ELSA-2026-36957

ELSA-2026-36957 - kernel security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-10

Description

[5.14.0-687.24.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.24.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}

[5.14.0-687.23.1]
- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
- eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
- epoll: annotate racy check (Ian Kent) [RHEL-180773]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]

Related CVEs

CVE-2025-71066

CVE-2026-46113

CVE-2026-53359

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_aarch64_appstream
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_aarch64_baseos_latest
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_aarch64_codeready_builder
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_aarch64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.24.1.el9_8.aarch64.rpm	2c4c56b1b808d1e0b79d5413c12db3f4511e3a031d825d131b17ecf4df23f553	-	ol9_aarch64_codeready_builder
	kernel-headers-5.14.0-687.24.1.el9_8.aarch64.rpm	2f552f1a46609b3d350abbc3c392099103168865deb71e6c3a1a4e4ac3708f1d	-	ol9_aarch64_appstream
	kernel-tools-5.14.0-687.24.1.el9_8.aarch64.rpm	ae3d20dbbf093610c72dfd5af6c7db05969539127dcbb82f16ca06478e9cb265	-	ol9_aarch64_baseos_latest
	kernel-tools-5.14.0-687.24.1.el9_8.aarch64.rpm	ae3d20dbbf093610c72dfd5af6c7db05969539127dcbb82f16ca06478e9cb265	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.24.1.el9_8.aarch64.rpm	dbcc6ee1c3103d79127722a766d2f24dafe37f78feadff6924b891e80a3a8676	-	ol9_aarch64_baseos_latest
	kernel-tools-libs-5.14.0-687.24.1.el9_8.aarch64.rpm	dbcc6ee1c3103d79127722a766d2f24dafe37f78feadff6924b891e80a3a8676	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.24.1.el9_8.aarch64.rpm	ba7d84fd596660644e771f450307363e92f46ea7508643bb3a3fda5f78dbd81d	-	ol9_aarch64_codeready_builder
	libperf-5.14.0-687.24.1.el9_8.aarch64.rpm	c3f063ac49d9368b2ef6d3f9cf36b2b6e4e4333672d4d8ee3fdf96062e718b5f	-	ol9_aarch64_codeready_builder
	perf-5.14.0-687.24.1.el9_8.aarch64.rpm	e59312df7f4bafc2831c6728a09b00999ffa92ff75473aff8e1705e3bc2f0a84	-	ol9_aarch64_appstream
	python3-perf-5.14.0-687.24.1.el9_8.aarch64.rpm	0efd7d1d1b5e1ceb13cda8e98c9e49577e9c5039cb7f3bb2ca7f1a556bd814be	-	ol9_aarch64_appstream
	rtla-5.14.0-687.24.1.el9_8.aarch64.rpm	df8f2d0329cb206a3638b8ec0dfad605be9c842cadef808ecb0ed8844ff48d51	-	ol9_aarch64_appstream
	rv-5.14.0-687.24.1.el9_8.aarch64.rpm	3be8bd218d5e01209c3991a4d8fe581a2d57297b679f6ee20616339e579cabb9	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_x86_64_appstream
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_x86_64_codeready_builder
	kernel-5.14.0-687.24.1.el9_8.src.rpm	d104f4cf68b90af5bc761705ad8db8d1015ae164971a5c8fea95730965d5a47b	-	ol9_x86_64_u8_baseos_patch
	kernel-5.14.0-687.24.1.el9_8.x86_64.rpm	f506ab061841ff1dce096cf519196025430137d1fc22d73ddc4030db7900de45	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.24.1.el9_8.x86_64.rpm	f506ab061841ff1dce096cf519196025430137d1fc22d73ddc4030db7900de45	-	ol9_x86_64_u8_baseos_patch
	kernel-abi-stablelists-5.14.0-687.24.1.el9_8.noarch.rpm	03ab7f20b3eaa470a0c99f2b357ca605705b571901fce4e0c2dae03743238c27	-	ol9_x86_64_baseos_latest
	kernel-abi-stablelists-5.14.0-687.24.1.el9_8.noarch.rpm	03ab7f20b3eaa470a0c99f2b357ca605705b571901fce4e0c2dae03743238c27	-	ol9_x86_64_u8_baseos_patch
	kernel-core-5.14.0-687.24.1.el9_8.x86_64.rpm	8a11758cff33f0bcaf173ddf260aff3ccd90834a6475bf430a92b396202a084d	-	ol9_x86_64_baseos_latest
	kernel-core-5.14.0-687.24.1.el9_8.x86_64.rpm	8a11758cff33f0bcaf173ddf260aff3ccd90834a6475bf430a92b396202a084d	-	ol9_x86_64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.24.1.el9_8.x86_64.rpm	3177ecf2ee97035e95d9f281c8d107e308a128e4c8e1451005b0e3465a6f8e18	-	ol9_x86_64_codeready_builder
	kernel-debug-5.14.0-687.24.1.el9_8.x86_64.rpm	3750453385134ab0caa148d1340ed4acb92dd627ad397a5605f6fb9f7d7051b7	-	ol9_x86_64_baseos_latest
	kernel-debug-5.14.0-687.24.1.el9_8.x86_64.rpm	3750453385134ab0caa148d1340ed4acb92dd627ad397a5605f6fb9f7d7051b7	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-core-5.14.0-687.24.1.el9_8.x86_64.rpm	08906b30036930a31f5700e064da8191f9ffa721349552f65c0aca5def54afd3	-	ol9_x86_64_baseos_latest
	kernel-debug-core-5.14.0-687.24.1.el9_8.x86_64.rpm	08906b30036930a31f5700e064da8191f9ffa721349552f65c0aca5def54afd3	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-devel-5.14.0-687.24.1.el9_8.x86_64.rpm	1e11fbf870602ed6ffb4b1f15e03106017b3f4fd7e334391a1df2ee72c0cade2	-	ol9_x86_64_appstream
	kernel-debug-devel-matched-5.14.0-687.24.1.el9_8.x86_64.rpm	e1e89caa54514cfe2557d787e107a28d8cac7a8a553dd6b0946ee03ecd5b5e00	-	ol9_x86_64_appstream
	kernel-debug-modules-5.14.0-687.24.1.el9_8.x86_64.rpm	9934a18b687fe2fe39005f4b33ecf94d501322cc5d34ca659d54384ef7395f68	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-5.14.0-687.24.1.el9_8.x86_64.rpm	9934a18b687fe2fe39005f4b33ecf94d501322cc5d34ca659d54384ef7395f68	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm	83f5bc46f1bc32c4e94c49e99449ed4099cf177fd9786b7de5f689bcc237ff83	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm	83f5bc46f1bc32c4e94c49e99449ed4099cf177fd9786b7de5f689bcc237ff83	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm	93c64e6e92c61ece2130e75ffa6d0078e7b40e5d105cd19690dd5a7393e0ce41	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm	93c64e6e92c61ece2130e75ffa6d0078e7b40e5d105cd19690dd5a7393e0ce41	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-uki-virt-5.14.0-687.24.1.el9_8.x86_64.rpm	0333e5a55d6858240af8b95439f233f1eeeaf1dadebda3663a65eaa2b62b3434	-	ol9_x86_64_baseos_latest
	kernel-debug-uki-virt-5.14.0-687.24.1.el9_8.x86_64.rpm	0333e5a55d6858240af8b95439f233f1eeeaf1dadebda3663a65eaa2b62b3434	-	ol9_x86_64_u8_baseos_patch
	kernel-devel-5.14.0-687.24.1.el9_8.x86_64.rpm	204b7b5c905a1223402dde8fb90459ebc20350386d182747609e2883eabfca40	-	ol9_x86_64_appstream
	kernel-devel-matched-5.14.0-687.24.1.el9_8.x86_64.rpm	06d06d61d8ff4a1fd299dea1331c7148c4b4c2f45cf5539024f38a43cf496f32	-	ol9_x86_64_appstream
	kernel-doc-5.14.0-687.24.1.el9_8.noarch.rpm	8a9020896c258d6181555cfc6e36e4b875f880c9b38c13f446575abbf17025d7	-	ol9_x86_64_appstream
	kernel-headers-5.14.0-687.24.1.el9_8.x86_64.rpm	233d84ef914d85c3c99e6b1ca9bf08b1a345650853d81a7b81ceca476cab5b0f	-	ol9_x86_64_appstream
	kernel-modules-5.14.0-687.24.1.el9_8.x86_64.rpm	ff167eedf59af1e81c35856fa8fd6e6cb0da00ab23db3a83037a1f1856aa5f21	-	ol9_x86_64_baseos_latest
	kernel-modules-5.14.0-687.24.1.el9_8.x86_64.rpm	ff167eedf59af1e81c35856fa8fd6e6cb0da00ab23db3a83037a1f1856aa5f21	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm	7223a1d2d5b76b8afa09c6cf8563c49ac7a8fad8ccf2633090ce31f785027ca8	-	ol9_x86_64_baseos_latest
	kernel-modules-core-5.14.0-687.24.1.el9_8.x86_64.rpm	7223a1d2d5b76b8afa09c6cf8563c49ac7a8fad8ccf2633090ce31f785027ca8	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm	4fd0e3c25134fbfbc99570ab972eb97b848753047d02066e4216aa67f6d7a84b	-	ol9_x86_64_baseos_latest
	kernel-modules-extra-5.14.0-687.24.1.el9_8.x86_64.rpm	4fd0e3c25134fbfbc99570ab972eb97b848753047d02066e4216aa67f6d7a84b	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-5.14.0-687.24.1.el9_8.x86_64.rpm	9a124c0c1af3bb2358b71f42b9441ac7793f10c25f752ed06e13753d76d376cd	-	ol9_x86_64_baseos_latest
	kernel-tools-5.14.0-687.24.1.el9_8.x86_64.rpm	9a124c0c1af3bb2358b71f42b9441ac7793f10c25f752ed06e13753d76d376cd	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.24.1.el9_8.x86_64.rpm	052e0e833bcfebe48f4976af868999265d576401e9bcace0e04b0a008cd58e4b	-	ol9_x86_64_baseos_latest
	kernel-tools-libs-5.14.0-687.24.1.el9_8.x86_64.rpm	052e0e833bcfebe48f4976af868999265d576401e9bcace0e04b0a008cd58e4b	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.24.1.el9_8.x86_64.rpm	5419e6718b59a66d3a3d5e476161c4925f7952437f68898ab14cd7cb3fc3613f	-	ol9_x86_64_codeready_builder
	kernel-uki-virt-5.14.0-687.24.1.el9_8.x86_64.rpm	7397ac8efdf9effb96058a3615b93a35c44cf83a1add242fe8b6e9b513092315	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-5.14.0-687.24.1.el9_8.x86_64.rpm	7397ac8efdf9effb96058a3615b93a35c44cf83a1add242fe8b6e9b513092315	-	ol9_x86_64_u8_baseos_patch
	kernel-uki-virt-addons-5.14.0-687.24.1.el9_8.x86_64.rpm	9e529d24277257950929e9982b2b6c38e15653d415c25a85bcf10145e5c4120b	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-addons-5.14.0-687.24.1.el9_8.x86_64.rpm	9e529d24277257950929e9982b2b6c38e15653d415c25a85bcf10145e5c4120b	-	ol9_x86_64_u8_baseos_patch
	libperf-5.14.0-687.24.1.el9_8.x86_64.rpm	c0e4e0de1ad37bbcee59e009c7b07db2f2d386ff56a0e88b30a81fe1b02c5125	-	ol9_x86_64_codeready_builder
	perf-5.14.0-687.24.1.el9_8.x86_64.rpm	3bdb459ff92a7466568fa7fab04bb32458a5d4759c8bb8ab1e09266050aab238	-	ol9_x86_64_appstream
	python3-perf-5.14.0-687.24.1.el9_8.x86_64.rpm	70af54b56196260e0285944538a04c2350da8612a8978423a007af3e2e92040d	-	ol9_x86_64_appstream
	rtla-5.14.0-687.24.1.el9_8.x86_64.rpm	356e2834c7ec36c4e49f214bb8dae9628d1984ade05dd10bb64f78be3af5d73b	-	ol9_x86_64_appstream
	rv-5.14.0-687.24.1.el9_8.x86_64.rpm	bf7b5106d8adda2c9f0eab0ffa0f149b23545e99fecfec2a4a8d3d761d202c5b	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team