ELBA-2026-77689-1

ELBA-2026-77689-1 - kernel bug fix update

Type:	BUG
Impact:	NA
Release Date:	2026-10-13

Description

[5.14.0-687.56.1.0.1]
- Update module name for cryptographic module [Orabug: 36324521]

[5.14.0-687.56.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.56.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.56.1]
- ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201]
- ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201]
- ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201]
- ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201]
- redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014]
- rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014]
- nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690}
- svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530}
- nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669}
- nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663}
- nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152]
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152]
- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398}
- SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317}
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246]
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246]
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744}
- ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
- sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279]
- sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279]
- vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
- vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291}
- idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286}
- idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162}
- idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647}
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577]
- vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115}
- igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480]

[5.14.0-687.55.1]
- dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410]
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892]
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288}
- thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332}
- nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417}
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275}
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192]
- nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481}
- nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
- ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
- ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
- ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984}
- ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993}
- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994}
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432}
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052}
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829}
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029]
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569}
- smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
- KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
- KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076}
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777]
- Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255}
- KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289}
- netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
- netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942}
- netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
- gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
- gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149}

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (x86_64)	kernel-5.14.0-687.56.1.0.1.el9_8.src.rpm	3fe022d4ebd6f64c628123aacedd2ebf513516a5ed3f9f7a53a7cc6066e6d9d4	-	ol9_x86_64_MODRHCK
	kernel-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	9a22d3b931f7134b43e9507c33bc0898c2972a79995beb3a7d3e45259317fdff	-	ol9_x86_64_MODRHCK
	kernel-abi-stablelists-5.14.0-687.56.1.0.1.el9_8.noarch.rpm	5065ceaf6998aa661237e1049d39c79e4009a23e1fb650dad8a39ee2b8563825	-	ol9_x86_64_MODRHCK
	kernel-core-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	1d5914f1aba2eca91ff354c9a0732088ed76782e5a03ab9864e358060d1fb02c	-	ol9_x86_64_MODRHCK
	kernel-cross-headers-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	1123e73613cf5a1886a3dd2798a63fdd230bb7973d5150d9da18c0f3cf562518	-	ol9_x86_64_MODRHCK
	kernel-debug-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	0d47bae0c37332172740ef460342802e3cb6658ae0dbd90d50aea3790edae77b	-	ol9_x86_64_MODRHCK
	kernel-debug-core-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	9698d1beff18ffdf70c8db0488f0d09e385f6b25601fd6df9c233e22ab780ade	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	bf9e63bca03badff2bed262dc307b23ae2a0a5f1bacc289bf1c581a22d544c9b	-	ol9_x86_64_MODRHCK
	kernel-debug-devel-matched-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	af73611761df9ffd7df12b5e6922643e1086c4c34875fd8d819bccb89aaa3923	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	8842de7027fbbf0f119492236d7525d7d40d8de8a954a6a9bef4ee61c633f0f7	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-core-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	49cd70f449154bf5ba5c6d8bee09c5d76f5571b9d90cbf50cf6196e9c45758ec	-	ol9_x86_64_MODRHCK
	kernel-debug-modules-extra-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	b33dc80b21772ce15d6b57805dbe20f84174316c0a2e2003185befca34ddaab3	-	ol9_x86_64_MODRHCK
	kernel-debug-uki-virt-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	afbfc4dac948e585cd81f1f1a9aad68f0769212cbc9403c3a82cb40d6538c54f	-	ol9_x86_64_MODRHCK
	kernel-devel-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	354431fc578f0c9822ddbddee9b6298b85da1bb5258ccee20b0f615c91f32c21	-	ol9_x86_64_MODRHCK
	kernel-devel-matched-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	e9c843eaa350f99b6f11a2d568abe4df2b490d7537733a2dc5c72a2085cc7efb	-	ol9_x86_64_MODRHCK
	kernel-doc-5.14.0-687.56.1.0.1.el9_8.noarch.rpm	764c66a3a5d5f2cbcc9a445aec6d8a336c06a2a310e939e3135b39baf75b9f40	-	ol9_x86_64_MODRHCK
	kernel-headers-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	5adc0196e5e1436e4996f2a4ae590977bf55511c5030de7e106bb3db11511838	-	ol9_x86_64_MODRHCK
	kernel-modules-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	757c8d38b74e3a389cb4714f4b9052628d58dd0df4e9fbb503284a2feb8152a2	-	ol9_x86_64_MODRHCK
	kernel-modules-core-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	88a1e8cf80041a2897ebdf89a84e6245b22b8f51cfc4db49c35ae2c5a140ffed	-	ol9_x86_64_MODRHCK
	kernel-modules-extra-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	f9eb5b95d167428885b5a8e687f347387fc80df7096c8a57bd37f557fd1dde94	-	ol9_x86_64_MODRHCK
	kernel-tools-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	37b9e6d9ae882d87e4a788fd29444d1621c2f64d2dac921fa087f7b487b31046	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	8d55aabba7e57edb834f23988ab251f9d8378c914e1dc888513c882367631239	-	ol9_x86_64_MODRHCK
	kernel-tools-libs-devel-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	64e821b7b8c00fa52b1a27e02e08e6850392d64faa440c465cca76d99ad6491b	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	49804792d78409901a813feeba84220d334846ebbe76608c98e3568131c5c130	-	ol9_x86_64_MODRHCK
	kernel-uki-virt-addons-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	7cc25a82c154584b786da2a5a49907ccb348369f7e16b34fadd24ccc22576a05	-	ol9_x86_64_MODRHCK
	libperf-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	8a5bf893d15758f07516debde0414f948a596924a44b4b85bc0670a5cfbc0fc6	-	ol9_x86_64_MODRHCK
	perf-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	961dbbc72b65e8d45a03d36d6b4ce0fb4d054246d8b91fa48ef67530fd98781f	-	ol9_x86_64_MODRHCK
	python3-perf-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	4efb95aefcc3d640731c48959215a2be21c512b03761667da3f27e5be875d5c4	-	ol9_x86_64_MODRHCK
	rtla-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	ea4b6746743c91439147485bf5f18404878c5532151ad857467b327790030c92	-	ol9_x86_64_MODRHCK
	rv-5.14.0-687.56.1.0.1.el9_8.x86_64.rpm	40b3ed4b54fc9e13b2e058652263108d354a01fcb7c116214ac850b87fd755bb	-	ol9_x86_64_MODRHCK

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team