ELSA-2026-57252
- ULN >
- Oracle Linux Errata repository >
- ELSA-2026-57252
ELSA-2026-57252 - kernel security, bug fix, and enhancement update
| Type: | SECURITY |
| Impact: | IMPORTANT |
| Release Date: | 2026-08-20 |
Description
[5.14.0-687.41.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
[5.14.0-687.41.1]
- smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237668] {CVE-2026-68343}
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227844] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227844] {CVE-2026-64370}
- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227844]
- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227844]
- smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236207] {CVE-2026-68388}
- smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234528] {CVE-2026-64379}
- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232554]
- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232554]
- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232554] {CVE-2026-52991}
- smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234121] {CVE-2026-64386}
- smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234107] {CVE-2026-64382}
- mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231225] {CVE-2026-53189}
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230090] {CVE-2026-64048}
- ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180144] {CVE-2026-46120}
[5.14.0-687.40.1]
- scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213222] {CVE-2026-63888}
- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235811]
- drm/amdgpu: fix amdgpu_hmm_range_get_pages (Jose Exposito) [RHEL-222614] {CVE-2026-63879}
- drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222668] {CVE-2026-53329}
- drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222683] {CVE-2026-53136}
- drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222703] {CVE-2026-53143}
- drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222718] {CVE-2026-45878}
- drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222742] {CVE-2026-63884}
- drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222748] {CVE-2026-53356}
- drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222571] {CVE-2026-64219}
- drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222647] {CVE-2026-53374}
- drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221333] {CVE-2026-43206}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237}
- drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221368] {CVE-2026-43237}
- wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Jose Ignacio Tornos Martinez) [RHEL-181065]
- wifi: iwlwifi: restore FIPS-disabled features with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065]
- wifi: mac80211: allow keys to driver with fips exception (Jose Ignacio Tornos Martinez) [RHEL-181065]
- crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Jose Ignacio Tornos Martinez) [RHEL-181065]
- netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CKI Backport Bot) [RHEL-230625] {CVE-2026-43233}
- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228909] {CVE-2026-64007}
- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228523] {CVE-2026-63952}
- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228523]
- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224549]
- udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179581] {CVE-2026-45991}
Related CVEs
Updated Packages
| Release/Architecture | Filename | sha256 | Superseded By Advisory | Channel Label |
| Oracle Linux 9 (aarch64) | kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_aarch64_appstream |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_aarch64_baseos_latest | |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_aarch64_codeready_builder | |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_aarch64_u8_baseos_patch | |
| kernel-cross-headers-5.14.0-687.41.1.el9_8.aarch64.rpm | 0e7137429d05e2968bd099894402dd2e9c0fb9c6b7decb98b319917e15c1c0d0 | - | ol9_aarch64_codeready_builder | |
| kernel-headers-5.14.0-687.41.1.el9_8.aarch64.rpm | 09822962a76319a935f9899802df3fffe0dd0944bcfc03416fe90ac6eaadc76e | - | ol9_aarch64_appstream | |
| kernel-tools-5.14.0-687.41.1.el9_8.aarch64.rpm | dbed295170e0b4a8bc85981e40a09ea3a79bdf3de2efcb9fd7afd1f6bf8903be | - | ol9_aarch64_baseos_latest | |
| kernel-tools-5.14.0-687.41.1.el9_8.aarch64.rpm | dbed295170e0b4a8bc85981e40a09ea3a79bdf3de2efcb9fd7afd1f6bf8903be | - | ol9_aarch64_u8_baseos_patch | |
| kernel-tools-libs-5.14.0-687.41.1.el9_8.aarch64.rpm | 4f0933cc97390dd8b5ad63ec3554d215ee332cf2f01179afb39d0519ba9606ff | - | ol9_aarch64_baseos_latest | |
| kernel-tools-libs-5.14.0-687.41.1.el9_8.aarch64.rpm | 4f0933cc97390dd8b5ad63ec3554d215ee332cf2f01179afb39d0519ba9606ff | - | ol9_aarch64_u8_baseos_patch | |
| kernel-tools-libs-devel-5.14.0-687.41.1.el9_8.aarch64.rpm | 510d9e003bae2fd610b580dd09cef70ea0080416fcda774dd37c42fea1b357b8 | - | ol9_aarch64_codeready_builder | |
| libperf-5.14.0-687.41.1.el9_8.aarch64.rpm | d7616769deaaabbbc6f176ddb9a4c4c818807acec2b9e8a9a8637348a36a3134 | - | ol9_aarch64_codeready_builder | |
| perf-5.14.0-687.41.1.el9_8.aarch64.rpm | 7ef4b9c53392bdde015ef768c424817acc5574f575a882f016dd862a303cd368 | - | ol9_aarch64_appstream | |
| python3-perf-5.14.0-687.41.1.el9_8.aarch64.rpm | 550a333ba434373d1e2130f1da36ace54b659ce34f186b507c3b2c48f103412f | - | ol9_aarch64_appstream | |
| rtla-5.14.0-687.41.1.el9_8.aarch64.rpm | 3a78058f7b705ed61a5caa9e6d5f6523a173470870d0ea9094912f385a0d3992 | - | ol9_aarch64_appstream | |
| rv-5.14.0-687.41.1.el9_8.aarch64.rpm | 5d0f26488b37c574c4ea8f57f3925d2c96cb593a15ff510c5c1bbc373b441637 | - | ol9_aarch64_appstream | |
| Oracle Linux 9 (x86_64) | kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_x86_64_appstream |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_x86_64_baseos_latest | |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_x86_64_codeready_builder | |
| kernel-5.14.0-687.41.1.el9_8.src.rpm | e78f5770534ad57d9cb828999dfb007ea900f3a2bcf347a23d6ccf117fb77444 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-5.14.0-687.41.1.el9_8.x86_64.rpm | d9d47874008df4f65ce5708f66a1f27f6f89f5c8ceba5c1f05f15828556600e4 | - | ol9_x86_64_baseos_latest | |
| kernel-5.14.0-687.41.1.el9_8.x86_64.rpm | d9d47874008df4f65ce5708f66a1f27f6f89f5c8ceba5c1f05f15828556600e4 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-abi-stablelists-5.14.0-687.41.1.el9_8.noarch.rpm | 21abe53530d9dc9a95b41366910b83dacd697d1d22a9dd8a74e398189b55f55d | - | ol9_x86_64_baseos_latest | |
| kernel-abi-stablelists-5.14.0-687.41.1.el9_8.noarch.rpm | 21abe53530d9dc9a95b41366910b83dacd697d1d22a9dd8a74e398189b55f55d | - | ol9_x86_64_u8_baseos_patch | |
| kernel-core-5.14.0-687.41.1.el9_8.x86_64.rpm | 72e1c2ab51d9322569633a2fea8045df82401b008855e786da3d891eb52f1449 | - | ol9_x86_64_baseos_latest | |
| kernel-core-5.14.0-687.41.1.el9_8.x86_64.rpm | 72e1c2ab51d9322569633a2fea8045df82401b008855e786da3d891eb52f1449 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-cross-headers-5.14.0-687.41.1.el9_8.x86_64.rpm | 849dcd92df14c7c17e88ae169a5422a6176490665dbeb69d4e08b20a9b943e24 | - | ol9_x86_64_codeready_builder | |
| kernel-debug-5.14.0-687.41.1.el9_8.x86_64.rpm | bdc7f5d5cd320b014c1830615ef78a90c22d6bb3f41eaf313f81363771cd09f7 | - | ol9_x86_64_baseos_latest | |
| kernel-debug-5.14.0-687.41.1.el9_8.x86_64.rpm | bdc7f5d5cd320b014c1830615ef78a90c22d6bb3f41eaf313f81363771cd09f7 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-debug-core-5.14.0-687.41.1.el9_8.x86_64.rpm | f93afd57e069c00393123e1b4aa6f3e925f1a0a826fa13f82375712a2f072f4c | - | ol9_x86_64_baseos_latest | |
| kernel-debug-core-5.14.0-687.41.1.el9_8.x86_64.rpm | f93afd57e069c00393123e1b4aa6f3e925f1a0a826fa13f82375712a2f072f4c | - | ol9_x86_64_u8_baseos_patch | |
| kernel-debug-devel-5.14.0-687.41.1.el9_8.x86_64.rpm | 2127698ea85f12fd1931cdd993c3278a2f84bc654c2508d9d752339b821bf7b1 | - | ol9_x86_64_appstream | |
| kernel-debug-devel-matched-5.14.0-687.41.1.el9_8.x86_64.rpm | f04e3ba43ef10efc6974d6565d49dc34767964a897dd37f1fec36c935715bab0 | - | ol9_x86_64_appstream | |
| kernel-debug-modules-5.14.0-687.41.1.el9_8.x86_64.rpm | 4007f9f7df256b39520b96dc0b004afef9c1af4ae58283f7a9e59788a574d970 | - | ol9_x86_64_baseos_latest | |
| kernel-debug-modules-5.14.0-687.41.1.el9_8.x86_64.rpm | 4007f9f7df256b39520b96dc0b004afef9c1af4ae58283f7a9e59788a574d970 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-debug-modules-core-5.14.0-687.41.1.el9_8.x86_64.rpm | e62391ad6091e38c0f202da185861a13f5b892880607cca6d52408846bc7c7cd | - | ol9_x86_64_baseos_latest | |
| kernel-debug-modules-core-5.14.0-687.41.1.el9_8.x86_64.rpm | e62391ad6091e38c0f202da185861a13f5b892880607cca6d52408846bc7c7cd | - | ol9_x86_64_u8_baseos_patch | |
| kernel-debug-modules-extra-5.14.0-687.41.1.el9_8.x86_64.rpm | 667341cd362df44b0060efa29ac8f6eb729630197a98eaaf7809a0a53e10cb47 | - | ol9_x86_64_baseos_latest | |
| kernel-debug-modules-extra-5.14.0-687.41.1.el9_8.x86_64.rpm | 667341cd362df44b0060efa29ac8f6eb729630197a98eaaf7809a0a53e10cb47 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-debug-uki-virt-5.14.0-687.41.1.el9_8.x86_64.rpm | cbc30eb473fcaa8a099d257ca39f7d2882939703a44abcb295ff96b78eaa5c0b | - | ol9_x86_64_baseos_latest | |
| kernel-debug-uki-virt-5.14.0-687.41.1.el9_8.x86_64.rpm | cbc30eb473fcaa8a099d257ca39f7d2882939703a44abcb295ff96b78eaa5c0b | - | ol9_x86_64_u8_baseos_patch | |
| kernel-devel-5.14.0-687.41.1.el9_8.x86_64.rpm | e86427295af4ba9965ab33cbcc16184e5f27c0c35b5c65576583a167ebb36d6d | - | ol9_x86_64_appstream | |
| kernel-devel-matched-5.14.0-687.41.1.el9_8.x86_64.rpm | b1c5c27d199268632d0b9218a30865371db20e0698a37b5fdc1a3cf0637863d0 | - | ol9_x86_64_appstream | |
| kernel-doc-5.14.0-687.41.1.el9_8.noarch.rpm | ebbed91dd46d5adcf917e35b8ea2dc37dbc17db5669e92184f84b3599d9a5be5 | - | ol9_x86_64_appstream | |
| kernel-headers-5.14.0-687.41.1.el9_8.x86_64.rpm | b40f154ed5d447426ebc0d926f9b1d35c878877eed4c68f9b6aa00e1ca3d1d93 | - | ol9_x86_64_appstream | |
| kernel-modules-5.14.0-687.41.1.el9_8.x86_64.rpm | 749d491a7bd86a468a68565e33dd6af82026157c6e80dbe4975e173508d87b56 | - | ol9_x86_64_baseos_latest | |
| kernel-modules-5.14.0-687.41.1.el9_8.x86_64.rpm | 749d491a7bd86a468a68565e33dd6af82026157c6e80dbe4975e173508d87b56 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-modules-core-5.14.0-687.41.1.el9_8.x86_64.rpm | 52867c9b147e595967ed764753e9f420f9cf6f268e01f369d1baddd96e3b42aa | - | ol9_x86_64_baseos_latest | |
| kernel-modules-core-5.14.0-687.41.1.el9_8.x86_64.rpm | 52867c9b147e595967ed764753e9f420f9cf6f268e01f369d1baddd96e3b42aa | - | ol9_x86_64_u8_baseos_patch | |
| kernel-modules-extra-5.14.0-687.41.1.el9_8.x86_64.rpm | d54d62ccf6af49b5088c7d2d833c335e80ef2b2a557103b7d6ea984f25304700 | - | ol9_x86_64_baseos_latest | |
| kernel-modules-extra-5.14.0-687.41.1.el9_8.x86_64.rpm | d54d62ccf6af49b5088c7d2d833c335e80ef2b2a557103b7d6ea984f25304700 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-tools-5.14.0-687.41.1.el9_8.x86_64.rpm | 553bf00e0013ccee40f85c697d27bcff246aa1b22a237420d66c7f88201ed341 | - | ol9_x86_64_baseos_latest | |
| kernel-tools-5.14.0-687.41.1.el9_8.x86_64.rpm | 553bf00e0013ccee40f85c697d27bcff246aa1b22a237420d66c7f88201ed341 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-tools-libs-5.14.0-687.41.1.el9_8.x86_64.rpm | 9c8a27e95dae4dbd073ef4b50ca43775bf94650684bd6efa277370be32185101 | - | ol9_x86_64_baseos_latest | |
| kernel-tools-libs-5.14.0-687.41.1.el9_8.x86_64.rpm | 9c8a27e95dae4dbd073ef4b50ca43775bf94650684bd6efa277370be32185101 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-tools-libs-devel-5.14.0-687.41.1.el9_8.x86_64.rpm | 00952c177788ab8a919ccb06381c6502d94bc1b72acbdcd94fe524bfe0de3013 | - | ol9_x86_64_codeready_builder | |
| kernel-uki-virt-5.14.0-687.41.1.el9_8.x86_64.rpm | 2ef3ac75424021891036c133c2fc7c314bfd7eef71b1f36c366f0046c47683a0 | - | ol9_x86_64_baseos_latest | |
| kernel-uki-virt-5.14.0-687.41.1.el9_8.x86_64.rpm | 2ef3ac75424021891036c133c2fc7c314bfd7eef71b1f36c366f0046c47683a0 | - | ol9_x86_64_u8_baseos_patch | |
| kernel-uki-virt-addons-5.14.0-687.41.1.el9_8.x86_64.rpm | eddce10b05bbe08de67c760eff4cc792787a48e995101172338be9cce557e230 | - | ol9_x86_64_baseos_latest | |
| kernel-uki-virt-addons-5.14.0-687.41.1.el9_8.x86_64.rpm | eddce10b05bbe08de67c760eff4cc792787a48e995101172338be9cce557e230 | - | ol9_x86_64_u8_baseos_patch | |
| libperf-5.14.0-687.41.1.el9_8.x86_64.rpm | ca09efe8158eca5b4a8457bf004ae77f8a098008131162f0e824569a44801c57 | - | ol9_x86_64_codeready_builder | |
| perf-5.14.0-687.41.1.el9_8.x86_64.rpm | 9534640007fd14199eb3af2f3fc8352fd6db90d3cf34d8418a166e94da2ba949 | - | ol9_x86_64_appstream | |
| python3-perf-5.14.0-687.41.1.el9_8.x86_64.rpm | a528ebfc04fb82b57d3bc841adf33525870d877ac914d48d1ebdcd333e1e2186 | - | ol9_x86_64_appstream | |
| rtla-5.14.0-687.41.1.el9_8.x86_64.rpm | 43e66e2ab725d9adcae7e9be2cdbfd89952f22db0d86a989cc937ec8c8119222 | - | ol9_x86_64_appstream | |
| rv-5.14.0-687.41.1.el9_8.x86_64.rpm | 3cd947f2a77c388770562d3f5362a236748aaff4a30e9c99bca0d17040d5039a | - | ol9_x86_64_appstream | |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team
