Stay Connected:

ELSA-2026-87805

ELSA-2026-87805 - kernel security, bug fix, and enhancement update

Type:SECURITY
Impact:IMPORTANT
Release Date:2026-10-23

Description


[5.14.0-687.60.1]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5]
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]

[5.14.0-687.60.1]
- xfs: bounds-check buffer log item's dirty bitmap (Pavel Reichl) [RHEL-253366] {CVE-2026-80536}
- ovl: check access to copy_file_range source with src mounter creds (Miklos Szeredi) [RHEL-238870] {CVE-2026-68448}
- ALSA: seq: close a re-opened queue timer in the destructor (CKI Backport Bot) [RHEL-263709] {CVE-2026-68202}
- calipso: unlock rcu before returning -EAFNOSUPPORT (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- calipso: Don't call calipso functions for AF_INET sk. (CKI Backport Bot) [RHEL-257685] {CVE-2025-38147}
- netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets (CKI Backport Bot) [RHEL-257666] {CVE-2025-22063}
- xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (CKI Backport Bot) [RHEL-255258] {CVE-2026-80530}
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252811] {CVE-2026-68299}
- ALSA: hda/cs35l41: Fix firmware load work teardown (CKI Backport Bot) [RHEL-234099] {CVE-2026-64481}
- rtla: Fix segfault on multiple SIGINTs (Tomas Glozar) [RHEL-193029]

[5.14.0-687.59.1]
- net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-284987]
- ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-284987] {CVE-2026-99999}
- smb: client: reject a tree connect response whose byte count is too small (Alisher Mazhirinov) [RHEL-271284] {CVE-2026-89631}
- exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282063] {CVE-2026-98260}
- perf: Fix addr_filter_ranges lifetime (Vratislav Bendel) [RHEL-271871] {CVE-2026-93817}
- smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271487] {CVE-2026-89633}
- strparser: make sure __strp_recv isn't running before tearing down the parser (Sabrina Dubroca) [RHEL-270747]
- xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256697]
- xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256697]
- xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256697]
- bridge: mcast: Fix a possible use-after-free when removing a bridge port (Jakub Ramaseuski) [RHEL-232528] {CVE-2026-64032}
- net: bridge: Flush multicast groups when snooping is disabled (Jakub Ramaseuski) [RHEL-232528]
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Antoine Tenart) [RHEL-231693] {CVE-2026-64024}
- ipv4: fib: free fib_alias with kfree_rcu() on insert error path (Jamie Bainbridge) [RHEL-233131] {CVE-2026-64572}
- inet: frags: strip GSO state from fragments before reassembly (Jamie Bainbridge) [RHEL-254224] {CVE-2026-80590}
- ipv4: raw: reject IP_HDRINCL packets with ihl < 5 (Jamie Bainbridge) [RHEL-225452] {CVE-2026-64114}
- usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259429] {CVE-2026-63958}
- usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259429]
- usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259429] {CVE-2026-63962}
- usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259429] {CVE-2026-63963}
- usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259429] {CVE-2026-63961}
- USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63956}
- USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63957}
- USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63928}
- USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259322] {CVE-2026-63899}
- Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254674] {CVE-2026-74509}
- openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253856] {CVE-2026-31678}
- Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244764] {CVE-2026-63974}
- xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222958] {CVE-2026-52935}


Related CVEs


CVE-2025-22063
CVE-2025-38147
CVE-2026-64481
CVE-2026-68202
CVE-2026-68299
CVE-2026-68448
CVE-2026-80530
CVE-2026-80536

Updated Packages


Release/ArchitectureFilenamesha256Superseded By AdvisoryChannel Label
Oracle Linux 9 (aarch64) kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_aarch64_appstream
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_aarch64_baseos_latest
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_aarch64_codeready_builder
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_aarch64_u8_baseos_patch
kernel-cross-headers-5.14.0-687.60.1.el9_8.aarch64.rpm2b6436e79d0446266b2a5abb475245c4e11058b193d2c4ab656dc14ad626dda5-ol9_aarch64_codeready_builder
kernel-headers-5.14.0-687.60.1.el9_8.aarch64.rpmcaf7c2b49cb0feb27b91fd34ca424ab8050c1959a9dd1aef859018f2bd203b67-ol9_aarch64_appstream
kernel-tools-5.14.0-687.60.1.el9_8.aarch64.rpm1b9ef9f47cbcb8d4890cc53d7234a6d2ffbb4ffc8902c81eb07c4161b37b6ded-ol9_aarch64_baseos_latest
kernel-tools-5.14.0-687.60.1.el9_8.aarch64.rpm1b9ef9f47cbcb8d4890cc53d7234a6d2ffbb4ffc8902c81eb07c4161b37b6ded-ol9_aarch64_u8_baseos_patch
kernel-tools-libs-5.14.0-687.60.1.el9_8.aarch64.rpma24baa4cc0626ab5c0553fea1ece9052ee0af139ad7d11d40b87b38c74ddf6c9-ol9_aarch64_baseos_latest
kernel-tools-libs-5.14.0-687.60.1.el9_8.aarch64.rpma24baa4cc0626ab5c0553fea1ece9052ee0af139ad7d11d40b87b38c74ddf6c9-ol9_aarch64_u8_baseos_patch
kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.aarch64.rpm00211d742740efcfe615476abffab3ab51c49917dc24615195051139fa3c47c9-ol9_aarch64_codeready_builder
libperf-5.14.0-687.60.1.el9_8.aarch64.rpmb2e29d3070da8bf7af005fe485fb169deb6ea99e102f463174f01add07b162c4-ol9_aarch64_codeready_builder
perf-5.14.0-687.60.1.el9_8.aarch64.rpmafce9b16c93bc4d75c2ae2b37f936d4360652051dad4235ffc2e636a9f68569d-ol9_aarch64_appstream
python3-perf-5.14.0-687.60.1.el9_8.aarch64.rpme9e708f71856f6b049aed6a1464097e79efa57c5fe33e852724b568c3aea41c2-ol9_aarch64_appstream
rtla-5.14.0-687.60.1.el9_8.aarch64.rpme819cdd1ac6c26e2719a5cd9656747f3b50afa7bc792767154a81411dd3bcc17-ol9_aarch64_appstream
rv-5.14.0-687.60.1.el9_8.aarch64.rpmdf4e335237e33a5f4933e74e62b03a1679737abf0b7304058a4b8bc5359f7e78-ol9_aarch64_appstream
Oracle Linux 9 (x86_64) kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_x86_64_appstream
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_x86_64_baseos_latest
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_x86_64_codeready_builder
kernel-5.14.0-687.60.1.el9_8.src.rpm82cf0d4e65ee5c0b65b398c0069d6642d71c2683374251c0783326057e48775c-ol9_x86_64_u8_baseos_patch
kernel-5.14.0-687.60.1.el9_8.x86_64.rpm59e31990091c9669a66744ab4b0b40defdeb69685030e4f1ee064c7e33028bd5-ol9_x86_64_baseos_latest
kernel-5.14.0-687.60.1.el9_8.x86_64.rpm59e31990091c9669a66744ab4b0b40defdeb69685030e4f1ee064c7e33028bd5-ol9_x86_64_u8_baseos_patch
kernel-abi-stablelists-5.14.0-687.60.1.el9_8.noarch.rpm49b2d6019e4ade34137fe5ea27c55af82e68cb5d580e31e617688eedef7d525a-ol9_x86_64_baseos_latest
kernel-abi-stablelists-5.14.0-687.60.1.el9_8.noarch.rpm49b2d6019e4ade34137fe5ea27c55af82e68cb5d580e31e617688eedef7d525a-ol9_x86_64_u8_baseos_patch
kernel-core-5.14.0-687.60.1.el9_8.x86_64.rpm6d1641adff60701b0caa9f2e3fb74e9451237d02fbf1ac669c007eac0de685d8-ol9_x86_64_baseos_latest
kernel-core-5.14.0-687.60.1.el9_8.x86_64.rpm6d1641adff60701b0caa9f2e3fb74e9451237d02fbf1ac669c007eac0de685d8-ol9_x86_64_u8_baseos_patch
kernel-cross-headers-5.14.0-687.60.1.el9_8.x86_64.rpmc4aaa1788d956eb2dee31b8802360d7ea8d1023594a6d980983cadd92586dd8e-ol9_x86_64_codeready_builder
kernel-debug-5.14.0-687.60.1.el9_8.x86_64.rpm55149b5d073e925f0527821b39c50dddb7c4ed3b46e976cd6f3ae12cad7cc21b-ol9_x86_64_baseos_latest
kernel-debug-5.14.0-687.60.1.el9_8.x86_64.rpm55149b5d073e925f0527821b39c50dddb7c4ed3b46e976cd6f3ae12cad7cc21b-ol9_x86_64_u8_baseos_patch
kernel-debug-core-5.14.0-687.60.1.el9_8.x86_64.rpm18a9d6f74a54d71abea8c77a0cf228f323d4c47d8bc865429dde0537a64fab30-ol9_x86_64_baseos_latest
kernel-debug-core-5.14.0-687.60.1.el9_8.x86_64.rpm18a9d6f74a54d71abea8c77a0cf228f323d4c47d8bc865429dde0537a64fab30-ol9_x86_64_u8_baseos_patch
kernel-debug-devel-5.14.0-687.60.1.el9_8.x86_64.rpmbccbccd571013835e7726700841106a4e843d58bfd4d5d3b7ae84ae903caa1fb-ol9_x86_64_appstream
kernel-debug-devel-matched-5.14.0-687.60.1.el9_8.x86_64.rpmf001fda65765d254cfbd42e378ba54045a154f444eb805a5cad1d8c9a8a2b613-ol9_x86_64_appstream
kernel-debug-modules-5.14.0-687.60.1.el9_8.x86_64.rpm07a09af415267bc288cc3edea0638e0a9664076948b1b85e21862244ce79415e-ol9_x86_64_baseos_latest
kernel-debug-modules-5.14.0-687.60.1.el9_8.x86_64.rpm07a09af415267bc288cc3edea0638e0a9664076948b1b85e21862244ce79415e-ol9_x86_64_u8_baseos_patch
kernel-debug-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpmb3fd2edbaef7dc41bb273f01d307a888f073dd8a162bc16a19bc2f68da1d6102-ol9_x86_64_baseos_latest
kernel-debug-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpmb3fd2edbaef7dc41bb273f01d307a888f073dd8a162bc16a19bc2f68da1d6102-ol9_x86_64_u8_baseos_patch
kernel-debug-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpm42345e1913a6459bbbcf5f6750f96ed4f24ca7f963343c146c8810ba9a2ce817-ol9_x86_64_baseos_latest
kernel-debug-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpm42345e1913a6459bbbcf5f6750f96ed4f24ca7f963343c146c8810ba9a2ce817-ol9_x86_64_u8_baseos_patch
kernel-debug-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpm3137f494ace345ea81577cc1cb5d3d89e3910766590755791aa708e53d476126-ol9_x86_64_baseos_latest
kernel-debug-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpm3137f494ace345ea81577cc1cb5d3d89e3910766590755791aa708e53d476126-ol9_x86_64_u8_baseos_patch
kernel-devel-5.14.0-687.60.1.el9_8.x86_64.rpm4a79cb12cee6f9c35e6bd06562ba68a4ca6a3f536f53e857c9af35251e407d42-ol9_x86_64_appstream
kernel-devel-matched-5.14.0-687.60.1.el9_8.x86_64.rpme980b4d32f3f2e9b3e4194d4a2488df5a096ef5968677933e9c04533c3350701-ol9_x86_64_appstream
kernel-doc-5.14.0-687.60.1.el9_8.noarch.rpm96267ee03c50f7da8a368a13858b5c18c9675cdf19f11d78ddd3a9bc9b82e08b-ol9_x86_64_appstream
kernel-headers-5.14.0-687.60.1.el9_8.x86_64.rpmc0a03e3878ce123eb8a343a80070c2c879b20d21c22efb8ae3112b18cd6f6257-ol9_x86_64_appstream
kernel-modules-5.14.0-687.60.1.el9_8.x86_64.rpm1d388adfd5a26ddbccf259e07f73ef5b2fe0ab697c3b7124ab2919c9ddbc2d60-ol9_x86_64_baseos_latest
kernel-modules-5.14.0-687.60.1.el9_8.x86_64.rpm1d388adfd5a26ddbccf259e07f73ef5b2fe0ab697c3b7124ab2919c9ddbc2d60-ol9_x86_64_u8_baseos_patch
kernel-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpm19d4a1d9128d72717d7c392056e03d6e18e92085ccde730206f6c4ce631a0125-ol9_x86_64_baseos_latest
kernel-modules-core-5.14.0-687.60.1.el9_8.x86_64.rpm19d4a1d9128d72717d7c392056e03d6e18e92085ccde730206f6c4ce631a0125-ol9_x86_64_u8_baseos_patch
kernel-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpmd1efb1f54373818e3880a6f4ea76b9754b2b4076c7e45dd85c748ea492e8eac7-ol9_x86_64_baseos_latest
kernel-modules-extra-5.14.0-687.60.1.el9_8.x86_64.rpmd1efb1f54373818e3880a6f4ea76b9754b2b4076c7e45dd85c748ea492e8eac7-ol9_x86_64_u8_baseos_patch
kernel-tools-5.14.0-687.60.1.el9_8.x86_64.rpme97c37a3fc401ac5bd057c9f9d382448ced4b1e9e824ab70643a0edc2a754313-ol9_x86_64_baseos_latest
kernel-tools-5.14.0-687.60.1.el9_8.x86_64.rpme97c37a3fc401ac5bd057c9f9d382448ced4b1e9e824ab70643a0edc2a754313-ol9_x86_64_u8_baseos_patch
kernel-tools-libs-5.14.0-687.60.1.el9_8.x86_64.rpmd23866e8040c500c89f33bb67dcd38d4a232d7d1f205f634c40c2e1ba8af467a-ol9_x86_64_baseos_latest
kernel-tools-libs-5.14.0-687.60.1.el9_8.x86_64.rpmd23866e8040c500c89f33bb67dcd38d4a232d7d1f205f634c40c2e1ba8af467a-ol9_x86_64_u8_baseos_patch
kernel-tools-libs-devel-5.14.0-687.60.1.el9_8.x86_64.rpm04f4964384d3c31a12fa03880888bd690db11c226e29a48a283e7ebf9badb9bb-ol9_x86_64_codeready_builder
kernel-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpmb3f69c670297c30b589ff412448bf967878a268452acfdb7f07326ce08f3b35b-ol9_x86_64_baseos_latest
kernel-uki-virt-5.14.0-687.60.1.el9_8.x86_64.rpmb3f69c670297c30b589ff412448bf967878a268452acfdb7f07326ce08f3b35b-ol9_x86_64_u8_baseos_patch
kernel-uki-virt-addons-5.14.0-687.60.1.el9_8.x86_64.rpma7e3ad63cd95ea4a24940000aaf3787af9579717299e81342b5c023a245235fb-ol9_x86_64_baseos_latest
kernel-uki-virt-addons-5.14.0-687.60.1.el9_8.x86_64.rpma7e3ad63cd95ea4a24940000aaf3787af9579717299e81342b5c023a245235fb-ol9_x86_64_u8_baseos_patch
libperf-5.14.0-687.60.1.el9_8.x86_64.rpm552f031d92cdbfbb71500a34730db959993b08691846022ff67202971d586d41-ol9_x86_64_codeready_builder
perf-5.14.0-687.60.1.el9_8.x86_64.rpm0039148a76c073d78b9f7834fabfe3ac598ebff35d01ffc33229a1b90c02c9ee-ol9_x86_64_appstream
python3-perf-5.14.0-687.60.1.el9_8.x86_64.rpm7a182c94d52486cf4b8508b146e9960ee4040855f8a6ccea2c19b3d1abeb682c-ol9_x86_64_appstream
rtla-5.14.0-687.60.1.el9_8.x86_64.rpmfda414bea44a67176ea83407c0df555322bd47a217a3e87ba20e272ee349f34a-ol9_x86_64_appstream
rv-5.14.0-687.60.1.el9_8.x86_64.rpmf82f0768a792f65bff51f3891d3268c338da40121ffd701e53f74358237278ca-ol9_x86_64_appstream



This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team

software.hardware.complete
Subscribe | Careers | Contact Us | Legal Notices | Terms of Use | Your Privacy Rights