Stay Connected:

ELSA-2026-86033

ELSA-2026-86033 - kernel security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-20

Description


[5.14.0-687.59.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.59.1]
- net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987]
- ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999}
- smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631}
- exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633}
- strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747]
- xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697]
- xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697]
- xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697]
- bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032}
- net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528]
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958}
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429]
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962}
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963}
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961}
- USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956}
- USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957}
- USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928}
- USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899}
- Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
- openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935}


Related CVEs


CVE-2026-31678
CVE-2026-52935
CVE-2026-63899
CVE-2026-63962
CVE-2026-63974
CVE-2026-64024
CVE-2026-64032
CVE-2026-64114
CVE-2026-64572
CVE-2026-74509
CVE-2026-80590
CVE-2026-89633
CVE-2026-93817
CVE-2026-98260
CVE-2026-99999

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 9 (aarch64) kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_aarch64_appstream
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_aarch64_baseos_latest
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_aarch64_codeready_builder
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_aarch64_u8_baseos_patch
kernel-cross-headers-5.14.0-687.59.1.el9_8.aarch64.rpm7f5e169d2245c35be04e69b0e6b92c5940027aed5a754dac41903e651c52770c-ol9_aarch64_codeready_builder
kernel-headers-5.14.0-687.59.1.el9_8.aarch64.rpm1576c6beecb9dc9d449039de507b24dc6c9f16331499d93ae80b7948123608f2-ol9_aarch64_appstream
kernel-tools-5.14.0-687.59.1.el9_8.aarch64.rpm15ba9e7487ec50027b4e37f039f65971acb1b31612c900284e17f14731ecb035-ol9_aarch64_baseos_latest
kernel-tools-5.14.0-687.59.1.el9_8.aarch64.rpm15ba9e7487ec50027b4e37f039f65971acb1b31612c900284e17f14731ecb035-ol9_aarch64_u8_baseos_patch
kernel-tools-libs-5.14.0-687.59.1.el9_8.aarch64.rpm78535d43ee0c4f3166b54845270f31ba57dc2fa3be330f1467e44ce7c3a1a003-ol9_aarch64_baseos_latest
kernel-tools-libs-5.14.0-687.59.1.el9_8.aarch64.rpm78535d43ee0c4f3166b54845270f31ba57dc2fa3be330f1467e44ce7c3a1a003-ol9_aarch64_u8_baseos_patch
kernel-tools-libs-devel-5.14.0-687.59.1.el9_8.aarch64.rpm9e60384fe43113eaefdebff3e52ac24ba9e3f076a2a6a22a7163579c61f3323a-ol9_aarch64_codeready_builder
libperf-5.14.0-687.59.1.el9_8.aarch64.rpm995e143f8d7bdc5fcc169bc609475029cb44cf65e3442b5021efe94cf05041b5-ol9_aarch64_codeready_builder
perf-5.14.0-687.59.1.el9_8.aarch64.rpmd678348b93b066b55a3d8d7f9166e7e6ffffd5c2e3828975efcb0cf5886790d7-ol9_aarch64_appstream
python3-perf-5.14.0-687.59.1.el9_8.aarch64.rpmef394f4bc3492c7cdcedc3c37b6640bd36a94297f11c06cc7b2c7214248018c5-ol9_aarch64_appstream
rtla-5.14.0-687.59.1.el9_8.aarch64.rpm60f0e32de36554ba25bcf16cd1c50b23ba81850cb72fd0174620f8e97c95733c-ol9_aarch64_appstream
rv-5.14.0-687.59.1.el9_8.aarch64.rpm014aa530e694e71a53d68e7bd81348f5224bc938f5a2a88cf86760b9bfda0f1c-ol9_aarch64_appstream
Oracle Linux 9 (x86_64) kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_x86_64_appstream
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_x86_64_baseos_latest
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_x86_64_codeready_builder
kernel-5.14.0-687.59.1.el9_8.src.rpmff1e2cc58f4c0081403f731ab0ade4bc2402321638fa5598c4ad63fd58066233-ol9_x86_64_u8_baseos_patch
kernel-5.14.0-687.59.1.el9_8.x86_64.rpm160d4a6f086b9f1800ee8ad382b509c4e4f47f3affb1ac0ce2bcf7f7c29cf2fb-ol9_x86_64_baseos_latest
kernel-5.14.0-687.59.1.el9_8.x86_64.rpm160d4a6f086b9f1800ee8ad382b509c4e4f47f3affb1ac0ce2bcf7f7c29cf2fb-ol9_x86_64_u8_baseos_patch
kernel-abi-stablelists-5.14.0-687.59.1.el9_8.noarch.rpm0588de7c29b6526de3cee75a524c28c169c74180c07192f0af3cd52e255942b0-ol9_x86_64_baseos_latest
kernel-abi-stablelists-5.14.0-687.59.1.el9_8.noarch.rpm0588de7c29b6526de3cee75a524c28c169c74180c07192f0af3cd52e255942b0-ol9_x86_64_u8_baseos_patch
kernel-core-5.14.0-687.59.1.el9_8.x86_64.rpmf239baaea3a0e7672d9b53bf869655b9deceaa5ea04fd00f32b6b8ea19c9d4e2-ol9_x86_64_baseos_latest
kernel-core-5.14.0-687.59.1.el9_8.x86_64.rpmf239baaea3a0e7672d9b53bf869655b9deceaa5ea04fd00f32b6b8ea19c9d4e2-ol9_x86_64_u8_baseos_patch
kernel-cross-headers-5.14.0-687.59.1.el9_8.x86_64.rpm120a8f9851c9217c1a75c4cbece650e71fa25f9905f174bed53efde6934d22f8-ol9_x86_64_codeready_builder
kernel-debug-5.14.0-687.59.1.el9_8.x86_64.rpm189b0dd2cb6cb2515983e3f7eeffb4f42df0a1d8d68f5ed11e711d5415f14040-ol9_x86_64_baseos_latest
kernel-debug-5.14.0-687.59.1.el9_8.x86_64.rpm189b0dd2cb6cb2515983e3f7eeffb4f42df0a1d8d68f5ed11e711d5415f14040-ol9_x86_64_u8_baseos_patch
kernel-debug-core-5.14.0-687.59.1.el9_8.x86_64.rpm355ac63a08d444f2bde23dd750dcc4ef549984633b55a9e65ea044525d7b9a2b-ol9_x86_64_baseos_latest
kernel-debug-core-5.14.0-687.59.1.el9_8.x86_64.rpm355ac63a08d444f2bde23dd750dcc4ef549984633b55a9e65ea044525d7b9a2b-ol9_x86_64_u8_baseos_patch
kernel-debug-devel-5.14.0-687.59.1.el9_8.x86_64.rpm7040463bfcd9498fb40364c545fc9a31a623de2c75f7ce5eac323b8a52b0f6a4-ol9_x86_64_appstream
kernel-debug-devel-matched-5.14.0-687.59.1.el9_8.x86_64.rpmd2fa69a9044376e315d723cf0d99f4f579fbc059cc57dac861a0b78635e5b6ca-ol9_x86_64_appstream
kernel-debug-modules-5.14.0-687.59.1.el9_8.x86_64.rpmd0607f6c38f2da4a979f672d59ce0c27e42b37f2f2d60952df129d586f0c4717-ol9_x86_64_baseos_latest
kernel-debug-modules-5.14.0-687.59.1.el9_8.x86_64.rpmd0607f6c38f2da4a979f672d59ce0c27e42b37f2f2d60952df129d586f0c4717-ol9_x86_64_u8_baseos_patch
kernel-debug-modules-core-5.14.0-687.59.1.el9_8.x86_64.rpm048c4ed52f10958cf607ab933f44d67eb87a51c85fd4a81956cc2f6ab7e7ea61-ol9_x86_64_baseos_latest
kernel-debug-modules-core-5.14.0-687.59.1.el9_8.x86_64.rpm048c4ed52f10958cf607ab933f44d67eb87a51c85fd4a81956cc2f6ab7e7ea61-ol9_x86_64_u8_baseos_patch
kernel-debug-modules-extra-5.14.0-687.59.1.el9_8.x86_64.rpmd6f2d8fa5a97870d76ed76ccd536bef78a4983b70afea1c608cf0e91c2a6eea9-ol9_x86_64_baseos_latest
kernel-debug-modules-extra-5.14.0-687.59.1.el9_8.x86_64.rpmd6f2d8fa5a97870d76ed76ccd536bef78a4983b70afea1c608cf0e91c2a6eea9-ol9_x86_64_u8_baseos_patch
kernel-debug-uki-virt-5.14.0-687.59.1.el9_8.x86_64.rpm7bd0a30fdab9b6845fdad8c1a5939fdf97fdf9d71b08c53aabb43298916c0488-ol9_x86_64_baseos_latest
kernel-debug-uki-virt-5.14.0-687.59.1.el9_8.x86_64.rpm7bd0a30fdab9b6845fdad8c1a5939fdf97fdf9d71b08c53aabb43298916c0488-ol9_x86_64_u8_baseos_patch
kernel-devel-5.14.0-687.59.1.el9_8.x86_64.rpm95cebac23466524b16218faa7409b9a772353e6f68db8641770fb69f8d1aca8d-ol9_x86_64_appstream
kernel-devel-matched-5.14.0-687.59.1.el9_8.x86_64.rpm3b26ee2e545632e111216668506298bea713e27600e898123ae78e4c1f2907c5-ol9_x86_64_appstream
kernel-doc-5.14.0-687.59.1.el9_8.noarch.rpmac3cca2f028c233a51858a41cbfffd1bae8dd48742c17d6de783b58bf55942ed-ol9_x86_64_appstream
kernel-headers-5.14.0-687.59.1.el9_8.x86_64.rpmc7e50d35cf6594e65719901331de2d03ffcb4d5746bb3826a1ca53902d4c24c1-ol9_x86_64_appstream
kernel-modules-5.14.0-687.59.1.el9_8.x86_64.rpm382f32a164ada88203d7a0f4dddb978bb7adde85c625a2f4030a8a85fcd81e01-ol9_x86_64_baseos_latest
kernel-modules-5.14.0-687.59.1.el9_8.x86_64.rpm382f32a164ada88203d7a0f4dddb978bb7adde85c625a2f4030a8a85fcd81e01-ol9_x86_64_u8_baseos_patch
kernel-modules-core-5.14.0-687.59.1.el9_8.x86_64.rpmfda7acb2a7edf23f531b83af341ce67e5f1801632c953029bd6d3ed95a2d4c22-ol9_x86_64_baseos_latest
kernel-modules-core-5.14.0-687.59.1.el9_8.x86_64.rpmfda7acb2a7edf23f531b83af341ce67e5f1801632c953029bd6d3ed95a2d4c22-ol9_x86_64_u8_baseos_patch
kernel-modules-extra-5.14.0-687.59.1.el9_8.x86_64.rpme4a0a5747e8223672c25e2f62814769b4dedca0f3b18a5b9cffa4a6d6d68726e-ol9_x86_64_baseos_latest
kernel-modules-extra-5.14.0-687.59.1.el9_8.x86_64.rpme4a0a5747e8223672c25e2f62814769b4dedca0f3b18a5b9cffa4a6d6d68726e-ol9_x86_64_u8_baseos_patch
kernel-tools-5.14.0-687.59.1.el9_8.x86_64.rpmf5c3d57ba1d9d52631f9b63caa6463b128f219a015c15d37f6015c57454469ca-ol9_x86_64_baseos_latest
kernel-tools-5.14.0-687.59.1.el9_8.x86_64.rpmf5c3d57ba1d9d52631f9b63caa6463b128f219a015c15d37f6015c57454469ca-ol9_x86_64_u8_baseos_patch
kernel-tools-libs-5.14.0-687.59.1.el9_8.x86_64.rpme0b580523995b621f613a0ff776534693aa176c498eadd18005d6f147467668c-ol9_x86_64_baseos_latest
kernel-tools-libs-5.14.0-687.59.1.el9_8.x86_64.rpme0b580523995b621f613a0ff776534693aa176c498eadd18005d6f147467668c-ol9_x86_64_u8_baseos_patch
kernel-tools-libs-devel-5.14.0-687.59.1.el9_8.x86_64.rpm9662f3f33024b7ca304e5ac923e7aac0ea648c268dcb162d1eccaeb83eeacece-ol9_x86_64_codeready_builder
kernel-uki-virt-5.14.0-687.59.1.el9_8.x86_64.rpmbe785ce98f92f92df8e1493e1a519c435d41ce5456f0c59b64860b021f6ad38f-ol9_x86_64_baseos_latest
kernel-uki-virt-5.14.0-687.59.1.el9_8.x86_64.rpmbe785ce98f92f92df8e1493e1a519c435d41ce5456f0c59b64860b021f6ad38f-ol9_x86_64_u8_baseos_patch
kernel-uki-virt-addons-5.14.0-687.59.1.el9_8.x86_64.rpm35d2caca8eea02df628dcdd545c1be3f4f9ba7610b44b7b2b8e074308bd2b75e-ol9_x86_64_baseos_latest
kernel-uki-virt-addons-5.14.0-687.59.1.el9_8.x86_64.rpm35d2caca8eea02df628dcdd545c1be3f4f9ba7610b44b7b2b8e074308bd2b75e-ol9_x86_64_u8_baseos_patch
libperf-5.14.0-687.59.1.el9_8.x86_64.rpme51db2fb7ed163e5a18e38ad0b1f926b62499dc63664b96334e65a2ac7303744-ol9_x86_64_codeready_builder
perf-5.14.0-687.59.1.el9_8.x86_64.rpm0dafc85e3084ca92025bb171b4613bca1b4f18fbaf2899ea396b88cec8b6eb24-ol9_x86_64_appstream
python3-perf-5.14.0-687.59.1.el9_8.x86_64.rpm522cf4f71be3630a0096cdfbc7363ab70516373626f6f7871cea450cd33d8ad4-ol9_x86_64_appstream
rtla-5.14.0-687.59.1.el9_8.x86_64.rpmc1d2c1e8d9f366e41e80792c96ad88b304eebab644ea49282bf8358380927499-ol9_x86_64_appstream
rv-5.14.0-687.59.1.el9_8.x86_64.rpm2de4062da212423cccb5f9d1f96d03fd782fc900e8c6f1c57ef8312db4e215f2-ol9_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights