ELSA-2026-500136

ELSA-2026-500136 - Unbreakable Enterprise kernel security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-08-05

Description

[5.4.17-2136.358.2.0.1]
- x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 39832992] {CVE-2026-68480}
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug: 39832992]
- x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39832992]
- x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39832992]
- x86/alternatives: Add alt_instr.flags (Borislav Petkov (AMD)) [Orabug: 39832992]
- x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39832992]
- x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39832992]
- x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39832992]
(H. Peter Anvin (Intel)) [Orabug: 39832992]
- x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39832992]
- x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39832992]
- x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39832992]
- x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39832992]
- x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39832992]
- x86/alternative: Merge include files (Juergen Gross) [Orabug: 39832992]
- x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug: 39832992]
- x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39832992]
- x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39832992]
- tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug: 39832992]
- perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39832992]
- objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39832992]
- objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39832992]
- x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39832992]
- tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39832992]
- x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39832992]
- tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39832992]
- net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39832997]

[5.4.17-2136.358.2]
- xfs: resample the data fork mapping after cycling ILOCK (Darrick J. Wong) [Orabug: 39776792] {CVE-2026-64600}
- net: Work around Marvell NIC TX stalls (Venkat Venkatsubra) [Orabug: 39765820]

[5.4.17-2136.358.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673871]
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon) [Orabug: 39673871]
- KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [Orabug: 39673871]
- KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu) [Orabug: 39673871]
- KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini) [Orabug: 39673871]
- KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack) [Orabug: 39673871]
- KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack) [Orabug: 39673871]
- KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan) [Orabug: 39673871]
- KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan) [Orabug: 39673871]
- KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan) [Orabug: 39673871]
- KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Stop passing 'direct' to mmu_alloc_root() (David Matlack) [Orabug: 39673871]
- KVM: x86/mmu: Use a bool for direct (David Matlack) [Orabug: 39673871]
- kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon) [Orabug: 39673871]
- KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson) [Orabug: 39673871]
- KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson) [Orabug: 39673871]
- Revert 'net/rds: poll eq during user-reset' (Praveen Kumar Kannoju) [Orabug: 39659401]
- net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39567287]
- net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567287]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39567287] {CVE-2026-46331}
- net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39567287]
- net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567287]
- net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567287]
- net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39567287]
- net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39567287]
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39567287]
- net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39567287]
- RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (hkbinbin) [Orabug: 39452261] {CVE-2026-46043}
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug: 39426001]
- rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug: 39426001] {CVE-2026-43499}
- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300930] {CVE-2026-43038}
- tracing/events: Expand global buffer for in-kernel event enables (Manjunath Patil) [Orabug: 38790406]
- net/mlx5: poll mlx5 eq during irq migration (Praveen Kumar Kannoju) [Orabug: 38776184]

[5.4.17-2136.357.3]
- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39619389] {CVE-2026-52943}

[5.4.17-2136.357.2]
- net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39250953] {CVE-2026-31504}
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams) [Orabug: 39429802]
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh) [Orabug: 39429802]
- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [Orabug: 39526882] {CVE-2022-50073}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
- arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39548666]
- ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 39548666]
- arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Premium definitions (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Ultra definitions (Mark Rutland) [Orabug: 39548666]
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet) [Orabug: 39300926] {CVE-2026-43037}

[5.4.17-2136.357.1]
- batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39262375] {CVE-2026-31657}
- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito) [Orabug: 39446045]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39152239]

[5.4.17-2136.356.4.1]
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463669] {CVE-2026-46243}

[5.4.17-2136.356.4]
- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39429147]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]

[5.4.17-2136.356.3]
- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39384275,39391459] {CVE-2026-46333}
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39368828,39441326] {CVE-2026-43503,CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368828] {CVE-2026-46300}

[5.4.17-2136.356.2]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39167617,39368718] {CVE-2026-31402}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985173,39368732] {CVE-2026-23216}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970455,39368774] {CVE-2026-23193}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334580,39367147] {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218897] {CVE-2025-54518}

Related CVEs

CVE-2026-68480

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 7 (x86_64)	kernel-uek-5.4.17-2136.358.2.0.1.el7uek.src.rpm	cd0adb870fd6d9a8e1c6fba06adc26cb6202decd303c87e0b192e51a4e8ee83c	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	12e747e17058a2c4019abec8cb31b894af3270dd8a772cd2243d6994b989c431	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	f94fad2dd03dec35752035b1873e81a0a7c6be630c7b775d6a9304d7b999ac53	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-container-debug-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	0f6fe87a908bed2caedd5c8340fb180525aff9c8df0bb4bb08a69a3078f3adf5	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	42efa072faa65e0230b9f884a68371961913a869f0af3798bdfa84396e99ebe9	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-debug-devel-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	2a1f7c9c65deb3f41f03507737d1c83df7860724bb4f0d15e8e66d5ef76c3dc3	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-devel-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	884e2f046581a0aff46c6ba541426487e0b5b32e9281301fac20d8b26566ba88	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-doc-5.4.17-2136.358.2.0.1.el7uek.noarch.rpm	d25c711a401a69611b3e714a4888291f2fd21f4936995e0f8b338d213de60b1d	-	ol7_x86_64_UEKR6_ELS
	kernel-uek-tools-5.4.17-2136.358.2.0.1.el7uek.x86_64.rpm	07fef1554b51f27357988acd0f69f7264a625ebccbb4eac317b92425a53a9c6f	-	ol7_x86_64_UEKR6_ELS
Oracle Linux 8 (aarch64)	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.src.rpm	68b0843eb4351b7855470671b86f760ba89dfe792c3b9b0d1e3b47698323bebc	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.src.rpm	68b0843eb4351b7855470671b86f760ba89dfe792c3b9b0d1e3b47698323bebc	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	a994cde001c92ed3f351fe1189fa7018aa481a0f0ae7fc672ba62e62c43f325e	-	ol8_aarch64_baseos_latest
	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	a994cde001c92ed3f351fe1189fa7018aa481a0f0ae7fc672ba62e62c43f325e	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	72b80afb46cb4c53fc1161aadba6f9f3a7dea2bc762fbbf1572bb8e98f8d73ab	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	72b80afb46cb4c53fc1161aadba6f9f3a7dea2bc762fbbf1572bb8e98f8d73ab	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-debug-devel-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	4e63fa6a6b9e61d4b5e12625cbe9486f7a10620e0f390fa51a8fb347f78c4225	-	ol8_aarch64_baseos_latest
	kernel-uek-debug-devel-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	4e63fa6a6b9e61d4b5e12625cbe9486f7a10620e0f390fa51a8fb347f78c4225	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-devel-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	6f0dc2ff19288d8fab236f59f6cf4ef7ad1ecbd4afbbb36955c187885b2493d8	-	ol8_aarch64_baseos_latest
	kernel-uek-devel-5.4.17-2136.358.2.0.1.el8uek.aarch64.rpm	6f0dc2ff19288d8fab236f59f6cf4ef7ad1ecbd4afbbb36955c187885b2493d8	-	ol8_aarch64_u10_baseos_patch
	kernel-uek-doc-5.4.17-2136.358.2.0.1.el8uek.noarch.rpm	63b646680c502c77a6e12747b4ca8f541239c053dd6aaffc5a27bbfc30d4a6d7	-	ol8_aarch64_baseos_latest
	kernel-uek-doc-5.4.17-2136.358.2.0.1.el8uek.noarch.rpm	63b646680c502c77a6e12747b4ca8f541239c053dd6aaffc5a27bbfc30d4a6d7	-	ol8_aarch64_u10_baseos_patch
Oracle Linux 8 (x86_64)	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.src.rpm	68b0843eb4351b7855470671b86f760ba89dfe792c3b9b0d1e3b47698323bebc	-	ol8_x86_64_UEKR6
	kernel-uek-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	1ec03575f21c4857085a1300ca2bd2c5b966ad2381609d231a1e8aee0adb2ad9	-	ol8_x86_64_UEKR6
	kernel-uek-container-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	0d8442bb28268c849a04342c3c41311d20d9328576ac7f822a16436730ef02e0	-	ol8_x86_64_UEKR6
	kernel-uek-container-debug-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	461ce499947711ddae9517cc2224663cc7f2b9026857c66d2d5d4b6da1acf2d9	-	ol8_x86_64_UEKR6
	kernel-uek-debug-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	374a9687da6620861054a86cde4d9bf28ce909f7c8e03aa0cb9465df79061c2f	-	ol8_x86_64_UEKR6
	kernel-uek-debug-devel-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	8b103cdd1f9512ab3cea13dac66e8078112ac836db0cb2a1a90f694fd2593ee5	-	ol8_x86_64_UEKR6
	kernel-uek-devel-5.4.17-2136.358.2.0.1.el8uek.x86_64.rpm	ae5c478fff1a62a94825371423fcbe01f5e75571807f61dc5d983c23011a7e8f	-	ol8_x86_64_UEKR6
	kernel-uek-doc-5.4.17-2136.358.2.0.1.el8uek.noarch.rpm	63b646680c502c77a6e12747b4ca8f541239c053dd6aaffc5a27bbfc30d4a6d7	-	ol8_x86_64_UEKR6

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team