Oracle Errata System Oracle Linux 5.11 2026-09-17T16:12:18 Oracle Linux 10 Oracle Linux 9 [6.12.0-206.104.4.4] - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035126] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035125] {CVE-2026-80844} - RDMA/nldev: Fix locking when accessing mr->pd (Jason Gunthorpe) [Orabug: 40028950] {CVE-2026-74334} - RDMA/restrack: Fix typos in the comments (Kalesh AP) [Orabug: 40028950] - tcp: clear sock_ops cb flags before force-closing a child socket (Sechang Lim) [Orabug: 40028948] {CVE-2026-74268} - xsk: cache csum_start/csum_offset to fix TOCTOU in xsk_skb_metadata() (Jason Xing) [Orabug: 40028941] {CVE-2026-53250} - tcp: fix potential race in tcp_v6_syn_recv_sock() (Eric Dumazet) [Orabug: 40028939] {CVE-2026-43198} [6.12.0-206.104.4.3] - net: Account VLAN RPS drops (Sherry Yang) [Orabug: 40023758] - net: ntb_netdev: Count packets dropped on RX refill failure (Koichiro Den) - net: ntb_netdev: Avoid double-accounting netif_rx() drops (Koichiro Den) - net: stmmac: selftests: Pass the IP proto mask in the TC selftest (Maxime Chevallier) - Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan (Pauli Virtanen) - ALSA: seq: midi: Optimize event_input locking with RCU (Takashi Iwai) - ALSA: seq: Don't leak the extension cell pointer in the bounce payload (HyeongJun An) - f2fs: fix i_size when pinned fallocate partially fails (Zhan Xusheng) - media: cec: core: Fix kmemleak due to missed rc_free_device() call (Jonas Karlman) - LoongArch: Fix acpi_package_ids[] array overflow (Bibo Mao) - fs: fix user path of nested backing files (Baokun Li) - Revert 'PM: sleep: Use complete() in device_pm_sleep_init()' (Sasha Levin) - perf: Reject exited events as group leaders (Kyle Zeng) - erofs: Fix EROFS_FS_ZIP_LZMA_DEFAULT_MAX_STREAMS default logic (Geert Uytterhoeven) - drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix (Nathan Lucas) - ipv4: start using dst_dev_rcu() (Eric Dumazet) [Orabug: 40022810] {CVE-2025-40074} - NTB: ntb_netdev: Preserve RX queue depth on allocation failure (Koichiro Den) [Orabug: 40022771] {CVE-2026-74626} - inet: frags: publish queues before arming timer (Zhiling Zou) [Orabug: 40022764] {CVE-2026-74662} - inet: frags: save a pair of atomic operations in reassembly (Eric Dumazet) [Orabug: 40022764] - inet: frags: change inet_frag_kill() to defer refcount updates (Eric Dumazet) [Orabug: 40022764] - ipv4: frags: remove ipq_put() (Eric Dumazet) [Orabug: 40022764] - inet: frags: add inet_frag_putn() helper (Eric Dumazet) [Orabug: 40022764] IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-43198 CVE-2026-53250 CVE-2026-74268 CVE-2026-74334 CVE-2026-80844 CVE-2026-81000 cpe:/a:oracle:linux:9::UEKR8 cpe:/a:oracle:linux:10::UEKR8