ELSA-2026-0453

ELSA-2026-0453 - kernel security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-01-12

Description

[6.12.0-124.27.1]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage

[6.12.0-124.27.1]
- arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-120684]
- arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-120684]
- arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-120684]
- arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-120684]
- arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-120684]
- arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-120684]
- arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-120684]
- kmem/tracing: add kmem name to kmem_cache_alloc tracepoint (Charles Haithcock) [RHEL-129882]
- mm: memory-tiering: fix PGPROMOTE_CANDIDATE counting (Rafael Aquini) [RHEL-128383]

[6.12.0-124.26.1]
- usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137150] {CVE-2025-68287}
- drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134431] {CVE-2025-40277}
- net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (CKI Backport Bot) [RHEL-129812] {CVE-2025-39905}

[6.12.0-124.25.1]
- sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134010] {CVE-2025-40240}
- HID: i2c-hid: Resolve touchpad issues on Dell systems during S4 (CKI Backport Bot) [RHEL-128281]
- HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124610] {CVE-2025-39806}
- inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-115287]
- inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-115287]
- inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-115287]
- inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-115287]

[6.12.0-124.24.1]
- audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119185] {CVE-2025-39840}

[6.12.0-124.23.1]
- redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
- redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
- iommufd: Fix race during abort for file descriptors (Eder Zulian) [RHEL-123789] {CVE-2025-39966}
- smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126227]
- mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125522] {CVE-2025-39843}
- dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116157]
- dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116157]
- dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116157]
- dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116157]
- dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116157]
- dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116157]

[6.12.0-124.22.1]
- ASoC: Intel: sof_sdw: Add quirks for Lenovo P1 and P16 (CKI Backport Bot) [RHEL-130550]
- tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128866] {CVE-2025-40176}
- sched/deadline: Fix RT task potential starvation when expiry time passed (CKI Backport Bot) [RHEL-124660]

Related CVEs

CVE-2025-39806

CVE-2025-39840

CVE-2025-39843

CVE-2025-39905

CVE-2025-39966

CVE-2025-40176

CVE-2025-40240

CVE-2025-40277

CVE-2025-68287

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_aarch64_appstream
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_aarch64_baseos_latest
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_aarch64_codeready_builder
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_aarch64_u1_baseos_patch
	kernel-cross-headers-6.12.0-124.27.1.el10_1.aarch64.rpm	d9a899d0016d8f8caaa561912c2b0e8fc171bada2209174a05c1b7c938c56307	-	ol10_aarch64_codeready_builder
	kernel-headers-6.12.0-124.27.1.el10_1.aarch64.rpm	60aac0736232ddf6e6bae8e060d5916c888674494b3c62dfbc29d1fc21647da4	-	ol10_aarch64_appstream
	kernel-tools-6.12.0-124.27.1.el10_1.aarch64.rpm	b1f6e4c0eb5e859fa62e850795503dccfad16ffc149b7a6de90cd0e44ad1a270	-	ol10_aarch64_baseos_latest
	kernel-tools-6.12.0-124.27.1.el10_1.aarch64.rpm	b1f6e4c0eb5e859fa62e850795503dccfad16ffc149b7a6de90cd0e44ad1a270	-	ol10_aarch64_u1_baseos_patch
	kernel-tools-libs-6.12.0-124.27.1.el10_1.aarch64.rpm	d1b2ad6ee79cffd2a92b0623ae13f542284608c734398bb5d22b2b96a8be3b11	-	ol10_aarch64_baseos_latest
	kernel-tools-libs-6.12.0-124.27.1.el10_1.aarch64.rpm	d1b2ad6ee79cffd2a92b0623ae13f542284608c734398bb5d22b2b96a8be3b11	-	ol10_aarch64_u1_baseos_patch
	kernel-tools-libs-devel-6.12.0-124.27.1.el10_1.aarch64.rpm	16c070140979a678d2238b5fd47326a76be744c5841072734cc2e9fb3428de31	-	ol10_aarch64_codeready_builder
	libperf-6.12.0-124.27.1.el10_1.aarch64.rpm	385cd024ed14f7fb148969b6cf5795a2e67421ae9eab367950983a978268bd2a	-	ol10_aarch64_codeready_builder
	perf-6.12.0-124.27.1.el10_1.aarch64.rpm	ea2e281538ea1df4b6ef245aec27e7fa77de0890d017b293d3dc5cba210658c3	-	ol10_aarch64_appstream
	python3-perf-6.12.0-124.27.1.el10_1.aarch64.rpm	41bdb09a012db83835a4f04c6e4a0ec8271985b94af8b896583651e40e4201f0	-	ol10_aarch64_appstream
	rtla-6.12.0-124.27.1.el10_1.aarch64.rpm	4741945b95e9044f087b7382b6e03624db459195c643ee833d1e6a64bd0b3278	-	ol10_aarch64_appstream
	rv-6.12.0-124.27.1.el10_1.aarch64.rpm	2093c00ab474165c7b93e820f73560ee386452b072e42711c0019db16ed23c19	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_x86_64_appstream
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_x86_64_baseos_latest
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_x86_64_codeready_builder
	kernel-6.12.0-124.27.1.el10_1.src.rpm	0a903d285a5e8df815198d6af6d025ec79f97d9b54b48fb486a5e5321941ab83	-	ol10_x86_64_u1_baseos_patch
	kernel-6.12.0-124.27.1.el10_1.x86_64.rpm	d98c744f0069112505a0592701f850e48d56e5f31c50562549a08cd29b2f8ce0	-	ol10_x86_64_baseos_latest
	kernel-6.12.0-124.27.1.el10_1.x86_64.rpm	d98c744f0069112505a0592701f850e48d56e5f31c50562549a08cd29b2f8ce0	-	ol10_x86_64_u1_baseos_patch
	kernel-abi-stablelists-6.12.0-124.27.1.el10_1.noarch.rpm	c0816f049483c7d238098aed774edcd49a553cd84519defe807729819a29143b	-	ol10_x86_64_baseos_latest
	kernel-abi-stablelists-6.12.0-124.27.1.el10_1.noarch.rpm	c0816f049483c7d238098aed774edcd49a553cd84519defe807729819a29143b	-	ol10_x86_64_u1_baseos_patch
	kernel-core-6.12.0-124.27.1.el10_1.x86_64.rpm	d68ac441497ba214526e2b76bb1a649bc32d8c1b2a96b7fe7762ccef142eec42	-	ol10_x86_64_baseos_latest
	kernel-core-6.12.0-124.27.1.el10_1.x86_64.rpm	d68ac441497ba214526e2b76bb1a649bc32d8c1b2a96b7fe7762ccef142eec42	-	ol10_x86_64_u1_baseos_patch
	kernel-cross-headers-6.12.0-124.27.1.el10_1.x86_64.rpm	ebfdf39361a780950fb7fcd418ab138c808d71c908c44347beb63b33d2bf770d	-	ol10_x86_64_codeready_builder
	kernel-debug-6.12.0-124.27.1.el10_1.x86_64.rpm	54053e74d5cd529c6230b60b8b133a54b9f9a6f2804e33ca49448685e71d988e	-	ol10_x86_64_baseos_latest
	kernel-debug-6.12.0-124.27.1.el10_1.x86_64.rpm	54053e74d5cd529c6230b60b8b133a54b9f9a6f2804e33ca49448685e71d988e	-	ol10_x86_64_u1_baseos_patch
	kernel-debug-core-6.12.0-124.27.1.el10_1.x86_64.rpm	17f496c1331a8dc2049e0104617adac1b30199ad1fab5b27b3062cb2ef885043	-	ol10_x86_64_baseos_latest
	kernel-debug-core-6.12.0-124.27.1.el10_1.x86_64.rpm	17f496c1331a8dc2049e0104617adac1b30199ad1fab5b27b3062cb2ef885043	-	ol10_x86_64_u1_baseos_patch
	kernel-debug-devel-6.12.0-124.27.1.el10_1.x86_64.rpm	2d012b0e66db6f331cb0e48fd3d09d0305608095a4f5a76755e0203b8ca564e3	-	ol10_x86_64_appstream
	kernel-debug-devel-matched-6.12.0-124.27.1.el10_1.x86_64.rpm	7ef0be45078dd9cbedd8eb44a62caffa23182ee798004921b560cb677e6d6c92	-	ol10_x86_64_appstream
	kernel-debug-modules-6.12.0-124.27.1.el10_1.x86_64.rpm	7374c4511a6e76d01993b6337542a6b14d8f7d38e36575c6b1db55670a872710	-	ol10_x86_64_baseos_latest
	kernel-debug-modules-6.12.0-124.27.1.el10_1.x86_64.rpm	7374c4511a6e76d01993b6337542a6b14d8f7d38e36575c6b1db55670a872710	-	ol10_x86_64_u1_baseos_patch
	kernel-debug-modules-core-6.12.0-124.27.1.el10_1.x86_64.rpm	82e6332bac6f5a414e0bbf70bbd8fc6eb5431a21b575d71dabd2db9ff177de1e	-	ol10_x86_64_baseos_latest
	kernel-debug-modules-core-6.12.0-124.27.1.el10_1.x86_64.rpm	82e6332bac6f5a414e0bbf70bbd8fc6eb5431a21b575d71dabd2db9ff177de1e	-	ol10_x86_64_u1_baseos_patch
	kernel-debug-modules-extra-6.12.0-124.27.1.el10_1.x86_64.rpm	683a98d19e459a6ce79eea044bfb51be76c8977f8daa3965f6531417160db84e	-	ol10_x86_64_baseos_latest
	kernel-debug-modules-extra-6.12.0-124.27.1.el10_1.x86_64.rpm	683a98d19e459a6ce79eea044bfb51be76c8977f8daa3965f6531417160db84e	-	ol10_x86_64_u1_baseos_patch
	kernel-debug-uki-virt-6.12.0-124.27.1.el10_1.x86_64.rpm	73928536362f8e8d5789e904db8eb6e1381f39be96a5e2e7c63412a9ffe9e6e1	-	ol10_x86_64_baseos_latest
	kernel-debug-uki-virt-6.12.0-124.27.1.el10_1.x86_64.rpm	73928536362f8e8d5789e904db8eb6e1381f39be96a5e2e7c63412a9ffe9e6e1	-	ol10_x86_64_u1_baseos_patch
	kernel-devel-6.12.0-124.27.1.el10_1.x86_64.rpm	05079cf85911fec29abc761463ff5e715e920c68342b7ee13077e16b84f846ad	-	ol10_x86_64_appstream
	kernel-devel-matched-6.12.0-124.27.1.el10_1.x86_64.rpm	f91a15c511edefe364a023597728c09cc1115994df11277a8a1908740e6373ed	-	ol10_x86_64_appstream
	kernel-doc-6.12.0-124.27.1.el10_1.noarch.rpm	9f5b313ba2912000ae0235630c69813dfb73af38e46a3ac2425df499298239c8	-	ol10_x86_64_appstream
	kernel-headers-6.12.0-124.27.1.el10_1.x86_64.rpm	0697585578ad823b3547d8920984585e5e571aaec4c241377ed31e68824b73ed	-	ol10_x86_64_appstream
	kernel-modules-6.12.0-124.27.1.el10_1.x86_64.rpm	ea98cdf19ddf93af1b5c624cb71d59cc08533a8d7b1a95300d9da8ce22e40367	-	ol10_x86_64_baseos_latest
	kernel-modules-6.12.0-124.27.1.el10_1.x86_64.rpm	ea98cdf19ddf93af1b5c624cb71d59cc08533a8d7b1a95300d9da8ce22e40367	-	ol10_x86_64_u1_baseos_patch
	kernel-modules-core-6.12.0-124.27.1.el10_1.x86_64.rpm	29365f950dc1dcf086fa34f71e7a3b39a8e1904a42c009d4413029d6407a4d3e	-	ol10_x86_64_baseos_latest
	kernel-modules-core-6.12.0-124.27.1.el10_1.x86_64.rpm	29365f950dc1dcf086fa34f71e7a3b39a8e1904a42c009d4413029d6407a4d3e	-	ol10_x86_64_u1_baseos_patch
	kernel-modules-extra-6.12.0-124.27.1.el10_1.x86_64.rpm	a41e3bdf1f89f066e37846fc9fc4e25ddeb5a994aee7b8fbdd3b83dff5d83cb9	-	ol10_x86_64_baseos_latest
	kernel-modules-extra-6.12.0-124.27.1.el10_1.x86_64.rpm	a41e3bdf1f89f066e37846fc9fc4e25ddeb5a994aee7b8fbdd3b83dff5d83cb9	-	ol10_x86_64_u1_baseos_patch
	kernel-modules-extra-matched-6.12.0-124.27.1.el10_1.x86_64.rpm	b04244c48f7151007fd813e312b9b1b188ab5c3931f7203bd81748d8fed1ad67	-	ol10_x86_64_baseos_latest
	kernel-modules-extra-matched-6.12.0-124.27.1.el10_1.x86_64.rpm	b04244c48f7151007fd813e312b9b1b188ab5c3931f7203bd81748d8fed1ad67	-	ol10_x86_64_u1_baseos_patch
	kernel-tools-6.12.0-124.27.1.el10_1.x86_64.rpm	b9b1995dfd367f238c7c599ae50e7c610e22f333a780340c667580364f5b1103	-	ol10_x86_64_baseos_latest
	kernel-tools-6.12.0-124.27.1.el10_1.x86_64.rpm	b9b1995dfd367f238c7c599ae50e7c610e22f333a780340c667580364f5b1103	-	ol10_x86_64_u1_baseos_patch
	kernel-tools-libs-6.12.0-124.27.1.el10_1.x86_64.rpm	9176a83185155e11193288bb43e0ffdd88783b365648f414238feca4fd6be730	-	ol10_x86_64_baseos_latest
	kernel-tools-libs-6.12.0-124.27.1.el10_1.x86_64.rpm	9176a83185155e11193288bb43e0ffdd88783b365648f414238feca4fd6be730	-	ol10_x86_64_u1_baseos_patch
	kernel-tools-libs-devel-6.12.0-124.27.1.el10_1.x86_64.rpm	8facbcf505a5dcdd1e6562ab720ec46d1dc11a3c53bb09e295562b09122bfb8f	-	ol10_x86_64_codeready_builder
	kernel-uki-virt-6.12.0-124.27.1.el10_1.x86_64.rpm	557c350d53f7ff7dabd2bef7b5d1d2599d52d6a823167caa750204667ff594d1	-	ol10_x86_64_baseos_latest
	kernel-uki-virt-6.12.0-124.27.1.el10_1.x86_64.rpm	557c350d53f7ff7dabd2bef7b5d1d2599d52d6a823167caa750204667ff594d1	-	ol10_x86_64_u1_baseos_patch
	kernel-uki-virt-addons-6.12.0-124.27.1.el10_1.x86_64.rpm	abbec8aab04147f3072cfed9065aca190ef92a1ad9be29b0f7c056e95e15ccab	-	ol10_x86_64_baseos_latest
	kernel-uki-virt-addons-6.12.0-124.27.1.el10_1.x86_64.rpm	abbec8aab04147f3072cfed9065aca190ef92a1ad9be29b0f7c056e95e15ccab	-	ol10_x86_64_u1_baseos_patch
	libperf-6.12.0-124.27.1.el10_1.x86_64.rpm	15836f3323317d0197b95506707fe69af9f507305f42741dc04feeb0ef32b7de	-	ol10_x86_64_codeready_builder
	perf-6.12.0-124.27.1.el10_1.x86_64.rpm	a5bb69b133dfacc07348be5274803fecd11bed60bb07286cfa94126f9e2974a9	-	ol10_x86_64_appstream
	python3-perf-6.12.0-124.27.1.el10_1.x86_64.rpm	0da608352733300dc74c4e1326d31aa3c2de2afdaadb1b43566898e4744c2ae2	-	ol10_x86_64_appstream
	rtla-6.12.0-124.27.1.el10_1.x86_64.rpm	a6c97556cb3baadf5767f8fa35e2d92e7943730ed558f91db11135bacfb5e5b6	-	ol10_x86_64_appstream
	rv-6.12.0-124.27.1.el10_1.x86_64.rpm	2b17ae08d1e83672483d9ba9733d721faab74bff7f81ecd43016a4b005da67f4	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team