Oracle Errata System Oracle Linux 5.11 2026-07-28T10:52:25 Oracle Linux 8 [2.28-251.0.4.40] - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: July-13-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> May-26-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> May-7-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-18-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.31 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> February-24-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.27 - Fixed orabug 38834066 stpcpy MTE support Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> December-8-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.27 - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> August-5-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.25 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> June-9-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> April-14-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> March-26-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string functions Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-17-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.14 - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> February-19-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.13 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> January-28-2025 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.11 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> September-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.5 - Forward port of Oracle patches over 2.28-251.5 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> August-26-2024 Jose E. Marchesi <jose.marchesi@oracle.com> - 2.28-251.0.2.4 - Forward port of Oracle patches over 2.28-251.4 Reviewed-by: David Faust <david.faust@oracle.com> May-24-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.2 - Forward port of Oracle patches over 2.28-251.2 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> May-23-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2.1 - Forward port of Oracle patches over 2.28-251.1 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> May-22-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.2 - Forward port of Oracle patches for ol8-u10 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-28-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.1 - Forward port of Oracle patches for ol8-u10-beta Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-5-2024 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.12 - Forward port of Oracle patches. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> November-14-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.7 - Forward port of Oracle patches. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> October-4-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-236.0.1.6 - Forward port of Oracle patches. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> April-21-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.3 - OraBug 35317410 Glibc tunable to disable huge pages on pthread_create stacks - Created tunable glibc.pthread.stack_hugetlb to control when hugepages can be used for stack allocation. - In case THP are enabled and glibc.pthread.stack_hugetlb is set to 0, glibc will madvise the kernel not to use allow hugepages for stack allocations. Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> April-11-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.2 - OraBug: 35268809 Fixed initialization of VDSO for tcache_key_initialize Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> March-28-2023 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-225.0.1 - Merge of Oracle patches for ol8u8 beta Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> September-28-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-211.0.1 - Merge of Oracle patches for ol8u7 beta Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> August-8-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-189.5.0.2 - Enable VDSO on x86_64, aarch64, i386, arm, and mips statically linked programs. - These changes enable reading the realtime clock without a kernel syscall. OraBug: 30478315 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> May-2-2022 Patrick McGehearty <patrick.mcgehearty@oracle.com> - 2.28-199.0.1 - Merge of patches from c8s 199 with ol8u6 beta Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> - Update siginfo constants from linux kernel (OraBug: 33734528) - Remove limit on MALLOC_MMAP_THRESHOLD tunable (Orabug: 29630826) - Provide glibc.pthread.mutex_spin_count tunable for pthread adaptive - spin mutex (Orabug: 27982358) Reviewed-by: Qing Zhao <qing.zhao@oracle.com> - add Ampere emag to tunable cpu list (Patrick McGehearty) - add optimized memset for emag - add an ASIMD variant of strlen for falkor Orabug: 2700101. - Modify glibc-ora28849085.patch so it works with RHCK kernels. (Orabug: 28849085) - Make _IO_funlockfile match __funlockfile and _IO_flockfile match __flockfile Both should test if (stream->_flags & _IO_USER_LOCK) == 0) _IO_lock_lock (*stream->_lock); OraBug: 28481550. Reviewed-by: Qing Zhao <qing.zhao@oracle.com> [2.28-251.40] - CVE-2026-5435 Out-of-bounds write via TSIG record processing (RHEL-181724) [2.28-251.39] - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-181725) [2.28-251.38] - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172700) [2.28-251.37] - Add tests for CVE-2026-4437 and CVE-2026-4438 (RHEL-173358) [2.28-251.36] - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-168095) [2.28-251.35] - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162891) [2.28-251.34] - Update locales for Croatia to use EUR as currency symbol. (RHEL-140104) [2.28-251.33] - Change the currency symbol for the bg_BG locale to euro. (RHEL-137185) [2.28-251.32] - Improve qsort implementation (RHEL-24169) MODERATE Copyright 2026 Oracle, Inc. CVE-2026-5435 CVE-2026-5928 CVE-2026-6238 cpe:/o:oracle:linux:8::baseos_latest cpe:/o:oracle:linux:8:10:baseos_patch cpe:/a:oracle:linux:8::appstream cpe:/a:oracle:linux:8::codeready_builder