ELSA-2026-36018

ELSA-2026-36018 - kernel security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-08

Description

[5.14.0-687.22.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.22.1]
- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}

[5.14.0-687.21.1]
- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]

Related CVEs

CVE-2025-10263

CVE-2026-43112

CVE-2026-43276

CVE-2026-46116

CVE-2026-46155

CVE-2026-46209

CVE-2026-46227

CVE-2026-46244

CVE-2026-46259

CVE-2026-46316

CVE-2026-46323

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_aarch64_appstream
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_aarch64_baseos_latest
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_aarch64_codeready_builder
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_aarch64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.22.1.el9_8.aarch64.rpm	8de9481efa1a82c30aace059a9248d83c17e1e4460b642df4c28762d2a072aee	-	ol9_aarch64_codeready_builder
	kernel-headers-5.14.0-687.22.1.el9_8.aarch64.rpm	28600382d6a2f157ba2b0ef0c7d14fb9307817a52da1f193facfcae60f45d245	-	ol9_aarch64_appstream
	kernel-tools-5.14.0-687.22.1.el9_8.aarch64.rpm	45e45288acfd1e1e5c3df3589726c3ea9ca5ad6fdda39e0b8011a5d6ed8b628b	-	ol9_aarch64_baseos_latest
	kernel-tools-5.14.0-687.22.1.el9_8.aarch64.rpm	45e45288acfd1e1e5c3df3589726c3ea9ca5ad6fdda39e0b8011a5d6ed8b628b	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.22.1.el9_8.aarch64.rpm	1293ef77bbb7594664c6c94d107d3ab3e28fdd3ca8bc6da65bd67643fdaf5d8b	-	ol9_aarch64_baseos_latest
	kernel-tools-libs-5.14.0-687.22.1.el9_8.aarch64.rpm	1293ef77bbb7594664c6c94d107d3ab3e28fdd3ca8bc6da65bd67643fdaf5d8b	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.22.1.el9_8.aarch64.rpm	0ed32d30ee21e5ca1353f5fbdf0aa7d0a90d1b1f5b17cf260c69c4be5bb59726	-	ol9_aarch64_codeready_builder
	libperf-5.14.0-687.22.1.el9_8.aarch64.rpm	9c01d20e17440df69b894be532398b87a688fb67f8d2731ebbda116c08b853b4	-	ol9_aarch64_codeready_builder
	perf-5.14.0-687.22.1.el9_8.aarch64.rpm	0129957c772f41f86a477f0e8758c0ddf2b3b8807ea62492f493ce3e5363c420	-	ol9_aarch64_appstream
	python3-perf-5.14.0-687.22.1.el9_8.aarch64.rpm	f3b61dae43a5c05266dbe505814c09305645881cf5c41070e3c637ab17a3a775	-	ol9_aarch64_appstream
	rtla-5.14.0-687.22.1.el9_8.aarch64.rpm	404917db3e30156fb516bc268df6b26c5e1c307c5502d8bc38211c3e56df7622	-	ol9_aarch64_appstream
	rv-5.14.0-687.22.1.el9_8.aarch64.rpm	f2263c4042aa886b33001fd5173ea338e2199600fe9f8647c279a97c2792c600	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_x86_64_appstream
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_x86_64_codeready_builder
	kernel-5.14.0-687.22.1.el9_8.src.rpm	7ed1e805cc7fd3e68fc37af9a8d9a261b4a9cd53ba33e01419508b96fe206cb0	-	ol9_x86_64_u8_baseos_patch
	kernel-5.14.0-687.22.1.el9_8.x86_64.rpm	fcd2e706088686fb3871952f47432114c5f500412b132892cd2e57f74d467f37	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.22.1.el9_8.x86_64.rpm	fcd2e706088686fb3871952f47432114c5f500412b132892cd2e57f74d467f37	-	ol9_x86_64_u8_baseos_patch
	kernel-abi-stablelists-5.14.0-687.22.1.el9_8.noarch.rpm	5aa6e3fb1d56821a858fad5b05ca3c2f45193145a404fff9ab3215403ca9d20b	-	ol9_x86_64_baseos_latest
	kernel-abi-stablelists-5.14.0-687.22.1.el9_8.noarch.rpm	5aa6e3fb1d56821a858fad5b05ca3c2f45193145a404fff9ab3215403ca9d20b	-	ol9_x86_64_u8_baseos_patch
	kernel-core-5.14.0-687.22.1.el9_8.x86_64.rpm	67d6c56c854c972442c8c279d3d73960c837f667e1b352104baf7a16ee87275d	-	ol9_x86_64_baseos_latest
	kernel-core-5.14.0-687.22.1.el9_8.x86_64.rpm	67d6c56c854c972442c8c279d3d73960c837f667e1b352104baf7a16ee87275d	-	ol9_x86_64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.22.1.el9_8.x86_64.rpm	6c8a8b447d654e7a550cad8e6cb4a8f6827eb11f8cdac9d9eb8420fac23ecee8	-	ol9_x86_64_codeready_builder
	kernel-debug-5.14.0-687.22.1.el9_8.x86_64.rpm	8de3b33c3e75c7479ee8ced2e17ad4a779e247f06167125f2e7d8bfddecc1466	-	ol9_x86_64_baseos_latest
	kernel-debug-5.14.0-687.22.1.el9_8.x86_64.rpm	8de3b33c3e75c7479ee8ced2e17ad4a779e247f06167125f2e7d8bfddecc1466	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-core-5.14.0-687.22.1.el9_8.x86_64.rpm	4d9bfd81d35aaa07d2439c239a3c66618dd892ea0cb91fcf95d910249de3fc3f	-	ol9_x86_64_baseos_latest
	kernel-debug-core-5.14.0-687.22.1.el9_8.x86_64.rpm	4d9bfd81d35aaa07d2439c239a3c66618dd892ea0cb91fcf95d910249de3fc3f	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-devel-5.14.0-687.22.1.el9_8.x86_64.rpm	aead262fe72e70ecae84d40b914301acd8e34f3f22acea3ef158f56f40f96998	-	ol9_x86_64_appstream
	kernel-debug-devel-matched-5.14.0-687.22.1.el9_8.x86_64.rpm	8515da048b577b551da02176bac14dd6746f4eeb89847f7d32639b09d78b22e2	-	ol9_x86_64_appstream
	kernel-debug-modules-5.14.0-687.22.1.el9_8.x86_64.rpm	8d9d1db84641d6f2f04f2d1d96ce43123271275cd46d8a0bc42dd7a415749022	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-5.14.0-687.22.1.el9_8.x86_64.rpm	8d9d1db84641d6f2f04f2d1d96ce43123271275cd46d8a0bc42dd7a415749022	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-core-5.14.0-687.22.1.el9_8.x86_64.rpm	aa5dd3dd12ded68c78b9996a757bc08ea828fd00eff1c82cc264bd6621ee3f44	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-core-5.14.0-687.22.1.el9_8.x86_64.rpm	aa5dd3dd12ded68c78b9996a757bc08ea828fd00eff1c82cc264bd6621ee3f44	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-extra-5.14.0-687.22.1.el9_8.x86_64.rpm	907d2ec2e36691a53f2f0d12d6e114f560e0d12a144b74c239b961e8b5ddef26	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-extra-5.14.0-687.22.1.el9_8.x86_64.rpm	907d2ec2e36691a53f2f0d12d6e114f560e0d12a144b74c239b961e8b5ddef26	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-uki-virt-5.14.0-687.22.1.el9_8.x86_64.rpm	94881c8a1c91edcc8c3303fa8d134735c6db749faf5113c88f4b83115326d443	-	ol9_x86_64_baseos_latest
	kernel-debug-uki-virt-5.14.0-687.22.1.el9_8.x86_64.rpm	94881c8a1c91edcc8c3303fa8d134735c6db749faf5113c88f4b83115326d443	-	ol9_x86_64_u8_baseos_patch
	kernel-devel-5.14.0-687.22.1.el9_8.x86_64.rpm	24565281f9880a463bf49fef6796c4e2ff2b653b334e82ca8d15464cb6162027	-	ol9_x86_64_appstream
	kernel-devel-matched-5.14.0-687.22.1.el9_8.x86_64.rpm	7c6e1ecedbea2af68ce289ad4ac10378476be63fd6659590120ed8977ebed6a3	-	ol9_x86_64_appstream
	kernel-doc-5.14.0-687.22.1.el9_8.noarch.rpm	4723e682d055b8bbf8a9b1505d6171af7add4a7bd7f3812a937f0c13dc02fb88	-	ol9_x86_64_appstream
	kernel-headers-5.14.0-687.22.1.el9_8.x86_64.rpm	0094ccf07ffdfcae82ff0adee22c1c772bef4755cb24c7e5347a4213473a6eef	-	ol9_x86_64_appstream
	kernel-modules-5.14.0-687.22.1.el9_8.x86_64.rpm	19ece47265ef082b1e889f3bae78593063e65c95be30e8dd8267bdf2c9736b54	-	ol9_x86_64_baseos_latest
	kernel-modules-5.14.0-687.22.1.el9_8.x86_64.rpm	19ece47265ef082b1e889f3bae78593063e65c95be30e8dd8267bdf2c9736b54	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-core-5.14.0-687.22.1.el9_8.x86_64.rpm	0fd2fc1f128d47c59ff96ef6aaab5b772db5603d31ea11a1c6de1e3ac43813cd	-	ol9_x86_64_baseos_latest
	kernel-modules-core-5.14.0-687.22.1.el9_8.x86_64.rpm	0fd2fc1f128d47c59ff96ef6aaab5b772db5603d31ea11a1c6de1e3ac43813cd	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-extra-5.14.0-687.22.1.el9_8.x86_64.rpm	4cd159b1294ed6a85ffb7aa29b1497fe9985e459e93616c41fe186c82bc8aa39	-	ol9_x86_64_baseos_latest
	kernel-modules-extra-5.14.0-687.22.1.el9_8.x86_64.rpm	4cd159b1294ed6a85ffb7aa29b1497fe9985e459e93616c41fe186c82bc8aa39	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-5.14.0-687.22.1.el9_8.x86_64.rpm	4f28d6eed138b5f0a91afd370fb387f10384a6fa8d0fe0c195c3d765516c0efa	-	ol9_x86_64_baseos_latest
	kernel-tools-5.14.0-687.22.1.el9_8.x86_64.rpm	4f28d6eed138b5f0a91afd370fb387f10384a6fa8d0fe0c195c3d765516c0efa	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.22.1.el9_8.x86_64.rpm	e72659d10a7f18f3188f8754e61d1eafa390a8d5c1576c97aa407668d5ddba65	-	ol9_x86_64_baseos_latest
	kernel-tools-libs-5.14.0-687.22.1.el9_8.x86_64.rpm	e72659d10a7f18f3188f8754e61d1eafa390a8d5c1576c97aa407668d5ddba65	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.22.1.el9_8.x86_64.rpm	038cf78fb84104a864e5d5d6640f92bb019ca10bb6bf6a91f8da5622140016e0	-	ol9_x86_64_codeready_builder
	kernel-uki-virt-5.14.0-687.22.1.el9_8.x86_64.rpm	0584acbe32bf75da9bcc5e3c99f8758bf6fc592bbc25b60149065dce873467c1	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-5.14.0-687.22.1.el9_8.x86_64.rpm	0584acbe32bf75da9bcc5e3c99f8758bf6fc592bbc25b60149065dce873467c1	-	ol9_x86_64_u8_baseos_patch
	kernel-uki-virt-addons-5.14.0-687.22.1.el9_8.x86_64.rpm	ec9001489eab111f123633119894c31a8415a6dfba2bfc1de247ea88d85ddbae	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-addons-5.14.0-687.22.1.el9_8.x86_64.rpm	ec9001489eab111f123633119894c31a8415a6dfba2bfc1de247ea88d85ddbae	-	ol9_x86_64_u8_baseos_patch
	libperf-5.14.0-687.22.1.el9_8.x86_64.rpm	91ffc9d78c7d1212658e41610ea10a1755d1052d595d510900d13a692604eb4a	-	ol9_x86_64_codeready_builder
	perf-5.14.0-687.22.1.el9_8.x86_64.rpm	9bffcf7869942e95622c6b9ff916dd992363ae69780e281dc6d8ecc460056de4	-	ol9_x86_64_appstream
	python3-perf-5.14.0-687.22.1.el9_8.x86_64.rpm	9bda410451699d9ab8456509cb1c28e65aff76c77477130059b26a892e718feb	-	ol9_x86_64_appstream
	rtla-5.14.0-687.22.1.el9_8.x86_64.rpm	0d7283cfdd78ab270f418fb6df7038f646ab27a1701c58b31ce44f344ff0f658	-	ol9_x86_64_appstream
	rv-5.14.0-687.22.1.el9_8.x86_64.rpm	b4243bce8050fd200ee5b626bbf934859009664cec9064defdbf71fe6b6fca73	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team