ELBA-2026-66000-1

ELBA-2026-66000-1 - kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-09-15

Description

[4.18.0-553.162.1.0.1]
- scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]

[4.18.0-553.162.1]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

[4.18.0-553.162.1]
- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117]
- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801}
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117}
- sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971}
- sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917}
- sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315}
- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376}
- sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300}
- gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340]
- gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340]
- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202]
- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246}
- netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942}
- netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986}
- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745}
- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149}

[4.18.0-553.161.1]
- security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015}
- ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113}
- xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
- net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}

[4.18.0-553.160.1]
- rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563}
- net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480}
- nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129}
- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
- crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
- crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
- smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343}
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007}
- netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002}

[4.18.0-553.159.1]
- net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581}
- powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144]
- powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144]
- RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185}
- nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399}
- NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392}
- NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298}
- NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391}
- pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800}
- nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397}
- x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480}
- x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492]
(Waiman Long) [RHEL-230492]
- smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
- net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
- net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018}
- bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970}
- s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849}
- RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268}
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045]

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (x86_64)	kernel-4.18.0-553.162.1.0.1.el8_10.src.rpm	6a14c1d0d7a07269ff7a215659cc7617991d52db228834b7315b010d0af9a2e8	-	ol8_x86_64_MODRHCK
	bpftool-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	5c9e2408e0b1a8f6db3650e9c9c54793e9f774bad67af1b30951fca3a63b7cbf	-	ol8_x86_64_MODRHCK
	kernel-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	de0ce77819107eea55299c7c1e594b7ae70bc82dbb23fb0f31a5ddca46aba7e1	-	ol8_x86_64_MODRHCK
	kernel-abi-stablelists-4.18.0-553.162.1.0.1.el8_10.noarch.rpm	c69939f127d0cd64ab087c8666b751e4df0935ae01c82279159cb3ff3bbcf615	-	ol8_x86_64_MODRHCK
	kernel-core-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	a3055c90a530f97bce5fcf5bd0cb6136867369105c95eac34988c5b9c8070fcb	-	ol8_x86_64_MODRHCK
	kernel-cross-headers-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	a85186e385f681f3b679674709029721ef9cb55a4b6bcd9a0292ef6fc9535225	-	ol8_x86_64_MODRHCK
	kernel-debug-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	9eac19e6f2faaccac0a77d9ce480c0961570e40b452f1bf86cf99a69514a5a1b	-	ol8_x86_64_MODRHCK
	kernel-debug-core-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	b2cf0821d3bd70c10fc716b8f126994d25bdfc556ac7219c40a633cb36929ba5	-	ol8_x86_64_MODRHCK
	kernel-debug-devel-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	333ec1cbc7310e0dff2b283d57bca2b04901a266bab9132128aebb477a54f6ce	-	ol8_x86_64_MODRHCK
	kernel-debug-modules-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	2186d77063a7b6934c7c76f888076458087c07f25f8958cbc6767b2c5b0ec937	-	ol8_x86_64_MODRHCK
	kernel-debug-modules-extra-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	4fe97379f27670cd044bc869549daad313bb3bf93c2e28d580403f99a96fe14b	-	ol8_x86_64_MODRHCK
	kernel-devel-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	da94846ad47c824975f997be32acfff394d5f4655d0c2a254b2bf837ce5cadea	-	ol8_x86_64_MODRHCK
	kernel-doc-4.18.0-553.162.1.0.1.el8_10.noarch.rpm	e9254203d82ebc9c2b85e38a34548cf24f7f1b0931b08657b29ee0533af5ca12	-	ol8_x86_64_MODRHCK
	kernel-headers-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	03f009b53e60693d1737502938af8ada9eb5052270611f403480d53db4dc390c	-	ol8_x86_64_MODRHCK
	kernel-modules-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	a4e39e887aff6f263d291fd5f18cb73cb131e2cc9a3b06a86a9efcb07b2382aa	-	ol8_x86_64_MODRHCK
	kernel-modules-extra-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	36d6d4da3bf50c26a21c8adf67c1f482d76cdc1ad944996c7c0bafd1a1c250fe	-	ol8_x86_64_MODRHCK
	kernel-tools-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	2b142990b2305108f901ef1ad828df6c9694c47b6676c8f88fca78f398c7ce5e	-	ol8_x86_64_MODRHCK
	kernel-tools-libs-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	dc1624b33492acd4c69622bd250360483aff68791c97ced1ac1599581cb40072	-	ol8_x86_64_MODRHCK
	kernel-tools-libs-devel-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	da4b1e6e5c9b5b78a6a2a989410d06c04e920e5300956a38235a66e5cd9899b0	-	ol8_x86_64_MODRHCK
	perf-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	c4f10e60bf910581b848546761e4b2656d6c88463b519960a5802204cc0fdd75	-	ol8_x86_64_MODRHCK
	python3-perf-4.18.0-553.162.1.0.1.el8_10.x86_64.rpm	fb93ab19350a92789f6e5b5254a0290ac85115241df5d5fa463aec927e0a6f2a	-	ol8_x86_64_MODRHCK

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team