ELSA-2026-43307

ELSA-2026-43307 - kernel security, bug fix, and enhancement update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-07-22

Description

[5.14.0-687.29.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.29.1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
- dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
- net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]

[5.14.0-687.28.1]
- fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}

[5.14.0-687.27.1]
- drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
- drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
- drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
- drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
- drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
- crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
- crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
- scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
- net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
- net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
- net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
- net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
- net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
- net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
- net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
- net/mlx5: Avoid 'No data available' when FW version queries fail (Kamal Heib) [RHEL-188121]
- net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
- net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix 'scheduling while atomic' in IPsec MAC address query (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
- net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
- net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
- net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
- net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
- net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
- IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
- RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
- libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
- libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]

Related CVEs

CVE-2025-71113

CVE-2026-23110

CVE-2026-46150

CVE-2026-46215

CVE-2026-53071

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_aarch64_appstream
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_aarch64_baseos_latest
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_aarch64_codeready_builder
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_aarch64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.29.1.el9_8.aarch64.rpm	bc58938937a035e6595eac1ec48e652f4711033133eac0bc793fc37b9e26c814	-	ol9_aarch64_codeready_builder
	kernel-headers-5.14.0-687.29.1.el9_8.aarch64.rpm	22c009d7926d987b00ff02cac536caa0af20c71c0be9043bdbb5fa3b66609915	-	ol9_aarch64_appstream
	kernel-tools-5.14.0-687.29.1.el9_8.aarch64.rpm	b03ab036964009a38ddd5b0a3cfbd4240c0ab3e10884dbfc6ff97416f7ef92e4	-	ol9_aarch64_baseos_latest
	kernel-tools-5.14.0-687.29.1.el9_8.aarch64.rpm	b03ab036964009a38ddd5b0a3cfbd4240c0ab3e10884dbfc6ff97416f7ef92e4	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.29.1.el9_8.aarch64.rpm	4fb5f8cd77615caa9d13847acba61f1df94ab9473c57f76a48e31043b35e9837	-	ol9_aarch64_baseos_latest
	kernel-tools-libs-5.14.0-687.29.1.el9_8.aarch64.rpm	4fb5f8cd77615caa9d13847acba61f1df94ab9473c57f76a48e31043b35e9837	-	ol9_aarch64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.aarch64.rpm	3af4d94c9bbf50c6913f40acf88c393564def98b36e9dec439367f1281155dc6	-	ol9_aarch64_codeready_builder
	libperf-5.14.0-687.29.1.el9_8.aarch64.rpm	01a7892488c2c2a69990094034de95ed92f25840f3527caaa68d4c110e24bc71	-	ol9_aarch64_codeready_builder
	perf-5.14.0-687.29.1.el9_8.aarch64.rpm	ddc0859d3e8ffb8473b6ba62e05e008ba8c7657c8d6f8c1e6ebb87cee3988ee2	-	ol9_aarch64_appstream
	python3-perf-5.14.0-687.29.1.el9_8.aarch64.rpm	9d56aa1dacdf82fdcf90b684c3e84b7a13b3eef2bb5ced37199d1ec92dd46b34	-	ol9_aarch64_appstream
	rtla-5.14.0-687.29.1.el9_8.aarch64.rpm	ab2d9f97f3cd0e1243517fed04f333ce4b8aa0fd52689e7aa57e591eb374a04e	-	ol9_aarch64_appstream
	rv-5.14.0-687.29.1.el9_8.aarch64.rpm	3fa3d2e474ee86aad07fc1f09734d67225f3b5b9a52624901c33872e5c4448c2	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_x86_64_appstream
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_x86_64_codeready_builder
	kernel-5.14.0-687.29.1.el9_8.src.rpm	14608f4b171558cdc6286419972a979d93be4d4a4b1e22396e128e6ad2fd4ebe	-	ol9_x86_64_u8_baseos_patch
	kernel-5.14.0-687.29.1.el9_8.x86_64.rpm	9dbe948096b6cc219210290d2f5f514fe083b744a8ad231f2e293f3729abb021	-	ol9_x86_64_baseos_latest
	kernel-5.14.0-687.29.1.el9_8.x86_64.rpm	9dbe948096b6cc219210290d2f5f514fe083b744a8ad231f2e293f3729abb021	-	ol9_x86_64_u8_baseos_patch
	kernel-abi-stablelists-5.14.0-687.29.1.el9_8.noarch.rpm	a4449c0d91cd77074d539f9cbb806b7638ca5eed1c08fcbb0d03c43b342b15e2	-	ol9_x86_64_baseos_latest
	kernel-abi-stablelists-5.14.0-687.29.1.el9_8.noarch.rpm	a4449c0d91cd77074d539f9cbb806b7638ca5eed1c08fcbb0d03c43b342b15e2	-	ol9_x86_64_u8_baseos_patch
	kernel-core-5.14.0-687.29.1.el9_8.x86_64.rpm	66c13c29c3a0d54ff2fe88d28aabf04450817cee785a0f645e5fa53a1246d3e1	-	ol9_x86_64_baseos_latest
	kernel-core-5.14.0-687.29.1.el9_8.x86_64.rpm	66c13c29c3a0d54ff2fe88d28aabf04450817cee785a0f645e5fa53a1246d3e1	-	ol9_x86_64_u8_baseos_patch
	kernel-cross-headers-5.14.0-687.29.1.el9_8.x86_64.rpm	c67ca9a94af5f7b0a17068ab3c69feb10df6d7e12fab1e2077e6c9d04f2e63c5	-	ol9_x86_64_codeready_builder
	kernel-debug-5.14.0-687.29.1.el9_8.x86_64.rpm	d037e1a6c65ad9a825f096fe8168a02261370888b19688ee9c833472513d0a9b	-	ol9_x86_64_baseos_latest
	kernel-debug-5.14.0-687.29.1.el9_8.x86_64.rpm	d037e1a6c65ad9a825f096fe8168a02261370888b19688ee9c833472513d0a9b	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-core-5.14.0-687.29.1.el9_8.x86_64.rpm	ace4b2ec0e63cadb4bee20b041104c7a2b8a3d2bc72b30731b0bd098506b385e	-	ol9_x86_64_baseos_latest
	kernel-debug-core-5.14.0-687.29.1.el9_8.x86_64.rpm	ace4b2ec0e63cadb4bee20b041104c7a2b8a3d2bc72b30731b0bd098506b385e	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-devel-5.14.0-687.29.1.el9_8.x86_64.rpm	ab8e972de70cebf7801bcb9406c90cf30f3334ab5736975b064548f04716d169	-	ol9_x86_64_appstream
	kernel-debug-devel-matched-5.14.0-687.29.1.el9_8.x86_64.rpm	2d8fcf6981b9bb59e6254ffad651727251053aa5bdca0b5f389a4afe0ebdb54d	-	ol9_x86_64_appstream
	kernel-debug-modules-5.14.0-687.29.1.el9_8.x86_64.rpm	a69d35cca0dc2ed642c4f875225354f2b655a53f6435d0b8a027996da50558e8	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-5.14.0-687.29.1.el9_8.x86_64.rpm	a69d35cca0dc2ed642c4f875225354f2b655a53f6435d0b8a027996da50558e8	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm	f05a3a46b16820615cb980e27f91da1ba694653a07b1d2776731b7fb836e18b2	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm	f05a3a46b16820615cb980e27f91da1ba694653a07b1d2776731b7fb836e18b2	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm	327916b494a3a1e144d8c5ab7fd90f2f51f8cc879767ca915cf0cb1a7fa236b3	-	ol9_x86_64_baseos_latest
	kernel-debug-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm	327916b494a3a1e144d8c5ab7fd90f2f51f8cc879767ca915cf0cb1a7fa236b3	-	ol9_x86_64_u8_baseos_patch
	kernel-debug-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm	b2620a0773394661cdd820864f08017bf2b4e6543a32e03b4de8ea1d367357ad	-	ol9_x86_64_baseos_latest
	kernel-debug-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm	b2620a0773394661cdd820864f08017bf2b4e6543a32e03b4de8ea1d367357ad	-	ol9_x86_64_u8_baseos_patch
	kernel-devel-5.14.0-687.29.1.el9_8.x86_64.rpm	4dd143643f9fa744f8026a9ec0145fc3023c351a67f0d3d520da161f4e4ec7e8	-	ol9_x86_64_appstream
	kernel-devel-matched-5.14.0-687.29.1.el9_8.x86_64.rpm	346258568cec671ac11e93410cd09d1651a6139afadf9398392aa04ed930de92	-	ol9_x86_64_appstream
	kernel-doc-5.14.0-687.29.1.el9_8.noarch.rpm	d537b4910ff0e777ccd2fb0220a4c6f879e45764b05de7da898bf84689b46973	-	ol9_x86_64_appstream
	kernel-headers-5.14.0-687.29.1.el9_8.x86_64.rpm	c97f3bcc3bee063da9a41f8883015f08c36f2b9afeb3c3f312eae84a810a3494	-	ol9_x86_64_appstream
	kernel-modules-5.14.0-687.29.1.el9_8.x86_64.rpm	73b1bb1bbdf2e4cfe58c96e917db10778be4e72c64744e2c46ab6512d28cc28a	-	ol9_x86_64_baseos_latest
	kernel-modules-5.14.0-687.29.1.el9_8.x86_64.rpm	73b1bb1bbdf2e4cfe58c96e917db10778be4e72c64744e2c46ab6512d28cc28a	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm	c52b2a1b87edf34a8f823d46e034f45ccd4825e35f7e131219f9a41eb028b171	-	ol9_x86_64_baseos_latest
	kernel-modules-core-5.14.0-687.29.1.el9_8.x86_64.rpm	c52b2a1b87edf34a8f823d46e034f45ccd4825e35f7e131219f9a41eb028b171	-	ol9_x86_64_u8_baseos_patch
	kernel-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm	7a2f54785b96e0580075c114cba3257d1208d959f7c63cb545b84b7c85114562	-	ol9_x86_64_baseos_latest
	kernel-modules-extra-5.14.0-687.29.1.el9_8.x86_64.rpm	7a2f54785b96e0580075c114cba3257d1208d959f7c63cb545b84b7c85114562	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-5.14.0-687.29.1.el9_8.x86_64.rpm	b9d6658a9731bba9b741f3f18fc76a00330ba268676d066e2353fb5cbca9ad95	-	ol9_x86_64_baseos_latest
	kernel-tools-5.14.0-687.29.1.el9_8.x86_64.rpm	b9d6658a9731bba9b741f3f18fc76a00330ba268676d066e2353fb5cbca9ad95	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-5.14.0-687.29.1.el9_8.x86_64.rpm	e14d10beac579e9fd44570cd817e2af097e12e353a8058310348eb17f546d83d	-	ol9_x86_64_baseos_latest
	kernel-tools-libs-5.14.0-687.29.1.el9_8.x86_64.rpm	e14d10beac579e9fd44570cd817e2af097e12e353a8058310348eb17f546d83d	-	ol9_x86_64_u8_baseos_patch
	kernel-tools-libs-devel-5.14.0-687.29.1.el9_8.x86_64.rpm	f86e32473ddd6c217b5665249a80f7726de928700af9a680eafd93a191f8ae6a	-	ol9_x86_64_codeready_builder
	kernel-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm	3b50a8673d88ef5e369843e7292d5fd845412b5a4d4345a81d104d5d63b3e2b6	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-5.14.0-687.29.1.el9_8.x86_64.rpm	3b50a8673d88ef5e369843e7292d5fd845412b5a4d4345a81d104d5d63b3e2b6	-	ol9_x86_64_u8_baseos_patch
	kernel-uki-virt-addons-5.14.0-687.29.1.el9_8.x86_64.rpm	db0ce38f1d5099e5e66b63f522c0fb9bda80f578f55ee9250dec2f36c5baeba8	-	ol9_x86_64_baseos_latest
	kernel-uki-virt-addons-5.14.0-687.29.1.el9_8.x86_64.rpm	db0ce38f1d5099e5e66b63f522c0fb9bda80f578f55ee9250dec2f36c5baeba8	-	ol9_x86_64_u8_baseos_patch
	libperf-5.14.0-687.29.1.el9_8.x86_64.rpm	efb761dda85ee806f586ea667f7e517ff9c1a3f174507a53d10862704c264787	-	ol9_x86_64_codeready_builder
	perf-5.14.0-687.29.1.el9_8.x86_64.rpm	13a5a50a35e8999d6504e4d6b509f518ee1687b02fd055031012623185594953	-	ol9_x86_64_appstream
	python3-perf-5.14.0-687.29.1.el9_8.x86_64.rpm	57915b1513fd0e1cf473ba58c6beaf30b130ee274f8e4a4e87232d8e55e9b6de	-	ol9_x86_64_appstream
	rtla-5.14.0-687.29.1.el9_8.x86_64.rpm	ec90bb74b7a19791b1c58317f46bd0d724ad6900c8f269b294e20eba35eb6be8	-	ol9_x86_64_appstream
	rv-5.14.0-687.29.1.el9_8.x86_64.rpm	6a4fdb459db420571caf7ed40be885766acf668dfce154b13a0b95df9f4ba12e	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team