross-headers-5.14.0-611.20.1.el9_7.aarch64.rpm	faf22cb4715c81a9dc449513afc87501c1d5f376c9af6ec6c7e7c5277ebac5e5	-	ol9_aarch64_codeready_builder
	kernel-headers-5.14.0-611.20.1.el9_7.aarch64.rpm	183998da506bb98dd2a7fd0fa05561ff7b6e06c23af347612b8cd4cb2e1a76d2	-	ol9_aarch64_appstream
	kernel-tools-5.14.0-611.20.1.el9_7.aarch64.rpm	a4f9359c78da02e5fce5ff60be9e43da6c9d79837750480cc9c6856b63dce751	-	ol9_aarch64_baseos_latest
	kernel-tools-5.14.0-611.20.1.el9_7.aarch64.rpm	a4f9359c78da02e5fce5ff60be9e43da6c9d79837750480cc9c6856b63dce751	-	ol9_aarch64_u7_baseos_patch
	kernel-tools-libs-5.14.0-611.20.1.el9_7.aarch64.rpm	2e26d871003cad1664a467033082b431f6990299c2d099c87ecaa016e7a4814d	-	ol9_aarch64_baseos_latest
	kernel-tools-libs-5.14.0-611.20.1.el9_7.aarch64.rpm	2e26d871003cad1664a467033082b431f6990299c2d099c87ecaa016e7a4814d	-	ol9_aarch64_u7_baseos_patch
	kernel-tools-libs-devel-5.14.0-611.20.1.el9_7.aarch64.rpm	be8368964502919f9f5f6bb7daf82979d1b6b1463ff1f199ff3be0c56570e81d	-	ol9_aarch64_codeready_builder
	libperf-5.14.0-611.20.1.el9_7.aarch64.rpm	2a0e4183333f090273ed294ad2344de30dbd44909cd0b3b89274b883c65016da	-	ol9_aarch64_codeready_builder
	perf-5.14.0-611.20.1.el9_7.aarch64.rpm	a5eec5771db1a612ac284c8d4f447c1e18a4127f3d08e920137353e36f00e820	-	ol9_aarch64_appstream
	python3-perf-5.14.0-611.20.1.el9_7.aarch64.rpm	8d2c040c08f11a921c74376dbba662204f69738a3ee6a1e611509178ac3befa1	-	ol9_aarch64_appstream
	rtla-5.14.0-611.20.1.el9_7.aarch64.rpm	bff00ca4c17f6623a2ed05101eaaf7b370b307547aeb0933c3d08107384fc2b2	-	ol9_aarch64_appstream
	rv-5.14.0-611.20.1.el9_7.aarch64.rpm	1225723cce88dadb51ffe7b22f97ad26ff6f9f5c8353a058c2d7ddc79c696b6f	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_x86_64_appstream
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_x86_64_codeready_builder
	kernel-5.14.0-611.20.1.el9_7.src.rpm	6f63f465f2344dbff2e424d20314e5f42eaa5a0a3ed12656a71236574fe4f3bb	-	ol9_x86_64_u7_baseos_patch
	kernel-5.14.0-611.20.1.el9_7.x86_64.rpm	2fe2ce8912beb58ebf10c493daf05eb6b625b44ca55f712ab9c385b5c4d8c7f4	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-611.20.1.el9_7.x86_64.rpm	2fe2ce8912beb58ebf10c493daf05eb6b625b44ca55f712ab9c385b5c4d8c7f4	-	ol9_x86_64_u7_baseos_patch
	kernel-abi-stablelists-5.14.0-611.20.1.el9_7.noarch.rpm	bd05c9a1e55941f3fb0a579cfb057b6c48cb8526d4a35bccd406021537b1fffe	-	ol9_x86_64_baseos_latest
	kernel-abi-stablelists-5.14.0-611.20.1.el9_7.noarch.rpm	bd05c9a1e55941f3fb0a579cfb057b6c48cb8526d4a35bccd406021537b1fffe	-	ol9_x86_64_u7_baseos_patch
	kernel-core-5.14.0-611.20.1.el9_7.x86_64.rpm	109843c9463a6c6fb10bd0717723e2a2b15a1abc84a84e12871ef11196cf320b	-	ol9_x86_64_baseos_latest
	kernel-core-5.14.0-611.20.1.el9_7.x86_64.rpm	109843c9463a6c6fb10bd0717723e2a2b15a1abc84a84e12871ef11196cf320b	-	ol9_x86_64_u7_baseos_patch
	kernel-cross-headers-5.14.0-611.20.1.el9_7.x86_64.rpm	fad4b865998aa568d905d183544b971cc55a75be87495e8af79def765dd5e968	-	ol9_x86_64_codeready_builder
	kernel-debug-5.14.0-611.20.1.el9_7.x86_64.rpm	5060c91df9c2ecd57919b2822af54c418eee36043e39e35dc0257955bb0a4b7a	-	ol9_x86_64_baseos_latest
	kernel-debug-5.14.0-611.20.1.el9_7.x86_64.rpm	5060c91df9c2ecd57919b2822af54c418eee36043e39e35dc0257955bb0a4b7a	-	ol9_x86_64_u7_baseos_patch
	kernel-debug-core-5.14.0-611.20.1.el9_7.x86_64.rpm	3c60fe86d8cead65f5bb079000b28295f3ccac45864543367bb0a4be5441f0d4	-	ol9_x86_64_baseos_latest
	kernel-debug-core-5.14.0-611.20.1.el9_7.x86_64.rpm	3c60fe86d8cead65f5bb079000b28295f3ccac45864543367bb0a4be5441f0d4	-	ol9_x86_64_u7_baseos_patch
	kernel-debug-devel-5.14.0-611.20.1.el9_7.x86_64.rpm	0930dbf0e5bfab29db803f2a5bff6db589f5dea77d07e5a41e00dab931181c6f	-	ol9_x86_64_appstream
	kernel-debug-devel-matched-5.14.0-611.20.1.el9_7.x86_64.rpm	110baccb09c58cd5308497c47d3627a5ed8ba11bc40d53104364c6844676a269	-	ol9_x86_64_appstream
	kernel-debug-modules-5.14.0-611.20.1.el9_7.x86_64.rpm	d2bdc9b4d26075f338c37147cba1f2a6d9ab9d94d0ee86eedbb9cdbead8751e8	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-5.14.0-611.20.1.el9_7.x86_64.rpm	d2bdc9b4d26075f338c37147cba1f2a6d9ab9d94d0ee86eedbb9cdbead8751e8	-	ol9_x86_64_u7_baseos_patch
	kernel-debug-modules-core-5.14.0-611.20.1.el9_7.x86_64.rpm	d1abe7a01439abd47ba3fec980998823697c579a5b2004d74adc1954afcfd4a4	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-core-5.14.0-611.20.1.el9_7.x86_64.rpm	d1abe7a01439abd47ba3fec980998823697c579a5b2004d74adc1954afcfd4a4	-	ol9_x86_64_u7_baseos_patch
	kernel-debug-modules-extra-5.14.0-611.20.1.el9_7.x86_64.rpm	c5004a89d0ef6f6ae160786ccad14f5a26ee570a95256cce1a76bb91d46ced18	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-extra-5.14.0-611.20.1.el9_7.x86_64.rpm	c5004a89d0ef6f6ae160786ccad14f5a26ee570a95256cce1a76bb91d46ced18	-	ol9_x86_64_u7_baseos_patch
	kernel-debug-uki-virt-5.14.0-611.20.1.el9_7.x86_64.rpm	3dffddbd55736d3a54db13b8a88c620cd236d26f4cf2da8075338666fc66e0db	-	ol9_x86_64_baseos_latest
	kernel-debug-uki-virt-5.14.0-611.20.1.el9_7.x86_64.rpm	3dffddbd55736d3a54db13b8a88c620cd236d26f4cf2da8075338666fc66e0db	-	ol9_x86_64_u7_baseos_patch
	kernel-devel-5.14.0-611.20.1.el9_7.x86_64.rpm	4f002d9d0a1801d3f55d122ebd68fff497b5e8c9f5baf3c234b307131d5d5c2c	-	ol9_x86_64_appstream
	kernel-devel-matched-5.14.0-611.20.1.el9_7.x86_64.rpm	2a512781f6d46133c0662c539cc8909a80b1427fee39c066a7ca60f7331ca053	-	ol9_x86_64_appstream
	kernel-doc-5.14.0-611.20.1.el9_7.noarch.rpm	4c4a310089cc6acf0466f7f305b1cfde8fe9c5d35c99ec89ccd308ff61cc2b1c	-	ol9_x86_64_appstream
	kernel-headers-5.14.0-611.20.1.el9_7.x86_64.rpm	145719fe8650e7afa08e887303bce2f3d4cd4575e1ba47b8e07fbdcb32eebada	-	ol9_x86_64_appstream
	kernel-modules-5.14.0-611.20.1.el9_7.x86_64.rpm	5a84632ef31d3498cb8c5224cc0ede95e165fcc791ca95998fd72d9365cdd865	-	ol9_x86_64_baseos_latest
	kernel-modules-5.14.0-611.20.1.el9_7.x86_64.rpm	5a84632ef31d3498cb8c5224cc0ede95e165fcc791ca95998fd72d9365cdd865	-	ol9_x86_64_u7_baseos_patch
	kernel-modules-core-5.14.0-611.20.1.el9_7.x86_64.rpm	9fc79685a70bccc4dd05cdc764603cc06197ea2dd9eb1d73f65a57beebf76cba	-	ol9_x86_64_baseos_latest
	kernel-modules-core-5.14.0-611.20.1.el9_7.x86_64.rpm	9fc79685a70bccc4dd05cdc764603cc06197ea2dd9eb1d73f65a57beebf76cba	-	ol9_x86_64_u7_baseos_patch
	kernel-modules-extra-5.14.0-611.20.1.el9_7.x86_64.rpm	db5fe121fc6ffca6c620e83eef1aa2efe35dd7a06624787ead58ae0d7d3881f2	-	ol9_x86_64_baseos_latest
	kernel-modules-extra-5.14.0-611.20.1.el9_7.x86_64.rpm	db5fe121fc6ffca6c620e83eef1aa2efe35dd7a06624787ead58ae0d7d3881f2	-	ol9_x86_64_u7_baseos_patch
	kernel-tools-5.14.0-611.20.1.el9_7.x86_64.rpm	f854b039d80e18da39d827577a88797de211b1eacaafe36bbf74e79c8411a7d0	-	ol9_x86_64_baseos_latest
	kernel-tools-5.14.0-611.20.1.el9_7.x86_64.rpm	f854b039d80e18da39d827577a88797de211b1eacaafe36bbf74e79c8411a7d0	-	ol9_x86_64_u7_baseos_patch
	kernel-tools-libs-5.14.0-611.20.1.el9_7.x86_64.rpm	409ae4d5670a3bc9df2a0c5767ece56186a7bbeb3a80420c42522750ae95157e	-	ol9_x86_64_baseos_latest
	kernel-tools-libs-5.14.0-611.20.1.el9_7.x86_64.rpm	409ae4d5670a3bc9df2a0c5767ece56186a7bbeb3a80420c42522750ae95157e	-	ol9_x86_64_u7_baseos_patch
	kernel-tools-libs-devel-5.14.0-611.20.1.el9_7.x86_64.rpm	1ab11ddcef7c1950283d1762446b8b3c74bca01806b8821df8807f9c1afd410c	-	ol9_x86_64_codeready_builder
	kernel-uki-virt-5.14.0-611.20.1.el9_7.x86_64.rpm	3c428840c24693cf0925f5e89730b85d4089c8c9ded31f96ddd45353c3f1f232	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-5.14.0-611.20.1.el9_7.x86_64.rpm	3c428840c24693cf0925f5e89730b85d4089c8c9ded31f96ddd45353c3f1f232	-	ol9_x86_64_u7_baseos_patch
	kernel-uki-virt-addons-5.14.0-611.20.1.el9_7.x86_64.rpm	d6eef8876b24bf6c621fc63913cfad87372314c0a65efbcb637c87a531e69f08	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-addons-5.14.0-611.20.1.el9_7.x86_64.rpm	d6eef8876b24bf6c621fc63913cfad87372314c0a65efbcb637c87a531e69f08	-	ol9_x86_64_u7_baseos_patch
	libperf-5.14.0-611.20.1.el9_7.x86_64.rpm	1a36e0c33973aeb493981828514720254a9788c1a0f221062bcf0ef71d6cc23c	-	ol9_x86_64_codeready_builder
	perf-5.14.0-611.20.1.el9_7.x86_64.rpm	a9de0fb4011697098e4abce774a8b76269145ef5d3fa38f7c792da7219d3b70c	-	ol9_x86_64_appstream
	python3-perf-5.14.0-611.20.1.el9_7.x86_64.rpm	6d41f449d7e658297bde4ad019e0abd8f9a3bb5f6ed7ce3966e7c8b636af5398	-	ol9_x86_64_appstream
	rtla-5.14.0-611.20.1.el9_7.x86_64.rpm	6520014f16134e47548e4d78a3026bdf037ca5ed512264a4325302d08a2cfe95	-	ol9_x86_64_appstream
	rv-5.14.0-611.20.1.el9_7.x86_64.rpm	310cf6fa0d56a6611472fe5dc38dbc3fef12704e886903f5df45af30af0ea2c5	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team