ELSA-2026-500573

ELSA-2026-500573 - Unbreakable Enterprise kernel security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-11-02

Description

[5.4.17-2136.361.4]
- vhost-scsi: zero misaligned I/O bounce pages (Shubham Antil) [Orabug: 40193932]

[5.4.17-2136.361.3]
- KVM: x86: Use active memslots for the per-vCPU MMIO cache (Jinu Kim) [Orabug: 40180571]
- drbd: fix 'LOGIC BUG' in drbd_al_begin_io_nonblock() (Lars Ellenberg) [Orabug: 39130967] {CVE-2026-23356}
- rds: cong: fix race while clearing rs_cong_mask (Anand Khoje) [Orabug: 39519861]
- hugetlbfs: hold trunc_rwsem during hugepage migration (Stephen Brennan) [Orabug: 39541934]
- ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40165812] {CVE-2026-99999}
- netfilter: nfnetlink_queue: unbreak SCTP traffic (Antonio Ojea) [Orabug: 40165812]
- net: add inline function skb_csum_is_sctp (Xin Long) [Orabug: 40165812]
- ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40165790] {CVE-2026-98432}
- vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917526] {CVE-2026-74580}

[5.4.17-2136.361.2]
- ionic: serialize hardware timestamp Tx queue access (Joe Dobosenski) [Orabug: 40061822]

[5.4.17-2136.361.1]
- net/mlx5: Set parent device before health polling (Manjunath Patil) [Orabug: 39208695]

[5.4.17-2136.360.3]
- IB/mlx4: delete allocated id_map_entry while sending REJ (Praveen Kumar Kannoju) [Orabug: 39999072]
- net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
- inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
- sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
- pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}

[5.4.17-2136.360.2]
- Revert 'net/mlx5: Add poll-eq API to be used by ULP's' (Praveen Kumar Kannoju) [Orabug: 39764468]

[5.4.17-2136.360.1]
- x86/alternatives: Guard struct alt_instr kABI layout (Saeed Mirzamohammadi) [Orabug: 39860383]
- crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
- crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
- crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
- KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug: 39273524] {CVE-2026-31588}
- xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
- netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}

[5.4.17-2136.359.3]
- Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546]
- Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39866546]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
(H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
- net/rds: restrict RDS_INFO dumps to caller netns (Praveen Kumar Kannoju) [Orabug: 39681637]

[5.4.17-2136.359.2]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39558751,39919265] {CVE-2026-74684}
- rds: tcp: fix uninit-value in __inet_bind (Tabrez Ahmed) [Orabug: 39668203]
- rds: tcp: cleanup if kmem_cache_alloc fails in rds_tcp_conn_alloc() (Sowmini Varadhan) [Orabug: 39668203]
- net/rds: harden rds_rm_size (Manjunath Patil) [Orabug: 39812534]
- rds: ib: move gc_count reset before free_percpu (Manjunath Patil) [Orabug: 39818510]
- rds: fix lfstack_pop_all sequence reset (Manjunath Patil) [Orabug: 39818510]

[5.4.17-2136.359.1]
- KVM: arm64: Make nVHE ASLR conditional on RANDOMIZE_BASE (David Brazdil) [Orabug: 39374251]
- arm64: kvm: Fix IDMAP overlap with HYP VA (Russell King) [Orabug: 39374251]
- arm64: KVM: Invoke compute_layout() before alternatives are applied (Sebastian Andrzej Siewior) [Orabug: 39374251]
- ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026-31598}
- fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235] {CVE-2026-46116}
- net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug: 39621716,39638198] {CVE-2026-52995}
- uek: kabi: update x86_64 kABI files for a new symbol (Saeed Mirzamohammadi) [Orabug: 39651636]
- IB/rxe: use rxe_drop_ref to release rxe_pd (Wengang Wang) [Orabug: 39674348]
- IB/uverbs: enhance authorization checks for ib_uverbs_share_pd() (Wengang Wang) [Orabug: 39674348]
- fs/binfmt_elf: validate reserved VA ELF notes (Jianfeng Wang) [Orabug: 39681044]
- mm: preserve page-table boundaries for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- mm: enforce max_map_count for reserved VA mappings (Jianfeng Wang) [Orabug: 39681044]
- xen/ovmapi: terminate values passed to xenbus_write (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: free queued events on release (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: prevent duplicate app registration (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: avoid raw user pointer access in get_next_event (Joe Jin) [Orabug: 39726701]
- xen/ovmapi: reject oversized posted event payloads (Joe Jin) [Orabug: 39726701]
- rds: Prevent kernel-infoleak in rds_notify_queue_get() (Peilin Ye) [Orabug: 39772651]
- rds: do not leak kernel memory to user land (Eric Dumazet) [Orabug: 39772651]

Related CVEs

CVE-2026-23356

CVE-2026-74580

CVE-2026-98432

CVE-2026-99999

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 7 (x86_64)	kernel-uek-5.4.17-2136.361.4.el7uek.src.rpm	4c45bf50f46565f2e29e836341d9572defbc70ae5feb51d65e1c675b7fa52db4	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-5.4.17-2136.361.4.el7uek.x86_64.rpm	c30dba2f89f037adf54148cf3f6b726d1d293913a906ddd46bc626bb253fc7d5	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-5.4.17-2136.361.4.el7uek.x86_64.rpm	0097fd718a6a51d4bf7357fa053171057578256e3f5e94f9a993e60d07103dab	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-debug-5.4.17-2136.361.4.el7uek.x86_64.rpm	4e36c423305571ef7510331f4113d97da00a897cb204e7f306a7791623656fcf	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-5.4.17-2136.361.4.el7uek.x86_64.rpm	04df264c57ad95d4a48d237b521cf54e788bc92ce41e080d397510d978bc3f76	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-devel-5.4.17-2136.361.4.el7uek.x86_64.rpm	02ff7fa055a41292d98de19599e09fd106f8c2dd3ed72f01a09cedfd93323669	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-devel-5.4.17-2136.361.4.el7uek.x86_64.rpm	c966a5df4e27cff8bc28fca5fd5c904168959f0b7762473fed56759042b2f722	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-doc-5.4.17-2136.361.4.el7uek.noarch.rpm	bc469c1b3e30f20d481ee03777ccb3a121a88381440964d2c3fde4a326913492	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-tools-5.4.17-2136.361.4.el7uek.x86_64.rpm	53e7a2bfd976a5b6740ec5a17b91cf5543b404e094a01db3a3e61bc488323ed1	-	ol7_x86_64_UEKR6_ELS
Oracle Linux 8 (aarch64)	kernel-uek-5.4.17-2136.361.4.el8uek.src.rpm	bc3f686b958664e3b5e95bb1264d7e05ee213c84b62a1cc1b3830c8177d6d354	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.361.4.el8uek.src.rpm	bc3f686b958664e3b5e95bb1264d7e05ee213c84b62a1cc1b3830c8177d6d354	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-5.4.17-2136.361.4.el8uek.aarch64.rpm	ce73415d543e1305a9d8ee5e5a7c86a675ceb828f3bf3cae31262b0dcc07c53b	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.361.4.el8uek.aarch64.rpm	ce73415d543e1305a9d8ee5e5a7c86a675ceb828f3bf3cae31262b0dcc07c53b	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-5.4.17-2136.361.4.el8uek.aarch64.rpm	7558ec300392a0f9daaf6a6e4a9974a80c36b2a7f30bd416bfc2dacd7dba28c2	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-5.4.17-2136.361.4.el8uek.aarch64.rpm	7558ec300392a0f9daaf6a6e4a9974a80c36b2a7f30bd416bfc2dacd7dba28c2	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-devel-5.4.17-2136.361.4.el8uek.aarch64.rpm	6fc51e451ee6ff5d8f776f8439c0c17ccb1aad9988f0153cfa540f29e6506177	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-devel-5.4.17-2136.361.4.el8uek.aarch64.rpm	6fc51e451ee6ff5d8f776f8439c0c17ccb1aad9988f0153cfa540f29e6506177	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-devel-5.4.17-2136.361.4.el8uek.aarch64.rpm	bf5e46c497bd4b896bb9968261eff43df85041a586809bc36affe2a19e35b915	-	ol8_aarch64_baseos_latest
	kernel-uek-devel-5.4.17-2136.361.4.el8uek.aarch64.rpm	bf5e46c497bd4b896bb9968261eff43df85041a586809bc36affe2a19e35b915	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-doc-5.4.17-2136.361.4.el8uek.noarch.rpm	c937313a9d86aa8c72ab5bd00be210f152794cf3877c04fc333737797c13d8d0	-	ol8_aarch64_baseos_latest
	kernel-uek-doc-5.4.17-2136.361.4.el8uek.noarch.rpm	c937313a9d86aa8c72ab5bd00be210f152794cf3877c04fc333737797c13d8d0	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	kernel-uek-5.4.17-2136.361.4.el8uek.src.rpm	bc3f686b958664e3b5e95bb1264d7e05ee213c84b62a1cc1b3830c8177d6d354	-	ol8_x86_64_UEKR6
	kernel-uek-5.4.17-2136.361.4.el8uek.x86_64.rpm	04be130e7b73ab0106a957d930f4a018d248f3ccb2b993df0704302a9a8b4847	-	ol8_x86_64_UEKR6
	kernel-uek-container-5.4.17-2136.361.4.el8uek.x86_64.rpm	f1f16040fd235dce13fffbdf1c9350319de249b7540a2183611b4184cad3d343	-	ol8_x86_64_UEKR6
	kernel-uek-container-debug-5.4.17-2136.361.4.el8uek.x86_64.rpm	90c1796878e9402aeb07e4c54b055033ddc17407df59a63f2e090166199b7d10	-	ol8_x86_64_UEKR6
	kernel-uek-debug-5.4.17-2136.361.4.el8uek.x86_64.rpm	a186babf1cfc05be2bc85c5466c63b56f027c8c82ee3514933949b78c4de5319	-	ol8_x86_64_UEKR6
	kernel-uek-debug-devel-5.4.17-2136.361.4.el8uek.x86_64.rpm	60570660ebe2ad33d81c0436cc9d60ac0ad3980d3a6429036b11de2d10a50eda	-	ol8_x86_64_UEKR6
	kernel-uek-devel-5.4.17-2136.361.4.el8uek.x86_64.rpm	d7020ee1a365ca4bc44e31fb7edd21bdd154a476cc756aaecd80f4ea5bf8b60f	-	ol8_x86_64_UEKR6
	kernel-uek-doc-5.4.17-2136.361.4.el8uek.noarch.rpm	c937313a9d86aa8c72ab5bd00be210f152794cf3877c04fc333737797c13d8d0	-	ol8_x86_64_UEKR6

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team