ELBA-2025-21469-1

ELBA-2025-21469-1 - kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2025-11-28

Description

[5.14.0-611.8.1.0.1]
- Update module name for cryptographic module [Orabug: 36324521]

[5.14.0-611.8.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-611.8.1]
- NFSD: Fix callback decoder status codes (Jay Shin) [RHEL-127193]
- NFSD: Fix CB_GETATTR status fix (Jay Shin) [RHEL-127193]
- NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Jay Shin) [RHEL-127193]
- kernfs: Fix UAF in polling when open file is released (Pavel Reichl) [RHEL-122087] {CVE-2025-39881}
- gitlab-ci: disable automotive pipelines (Scott Weaver)
- NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Benjamin Coddington) [RHEL-122154]
- sched: Add wait/wake interface for variable updated under a lock. (Benjamin Coddington) [RHEL-122154]
- sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Benjamin Coddington) [RHEL-122154]
- sched: Document wait_var_event() family of functions and wake_up_var() (Benjamin Coddington) [RHEL-122154]
- sched: Improve documentation for wake_up_bit/wait_on_bit family of functions (Benjamin Coddington) [RHEL-122154]
- sched: change wake_up_bit() and related function to expect unsigned long * (Benjamin Coddington) [RHEL-122154]
- bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} [rhel-9.7.z] (Xin Long) [RHEL-125513]
- redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-125317]
- i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123808]
- i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123808] {CVE-2025-39968}
- i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123808] {CVE-2025-39969}
- i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123808] {CVE-2025-39970}
- i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123808] {CVE-2025-39971}
- i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123808] {CVE-2025-39972}
- i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123808] {CVE-2025-39973}
- io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124971] {CVE-2025-40047}
- Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124129] {CVE-2025-39983}
- Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123821] {CVE-2025-39982}
- use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121704] {CVE-2025-38498}
- do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121704] {CVE-2025-38498}
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-117136] {CVE-2025-38351}
- ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-117438]
- net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-117438]
- NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113855] {CVE-2025-39697}

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (x86_64)	kernel-5.14.0-611.8.1.0.1.el9_7.src.rpm	c2e596439cf6895c3c10d48294623c9c367ccaa13de3d09b66520a212b7e3234	-	ol9_x86_64_MODRHCK
	kernel-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	5c581dfbe962c136292c79dbf2b3e551f0f12fff83a72b46e51167a5f2d6c123	-	ol9_x86_64_MODRHCK
	kernel-abi-stablelists-5.14.0-611.8.1.0.1.el9_7.noarch.rpm	09a2de524724be39f33555d8724afcde2126af29602b2cf6153c2f67555638b5	-	ol9_x86_64_MODRHCK
	kernel-core-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	8dab93b2f1e78cd15b9f4ccfe08b3ccb685d34aa69dedcdc75361f7151a162fd	-	ol9_x86_64_MODRHCK
	kernel-cross-headers-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	3e5093e8549f6b30198552442ec95d892af40315b1e27510e1d13aa9057622ab	-	ol9_x86_64_MODRHCK
	kernel-debug-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	67bd235fba6399c32f0404f192b7f3de41cecfbc3a2f92ea44e4b09a6561bcc9	-	ol9_x86_64_MODRHCK
	kernel-debug-core-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	def0d35844c5e6ceaac64d1734b13252f04dd4280063752cce4af18a3b43a205	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	da9d62eed734a019fc7ee33cc0d4953a149b39abadf744c4d4e4f8e0170ee485	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-matched-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	ab3a1209309addf7089680c01b3e7ae6dab371d99b6c08a1d5df9603477cc01a	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	bba99de5423e46a1cc571850e4bee57ab73f5c5b2ff8bb5b7cc7de4721c0e33f	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-core-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	1f9c3449160c1d21c5ee79f0bfdfc2e3591e917b6ea6026aa62a9f3528c765a5	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-extra-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	0b4bf2853518f331d426287020c401a20c0731104af334b371f1a5cddcd17506	-	ol9_x86_64_MODRHCK
	kernel-debug-uki-virt-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	c5b19922ca0a9420b68b7ad47bd7577984ffbd95faae2f3f3882acf6a7f511d3	-	ol9_x86_64_MODRHCK
	kernel-devel-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	c773d8bdfebf61f9ca9dab35d6c143b1a2d64863ec9615aafb0ac462fc195959	-	ol9_x86_64_MODRHCK
	kernel-devel-matched-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	5de21da68a43be87e27fcdf84908cf4f97e32c020f53fe7086024cb9b1547c7c	-	ol9_x86_64_MODRHCK
	kernel-doc-5.14.0-611.8.1.0.1.el9_7.noarch.rpm	5500429ccf35990c7a43fb0b8a3fec6df00e01137baa98e096c4ad9b00ba8dc6	-	ol9_x86_64_MODRHCK
	kernel-headers-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	039a419e98bbce369a6a08252c0b66bb08eca04bde01cc9bff8bee558cb6d3a5	-	ol9_x86_64_MODRHCK
	kernel-modules-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	e8417cd0dcf1a9e51187bd09ac403f5c033f7d79c98a78362068e60949b625f4	-	ol9_x86_64_MODRHCK
	kernel-modules-core-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	149332e8beb0bcb570d6d07cbe57d02943e92bbc85be2278523a16552a3a1dbf	-	ol9_x86_64_MODRHCK
	kernel-modules-extra-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	a48b1bca5043ed8b42175f413287ebf24a6316fb23e25d122712e6946e302229	-	ol9_x86_64_MODRHCK
	kernel-tools-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	79e5892ea95494858233a1b4e9655977e3371fb1891a5289a8306611dd276c86	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	8aa6b120affa70f6bd02f6ca4ce58def4bb36229bf5a097ef9f789b6887af801	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-devel-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	9d90f456851cd3bdebd627cea19d18e96a7bc6a3656165dc330c3190879c5559	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	f8752a4bb805eade85e30c2be652f8e5b55c226d3340a4bda0483a07bdafb718	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-addons-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	c02476dba777ca20419ef3f608e6a61c078d248c5a44b54b35481a24b3832bdc	-	ol9_x86_64_MODRHCK
	libperf-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	93b8f86bbf16ea48d5999452982c2da0ffc7226a5c38f5615b27436b02f76aa4	-	ol9_x86_64_MODRHCK
	perf-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	c33d5feca258324f695246d17eadfe77ac06bc9a4816c988a5621bfd7a948935	-	ol9_x86_64_MODRHCK
	python3-perf-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	b87595249ca203ec3d9bdd981873dd0059aa5e9329d2a421b30c66c4d246bade	-	ol9_x86_64_MODRHCK
	rtla-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	20c27b4a9a97afc1b51429f38362b6949fa0dd7501d771528a0a36b009119e31	-	ol9_x86_64_MODRHCK
	rv-5.14.0-611.8.1.0.1.el9_7.x86_64.rpm	cd2d57fdc594f11591d3f9e74db0439687e86265543740b83102d58b47e7fc8e	-	ol9_x86_64_MODRHCK

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team