ELBA-2026-67150-1

ELBA-2026-67150-1 - kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-09-15

Description

[5.14.0-687.47.1.0.1]
- Update module name for cryptographic module [Orabug: 36324521]

[5.14.0-687.47.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.47.1]
- dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244958] {CVE-2026-72098}
- mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236332] {CVE-2026-68086}
- drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222396] {CVE-2026-43370}
- drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222481] {CVE-2026-43368}
- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222417] {CVE-2026-31656}
- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221275] {CVE-2026-31566}
- drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222300] {CVE-2026-31479}
- drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Jose Exposito) [RHEL-222458]
- drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222458] {CVE-2026-23466}
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Jose Exposito) [RHEL-236583] {CVE-2026-68264}
- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228880] {CVE-2026-63801}
- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238037] {CVE-2026-68117}
- sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229470] {CVE-2026-63971}
- sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231574] {CVE-2026-52917}
- sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236147] {CVE-2026-68315}
- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237395] {CVE-2026-68376}
- sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237093] {CVE-2026-68300}
- selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-224489]
- kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-224489]
- selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-224489]
- selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-224489]
- selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-224489]
- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-224489] {CVE-2026-43084}
- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-224489]
- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-224489]
- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235907] {CVE-2025-68745}
- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190206]
- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190206] {CVE-2026-53246}
- wifi: cfg80211: reject empty PMSR peer lists (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406}
- wifi: cfg80211: reject unsupported PMSR FTM location requests (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406}
- wifi: cfg80211: validate PMSR measurement type data (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406}
- wifi: cfg80211: validate PMSR FTM preamble range (Jose Ignacio Tornos Martinez) [RHEL-237652] {CVE-2026-68406}
- wifi: cfg80211: bound element ID read when checking non-inheritance (Jose Ignacio Tornos Martinez) [RHEL-236961] {CVE-2026-68402}
- wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232010] {CVE-2026-64255}
- wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117}
- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231682] {CVE-2026-64117}
- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230975] {CVE-2026-64037}
- wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230587] {CVE-2026-53182}
- net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229728] {CVE-2026-52947}
- wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
- wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227619] {CVE-2026-64515}
- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232670] {CVE-2026-53072}
- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231059] {CVE-2026-63947}
- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230073] {CVE-2026-53209}
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230005] {CVE-2026-63944}
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228756] {CVE-2026-63975}
- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228721] {CVE-2026-63889}
- Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227910] {CVE-2026-63946}
- ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227882] {CVE-2026-64113}
- Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227536] {CVE-2026-43334}
- iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227454] {CVE-2026-53053}
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-226431] {CVE-2026-63945}
- Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
- Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225646] {CVE-2026-53254}
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225576] {CVE-2026-53256}
- Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225553] {CVE-2026-52918}
- xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188228] {CVE-2026-53091}
- rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193025]
- rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193025]
- qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193050]
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172532] {CVE-2026-31692}
- gfs2: Fix data loss during inode evict (Andreas Gruenbacher) [RHEL-178219]
- gfs2: minor evict_[un]linked_inode cleanup (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Avoid unnecessary transactions in evict_linked_inode (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Remove unnecessary check in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Call unlock_new_inode before d_instantiate (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Don't remember delete unless it's successful (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Remove redundant check for GLF_INSTANTIATE_NEEDED (Andreas Gruenbacher) [RHEL-178219]
- gfs2: fiemap page fault fix (Andreas Gruenbacher) [RHEL-178219]
- gfs2: Don't get stuck writing page onto itself under direct I/O (Andreas Gruenbacher) [RHEL-178219]

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (x86_64)	kernel-5.14.0-687.47.1.0.1.el9_8.src.rpm	a6adc0184e08b03cddf176057fbf8e29c99b7c8645499fcdb4452ef8ae610266	-	ol9_x86_64_MODRHCK
	kernel-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	44d321e8cd3edc157268d431f286216f265c21053b294b2db404128fa11858cf	-	ol9_x86_64_MODRHCK
	kernel-abi-stablelists-5.14.0-687.47.1.0.1.el9_8.noarch.rpm	318660cdf2fba3a46274d61b02e00ebe723795d414ef20039fc36c0aa878a0f7	-	ol9_x86_64_MODRHCK
	kernel-core-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	9050508317178781a355bc6a5f6cb7a27b91f0c5213d55e7313c2e4cf56962ed	-	ol9_x86_64_MODRHCK
	kernel-cross-headers-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	74ac63c4fd51e4f9d7d545a287fc10a333e9687c4f6a7c5ad2f6db19fc6b1722	-	ol9_x86_64_MODRHCK
	kernel-debug-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	04a565f7f3379b527c1f924447e1972670bd7a74c2bcbfa8fdd7f17c0ae1ed56	-	ol9_x86_64_MODRHCK
	kernel-debug-core-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	3480288fc515df0d0d49a08b1de9fa77309e2a6a1c4665e398652af6921d3a33	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	3eaa0ca399895d4e805366259f418426674425c3e42ff506dec43a3a4837cb99	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-matched-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	c7c7ded0fa8516cf198416a99b52d9e2d24a27c4cd7325d1aed54a3b4b13bb18	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	0e7c96e6218569656c5e20a2ae748fab1b43ae1b77e80c896f7f5d939e126b10	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-core-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	5886b49d8eef671519c7fa204c4e74f43fb29619a0ad8a367a117a0812af589b	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-extra-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	d5eb2d7579ae5424c787298384a35359ab693c923509fef831859e60f5345a72	-	ol9_x86_64_MODRHCK
	kernel-debug-uki-virt-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	9e7039a43f7968ea5d71ea470a604d6a0fabf23f4da7da7b1fb19022b4886b9a	-	ol9_x86_64_MODRHCK
	kernel-devel-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	02896c75a7540f30cdea0d236d97c68d7266bf73bd5e724beb1c5c6c2941eb83	-	ol9_x86_64_MODRHCK
	kernel-devel-matched-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	22c3956baf4dc7fdb33471eaca70ce3cd95e43c83d9bcd6a09e7dfcc8133a587	-	ol9_x86_64_MODRHCK
	kernel-doc-5.14.0-687.47.1.0.1.el9_8.noarch.rpm	d64c0c5c0f60e844c65d152c7c0347b2896d4e41af62293d065a6cb673d3d053	-	ol9_x86_64_MODRHCK
	kernel-headers-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	68697545cd721f90a8679d71439709db4c62cb6532f5cb2b0f3b16fd55f60f2a	-	ol9_x86_64_MODRHCK
	kernel-modules-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	c39dea9bc06299bf65f14f308b8e5e88f601aa0e0484bc4f24871ad8419f3808	-	ol9_x86_64_MODRHCK
	kernel-modules-core-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	17175a6ddc3aa0e9a067065bd0b64d4dc6f9a9035ac8debe872198dd9a2d4436	-	ol9_x86_64_MODRHCK
	kernel-modules-extra-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	06032350a5fae2529b1a7b5289a3545aad88d75034d38f116c3df281f8c08582	-	ol9_x86_64_MODRHCK
	kernel-tools-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	8d6c754ebb35ad695640ecf2713517eabd8f6267ddefc1229454590821a547c6	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	124c82d321ce7111c61040ddf903fcf827085dfd889f2b057f2910082c2f320c	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-devel-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	5d80dc2a016519d475d907cd7ddbc27c598d3df956bd171c2794d23f17f2bdfa	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	5f5db86b60b681f1f28c37d1f17473e9274084f4476504a1bf1f9b82f3840429	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-addons-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	9665aeaf13302343a06a3e42753768b9eeb63e4658f3e7f0704e790b3d057141	-	ol9_x86_64_MODRHCK
	libperf-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	78af56fa8438e7a679c37aaf771312ac211adbbf7e87f4f30d9b3d10c9c3a211	-	ol9_x86_64_MODRHCK
	perf-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	2a35ce3458ae7cba97524401ae643cd95d26d426bf951a830a2bc708f8f17491	-	ol9_x86_64_MODRHCK
	python3-perf-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	9af8f452f7ee9600dc908d2cb9bd96dc17bbfbf30007ee622f5d9a09db21d8db	-	ol9_x86_64_MODRHCK
	rtla-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	436b59f5bac166c92928d62b877c51b363cce545c9640f55f85e22c744e84228	-	ol9_x86_64_MODRHCK
	rv-5.14.0-687.47.1.0.1.el9_8.x86_64.rpm	6871788362a10bfb8879720a1fee0e07cc806552c44f6fd54cf011d3e54d1c69	-	ol9_x86_64_MODRHCK

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team