ELSA-2026-50374
- ULN >
- Oracle Linux Errata repository >
- ELSA-2026-50374
ELSA-2026-50374 - Unbreakable Enterprise kernel security update
| Type: | SECURITY |
| Impact: | IMPORTANT |
| Release Date: | 2026-07-04 |
Description
[5.4.17-2136.357.3.1]
- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/MMU: Recursively zap nested TDP SPs when zapping last/only parent (Ben Gardon) [Orabug: 39673892]
- KVM: x86/mmu: Move flush logic from mmu_page_zap_pte() to FNAME(invlpg) (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86/mmu: Passing up the error state of mmu_alloc_shadow_roots() (Like Xu) [Orabug: 39673892]
- KVM: MMU: load PDPTRs outside mmu_lock (Paolo Bonzini) [Orabug: 39673892]
- KVM: x86/mmu: Check PDPTRs before allocating PAE roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (David Matlack) [Orabug: 39673892]
- KVM: x86/mmu: Derive shadow MMU page role from parent (David Matlack) [Orabug: 39673892]
- KVM: X86: Remove useless code to set role.gpte_is_8_bytes when role.direct (Lai Jiangshan) [Orabug: 39673892]
- KVM: X86: Synchronize the shadow pagetable before link it (Lai Jiangshan) [Orabug: 39673892]
- KVM: X86: Fix missed remote tlb flush in rmap_write_protect() (Lai Jiangshan) [Orabug: 39673892]
- KVM: x86/mmu: Refactor shadow walk in __direct_map() to reduce indentation (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Stop passing 'direct' to mmu_alloc_root() (David Matlack) [Orabug: 39673892]
- KVM: x86/mmu: Use a bool for direct (David Matlack) [Orabug: 39673892]
- kvm: mmu: Replace unsigned with unsigned int for PTE access (Ben Gardon) [Orabug: 39673892]
- KVM: x86/mmu: Ensure MMU pages are available when allocating roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Allocate pae_root and lm_root pages in dedicated helper (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Allocate the lm_root before allocating PAE roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Capture 'mmu' in a local variable when allocating roots (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Stash 'kvm' in a local variable in kvm_mmu_free_roots() (Sean Christopherson) [Orabug: 39673892]
- KVM: x86/mmu: Add a helper to consolidate root sp allocation (Sean Christopherson) [Orabug: 39673892]
- net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39680880]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug: 39680880] {CVE-2026-46331}
- net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39680880]
- net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39680880]
- net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39680880]
- net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39680880]
- net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39680880]
[5.4.17-2136.357.3]
- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Minh Nguyen) [Orabug: 39619389] {CVE-2026-52943}
[5.4.17-2136.357.2]
- net: fix fanout UAF in packet_release() via NETDEV_UP race (Yochai Eisenrich) [Orabug: 39250953] {CVE-2026-31504}
- x86/kaslr: Recognize all ZONE_DEVICE users as physaddr consumers (Dan Williams) [Orabug: 39429802]
- x86/kaslr: Reduce KASLR entropy on most x86 systems (Balbir Singh) [Orabug: 39429802]
- net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null (Cezar Bulinaru) [Orabug: 39526882] {CVE-2022-50073}
- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Rutland) [Orabug: 39548666] {CVE-2025-10263}
- arm64: tlb: Add ARM64_WORKAROUND_REPEAT_TLBI_SYNC (Mark Rutland) [Orabug: 39548666]
- ARM: uek: Disable CONFIG_QCOM_FALKOR_ERRATUM_1003 (Boris Ostrovsky) [Orabug: 39548666]
- arm64: tlb: allow XZR argument to TLBI ops (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Premium definitions (Mark Rutland) [Orabug: 39548666]
- arm64: cputype: Add C1-Ultra definitions (Mark Rutland) [Orabug: 39548666]
- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Eric Dumazet) [Orabug: 39300926] {CVE-2026-43037}
[5.4.17-2136.357.1]
- batman-adv: hold claim backbone gateways by reference (Haoze Xie) [Orabug: 39262375] {CVE-2026-31657}
- scsi: fcoe: Reject FIP descriptors with zero fip_dlen in CVL walker (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Michael Bommarito) [Orabug: 39446045]
- scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Michael Bommarito) [Orabug: 39446045]
- rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39152239]
[5.4.17-2136.356.4.1]
- smb: client: reject userspace cifs.spnego descriptions (Asim Viladi Oglu Manizada) [Orabug: 39463669] {CVE-2026-46243}
[5.4.17-2136.356.4]
- tun: free page on build_skb failure in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]
- tap: free page on error paths in tap_get_user_xdp() (Weiming Shi) [Orabug: 39429147]
- tun: free page on short-frame rejection in tun_xdp_one() (Weiming Shi) [Orabug: 39429147]
[5.4.17-2136.356.3]
- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) [Orabug: 39384275,39391459] {CVE-2026-46333}
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) [Orabug: 39368828,39441326] {CVE-2026-43503,CVE-2026-46300}
- net: skbuff: preserve shared-frag marker during coalescing (William Bowling) [Orabug: 39368828] {CVE-2026-46300}
[5.4.17-2136.356.2]
- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Jeff Layton) [Orabug: 39167617,39368718] {CVE-2026-31402}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) [Orabug: 38985173,39368732] {CVE-2026-23216}
- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) [Orabug: 38970455,39368774] {CVE-2026-23193}
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) [Orabug: 39334580,39367147] {CVE-2026-43284}
- x86/CPU/AMD: Add a fix for AMD-SB-7052 (Prathyushi Nangia) [Orabug: 39218897] {CVE-2025-54518}
[5.4.17-2136.356.1]
- arm64/kvm: Include linux/random.h in trng.c (Siddh Raman Pant) [Orabug: 39327096]
- i2c: designware: Disable TX_EMPTY irq while waiting for block length byte (Tam Nguyen) [Orabug: 39174662]
- i2c: designware: Handle invalid SMBus block data response length value (Tam Nguyen) [Orabug: 39174662]
- i2c: designware: fix __i2c_dw_disable() in case master is holding SCL low (Yann Sionneau) [Orabug: 39174662]
[5.4.17-2136.355.3]
- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39250687,39331106] {CVE-2026-43077}
- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39250687,39331111] {CVE-2026-43078}
- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39250687]
- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39250687,39300911] {CVE-2026-43033}
- crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687]
- crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39250687,39452217] {CVE-2026-46028}
- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39250687,39283868,39292250] {CVE-2026-31431}
- crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39250687] {CVE-2026-31431}
- crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39250687]
- crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c (Randy Dunlap) [Orabug: 39250687]
Related CVEs
| CVE-2022-50073 |
| CVE-2025-10263 |
| CVE-2026-31504 |
| CVE-2026-31657 |
| CVE-2026-43037 |
| CVE-2026-46331 |
| CVE-2026-52943 |
| CVE-2026-53359 |
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 7 (x86_64) | kernel-uek-5.4.17-2136.357.3.1.el7uek.src.rpm | fee60764f469278d343d8676e0fbdee19d19d2b37551c0123c7975b54a5db408 | - | ol7_x86_64_UEKR6_ELS |
| kernel-uek-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | 20592faf72c50ddc0ac1a7a41ad23e8856da13988c6c0835ed9d64502215e9f2 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-container-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | b3165f354229f818a4ad2ba7a44e2985924e8d815500c4548cb8bfdfecdb6982 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-container-debug-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | 5bf863cca320f9237e67fd21aa17e40b5b0f750d0480368d94136f02bd73c935 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-debug-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | 4374ea6b2e4e5bde731932549947a1f4ecbd50dd7d67fc52ac7916a5a0d9f0c4 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-debug-devel-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | 843469f4fbbdbf7dcdc0fe9485da58f61f1cae1d96c481878a83c521c4db3ad6 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-devel-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | d1def0d9cbd50e55fe8be47cd5e714cf14d3a4ab722c7309e26d9b23a8fa0f37 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-doc-5.4.17-2136.357.3.1.el7uek.noarch.rpm | b36b700253deb7d696e08ae5ca64c5cba99738a04f286a8915686fcc8d922b26 | - | ol7_x86_64_UEKR6_ELS | |
| kernel-uek-tools-5.4.17-2136.357.3.1.el7uek.x86_64.rpm | 8694f95152081adbd999162bc927004f8152ff34f18f8d72e6d9305702dc9d7d | - | ol7_x86_64_UEKR6_ELS | |
| Oracle Linux 8 (aarch64) | kernel-uek-5.4.17-2136.357.3.1.el8uek.src.rpm | e378589f123c646f10c61c65b6934c69c3869d7e1dfa28be7784428985ed190e | - | ol8_aarch64_baseos_latest |
| kernel-uek-5.4.17-2136.357.3.1.el8uek.src.rpm | e378589f123c646f10c61c65b6934c69c3869d7e1dfa28be7784428985ed190e | - | ol8_aarch64_u10_baseos_patch | |
| kernel-uek-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 7f4673e82831236b1358ae4a1b8572cfe9e7fc3f0df9638165d361f658932f7d | - | ol8_aarch64_baseos_latest | |
| kernel-uek-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 7f4673e82831236b1358ae4a1b8572cfe9e7fc3f0df9638165d361f658932f7d | - | ol8_aarch64_u10_baseos_patch | |
| kernel-uek-debug-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 2d13db8f95edcf28db4dcc6b88fb96d4004d71ffd00237e43ed03a5c76c79b93 | - | ol8_aarch64_baseos_latest | |
| kernel-uek-debug-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 2d13db8f95edcf28db4dcc6b88fb96d4004d71ffd00237e43ed03a5c76c79b93 | - | ol8_aarch64_u10_baseos_patch | |
| kernel-uek-debug-devel-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | eb6df07f1cdea6d26ef9f31d1c7c9e3bdc7203e5a628207aa219255d058212da | - | ol8_aarch64_baseos_latest | |
| kernel-uek-debug-devel-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | eb6df07f1cdea6d26ef9f31d1c7c9e3bdc7203e5a628207aa219255d058212da | - | ol8_aarch64_u10_baseos_patch | |
| kernel-uek-devel-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 1ea3477c5ce8c549b46ad41e914024017d6b29835bbc41f0cbb7e6ff8a73a9d2 | - | ol8_aarch64_baseos_latest | |
| kernel-uek-devel-5.4.17-2136.357.3.1.el8uek.aarch64.rpm | 1ea3477c5ce8c549b46ad41e914024017d6b29835bbc41f0cbb7e6ff8a73a9d2 | - | ol8_aarch64_u10_baseos_patch | |
| kernel-uek-doc-5.4.17-2136.357.3.1.el8uek.noarch.rpm | 425b61ea1758309388abda7304fe4158859f69e7ab690272a5ae858da598c836 | - | ol8_aarch64_baseos_latest | |
| kernel-uek-doc-5.4.17-2136.357.3.1.el8uek.noarch.rpm | 425b61ea1758309388abda7304fe4158859f69e7ab690272a5ae858da598c836 | - | ol8_aarch64_u10_baseos_patch | |
| Oracle Linux 8 (x86_64) | kernel-uek-5.4.17-2136.357.3.1.el8uek.src.rpm | e378589f123c646f10c61c65b6934c69c3869d7e1dfa28be7784428985ed190e | - | ol8_x86_64_UEKR6 |
| kernel-uek-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | 747b66a80bfd47657fba4f5ee6f9b2d7bf93edadb65260e111088c55d976bd5e | - | ol8_x86_64_UEKR6 | |
| kernel-uek-container-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | f358e6a2a5c9b3321354f02805dcb70c91e55300f36369cb1a4236a322ce3dd9 | - | ol8_x86_64_UEKR6 | |
| kernel-uek-container-debug-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | df4e2ec8020e67c22f16acbef0f9aaf4b6420f453655b88ec65d997db01d9d33 | - | ol8_x86_64_UEKR6 | |
| kernel-uek-debug-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | 9a3d832513e87b6fb3b56a6bea3da87838e6090c81f765f493c7b3bfb056e22e | - | ol8_x86_64_UEKR6 | |
| kernel-uek-debug-devel-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | ac35f56cdeff5e74767c5f0c7551511a6b23d518004671ce1e6a8cc0fc7e603a | - | ol8_x86_64_UEKR6 | |
| kernel-uek-devel-5.4.17-2136.357.3.1.el8uek.x86_64.rpm | ad4f1027f8a2bef42095d5b5faabeb4629b3977bd899c31aded7ffe3db51222b | - | ol8_x86_64_UEKR6 | |
| kernel-uek-doc-5.4.17-2136.357.3.1.el8uek.noarch.rpm | 425b61ea1758309388abda7304fe4158859f69e7ab690272a5ae858da598c836 | - | ol8_x86_64_UEKR6 | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
