Oracle Errata System Oracle Linux 5.11 2026-07-30T16:02:19 Oracle Linux 10 [9.9p1-25.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-25] - CVE-2026-59996: Fix remote glob result of '..' causing files to be placed in unintended parent directories when scp performs remote-to-remote copy via the local host Resolves: RHEL-193170 - CVE-2026-60002: Fix use-after-free in cached hostkey during key re-exchange Resolves: RHEL-193016 [9.9p1-24] - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-186435 - CVE-2026-55654: Fix heap out-of-bounds read during GSSAPI indicator cleanup due to missing NULL terminator Resolves: RHEL-185826 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX socket pre-binding Resolves: RHEL-185852 IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-55653 CVE-2026-55654 CVE-2026-55655 CVE-2026-59996 CVE-2026-60002 cpe:/o:oracle:linux:10:2:baseos_patch cpe:/a:oracle:linux:10::appstream cpe:/o:oracle:linux:10::baseos_latest