Oracle Errata System Oracle Linux 5.11 2026-05-02T15:53:00 Oracle Linux 8 Oracle Linux 9 [5.15.0-319.201.4.4] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [Orabug: 39291961] - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [Orabug: 39291961] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [Orabug: 39291961] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [Orabug: 39291961] - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39291961] - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le) [Orabug: 39291961] - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [Orabug: 39291961] {CVE-2026-31431} - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers) [Orabug: 39291961] - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers) [Orabug: 39291961] - uek-rpm: Enable FWCTL for aarch64 (Dave Kleikamp) [Orabug: 39291938] [5.15.0-319.201.4.3] - uek-rpm: CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON should be set (Dave Kleikamp) [Orabug: 39263158] - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Lu Baolu) [Orabug: 39263158] - iommu/vt-d: Set variable intel_dirty_ops to static (Kunwu Chan) [Orabug: 39263158] - iommu/vt-d: Access/Dirty bit support for SS domains (Joao Martins) [Orabug: 39263158] - iommu/amd: reduce GA Log overflow printk noise (Alejandro Jimenez) [Orabug: 39261287] - iommu/amd: add reschedule points to GA Log draining (Alejandro Jimenez) [Orabug: 39261287] - iommu/amd: Rework GAInt handling in overflow case (Joao Martins) [Orabug: 39261287] - iommu/amd: Disable GAInt while GA Log is processed (Joao Martins) [Orabug: 39261287] - iommu/amd: Move helpers to update IOMMU features to amd_iommu.h (Alejandro Jimenez) [Orabug: 39261287] - iommu/amd: Increase GA Log buffer size to 8192 entries (Joao Martins) [Orabug: 39261287] - x86/CPU: Fix FPDSS on Zen1 (Borislav Petkov (AMD)) [Orabug: 39261281] [5.15.0-319.201.4.2] - Revert 'rds: Drop rds conn in connect worker if not in down state.' (Vijayendra Suman) [Orabug: 39200414] [5.15.0-319.201.4.1] - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Sean Christopherson) [Orabug: 39153095] - vfio: Adapt to upstream uAPI for VFIO_PRECOPY_INFO_REINIT (Maciej S. Szmigiero) [Orabug: 39153092] - vfio/mlx5: Add REINIT support to VFIO_MIG_GET_PRECOPY_INFO (Yishai Hadas) [Orabug: 39153077] - vfio/mlx5: consider inflight SAVE during PRE_COPY (Yishai Hadas) [Orabug: 39153077] - net/mlx5: Add IFC bits for migration state (Yishai Hadas) [Orabug: 39153077] - vfio: Adapt drivers to use the core helper vfio_check_precopy_ioctl (Yishai Hadas) [Orabug: 39153077] - vfio: Add support for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 (Yishai Hadas) [Orabug: 39153077] - vfio: Define uAPI for re-init initial bytes during the PRE_COPY phase (Yishai Hadas) [Orabug: 39153077] [5.15.0-319.201.4] - bnxt_en: Fix GSO type for HW GRO packets on 5750X chips (Michael Chan) [Orabug: 39086190] - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled (Fernando Fernandez Mancera) [Orabug: 39080807] - hv_netvsc: Use VF's tso_max_size value when data path is VF (Shradha Gupta) [Orabug: 39065407] - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Shradha Gupta) [Orabug: 39065407] - IPv6/GRO: generic helper to remove temporary HBH/jumbo header in driver (Coco Li) [Orabug: 39065407] - rds: Drop rds conn in connect worker if not in down state. (Rohit Nair) [Orabug: 39045034] - exadata: tools: perf: use comm_ignore_digit for report, top (Stephen Brennan) [Orabug: 38567667] - tools: perf: add comm_ignore_digit column (Stephen Brennan) [Orabug: 38567667] - mm/page_alloc: ignore the exact initial compaction result (Vlastimil Babka) [Orabug: 39071712] - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Vlastimil Babka) [Orabug: 39071712] - rds: Add state field to RDS trace logs. (Rohit Nair) [Orabug: 38870357] - i3c: Move device name assignment after i3c_bus_init (Billy Tsai) - ASoC: fsl_xcvr: Revert fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo) - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) - netfilter: nf_conncount: fix tracking of connections from localhost (Fernando Fernandez Mancera) - PCI/IOV: Fix race between SR-IOV enable/disable and hotplug (Niklas Schnelle) - Revert 'PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV' (Niklas Schnelle) - rtc: interface: Alarm race handling should not discard preceding error (Anthony Pighin (Nokia)) [5.15.0-319.201.3] - arm64: pensando: Add non-caching option to capmem/mmap (Rob Gardner) [Orabug: 39017011] - PCI: Fix BUILD_BUG_ON usage for old gcc (Alex Williamson) [Orabug: 39021252] - PCI: Batch BAR sizing operations (Alex Williamson) [Orabug: 39021252] - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39053373] [5.15.0-319.201.2] - LTS version: v5.15.201 (Vijayendra Suman) - USB: serial: option: add Telit FN920C04 RNDIS compositions (Fabio Porcedda) - f2fs: fix out-of-bounds access in sysfs attribute read/write (Yongpeng Yang) - f2fs: fix to avoid UAF in f2fs_write_end_io() (Chao Yu) - fbdev: smscufx: properly copy ioctl memory to kernelspace (Greg Kroah-Hartman) - fbdev: rivafb: fix divide error in nv3_arb() (Guangshuo Li) - PCI: endpoint: Avoid creating sub-groups asynchronously (Liu Song) - PCI: endpoint: Remove unused field in struct pci_epf_group (Christophe JAILLET) - PCI: endpoint: Automatically create a function specific attributes group (Damien Le Moal) - scsi: qla2xxx: Free sp in error path to fix system crash (Anil Gurumurthy) - scsi: qla2xxx: Use named initializers for port_[d]state_str (Gleb Chesnokov) - scsi: qla2xxx: Fix bsg_done() causing double free (Anil Gurumurthy) - bus: fsl-mc: fix use-after-free in driver_override_show() (Gui-Dong Han) - bus: fsl-mc: Replace snprintf and sprintf with sysfs_emit in sysfs show functions (Chelsy Ratnawat) - smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() (Henrique Carvalho) - crypto: virtio - Remove duplicated virtqueue_kick in virtio_crypto_skcipher_crypt_req (Bibo Mao) - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() (Eric Dumazet) - selftests: mptcp: pm: ensure unknown flags are ignored (Matthieu Baerts (NGI0)) - net: dsa: free routing table on probe failure (Vladimir Oltean) - smb: client: set correct id, uid and cruid for multiuser automounts (Paulo Alcantara) - btrfs: fix racy bitfield write in btrfs_clear_space_info_full() (Boris Burkov) - Revert 'wireguard: device: enable threaded NAPI' (Daniel Borkmann) - gpiolib: acpi: Fix gpio count with string references (Alban Bedel) - ASoC: fsl_xcvr: fix missing lock in fsl_xcvr_mode_put() (Ziyi Guo) - platform/x86: panasonic-laptop: Fix sysfs group leak in error path (Rafael J. Wysocki) - platform/x86: classmate-laptop: Add missing NULL pointer checks (Rafael J. Wysocki) - drm/tegra: hdmi: sor: Fix error: variable 'j' set but not used (Brahmajit Das) - romfs: check sb_set_blocksize() return value (Deepanshu Kartikey) - gpio: sprd: Change sprd_gpio lock to raw_spin_lock (Xuewen Yan) - ALSA: hda/realtek: Fix headset mic for TongFang X6AR55xU (Tim Guttzeit) - gpio: omap: do not register driver in probe() (Danilo Krummrich) - scsi: qla2xxx: Query FW again before proceeding with login (Anil Gurumurthy) - scsi: qla2xxx: Delay module unload while fabric scan in progress (Anil Gurumurthy) - scsi: qla2xxx: Validate sp before freeing associated memory (Anil Gurumurthy) - nilfs2: Fix potential block overflow that cause system hang (Edward Adam Davis) - crypto: virtio - Add spinlock protection with virtqueue notification (Bibo Mao) - crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly (Kees Cook) - crypto: octeontx - Fix length check to avoid truncation in ucode_load_store (Thorsten Blum) - LTS version: v5.15.200 (Vijayendra Suman) - riscv: Replace function-like macro by static inline function (Bjorn Topel) - nvmet-tcp: pass iov_len instead of sg->length to bvec_set_page() (Varun Prakash) - spi: tegra: Fix a memory leak in tegra_slink_probe() (Felix Gu) - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Breno Leitao) - spi: tegra210-quad: Move curr_xfer read inside spinlock (Breno Leitao) - iommu: disable SVA when CONFIG_X86 is set (Lu Baolu) - Bluetooth: hci_event: call disconnect callback before deleting conn (Pauli Virtanen) - gve: Correct ethtool rx_dropped calculation (Max Yuan) - gve: Fix stats report corruption on queue count change (Debarghya Kundu) - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andreas Gruenbacher) - riscv: uprobes: Add missing fence.i after building the XOL buffer (Bjorn Topel) - ASoC: amd: fix memory leak in acp3x pdm dma ops (Chris Bainbridge) - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec (YunJe Shin) - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (Andrew Fasano) - hwmon: (occ) Mark occ_init_attribute() as __printf (Arnd Bergmann) - tipc: use kfree_sensitive() for session key material (Daniel Hodges) - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) - dpaa2-switch: add bounds check for if_id in IRQ handler (Junrui Luo) - net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup (Zilin Guan) - net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup (Zilin Guan) - net: liquidio: Initialize netdev pointer before queue setup (Zilin Guan) - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (Junrui Luo) - platform/x86: intel_telemetry: Fix PSS event register mask (Kaushlendra Kumar) - platform/x86: toshiba_haps: Fix memory leaks in add/remove routines (Rafael J. Wysocki) - wifi: mac80211: don't increment crypto_tx_tailroom_needed_cnt twice (Miri Korenblit) - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (Maurizio Lombardi) - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (Maurizio Lombardi) - wifi: cfg80211: Fix bitrate calculation overflow for HE rates (Veerendranath Jakkam) - ASoC: tlv320adcx140: Propagate error codes during probe (Dimitrios Katsaros) - ASoC: davinci-evm: Fix reference leak in davinci_evm_probe (Kery Qi) - wifi: mac80211: collect station statistics earlier when disconnect (Baochen Qiang) - ring-buffer: Avoid softlockup in ring_buffer_resize() during memory free (Wupeng Ma) - HID: Apply quirk HID_QUIRK_ALWAYS_POLL to Edifier QR30 (2d99:a101) (Rodrigo Lugathe da Conceicao Alves) - HID: quirks: Add another Chicony HP 5MP Cameras to hid_ignore_list (Chris Chiu) - netfilter: replace -EEXIST with -EBUSY (Daniel Gomez) - ALSA: hda/realtek: add HP Laptop 15s-eq1xxx mute LED quirk (Ruslan Krupitsa) - HID: playstation: Center initial joystick axes to prevent spurious events (Siarhei Vishniakou) - HID: intel-ish-hid: Reset enum_devices_done before enumeration (Zhang Lixu) - HID: multitouch: add MT_QUIRK_STICKY_FINGERS to MT_CLS_VTL (DaytonCL) - smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() (ZhangGuoDong) - block,bfq: fix aux stat accumulation destination (shechenglong) - net: usb: sr9700: support devices with virtual driver CD (Ethan Nelson-Moore) - wifi: wlcore: ensure skb headroom before skb_push (Peter Astrand) - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined (Moon Hee Lee) - binderfs: fix ida_alloc_max() upper bound (Carlos Llamas) - Bluetooth: hci_qca: Fix the teardown problem for real (Thomas Gleixner) - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) - ARM: spear: Do not use timer namespace for timer_shutdown() function (Steven Rostedt (Google)) - Documentation: Remove bogus claim about del_timer_sync() (Thomas Gleixner) - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Pablo Neira Ayuso) - mm/kfence: randomize the freelist on initialization (Pimyn Girgis) - KVM: Don't clobber irqfd routing type when deassigning irqfd (Sean Christopherson) - ARM: 9468/1: fix memset64() on big-endian (Thomas Weissschuh) - rbd: check for EOD after exclusive lock is ensured to be held (Ilya Dryomov) - platform/x86: intel_telemetry: Fix swapped arrays in PSS output (Kaushlendra Kumar) [5.15.0-319.199.1] - genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask (Imran Khan) [Orabug: 39001910] - nvme-pci: fix stuck reset on concurrent DPC and HP (Keith Busch) [Orabug: 38928033] - nvme: cancel pending I/O if nvme controller is in terminal state (Nilay Shroff) [Orabug: 38928033] - nvme-pci: fix queue unquiesce check on slot_reset (Keith Busch) [Orabug: 38928033] - nvme: ensure disabling pairs with unquiesce (Keith Busch) [Orabug: 38928033] - ionic: Rate limit unknown xcvr type messages (Eric Joyner) [Orabug: 38977644] [5.15.0-318.199.3] - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (Kang Chen) - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Breno Leitao) [Orabug: 38970594] {CVE-2026-23202} - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Breno Leitao) - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Breno Leitao) - x86/kfence: fix booting on 32bit non-PAE systems (Andrew Cooper) - KVM: x86: Don't snapshot 'max' TSC if host TSC is constant (Sean Christopherson) [Orabug: 38966500] - KVM: x86: Accept KVM_[GS]ET_TSC_KHZ as a VM ioctl. (David Woodhouse) [Orabug: 38966500] - sfc: fix NULL dereferences in ef100_process_design_param() (Edward Cree) [Orabug: 37855346] {CVE-2025-37860} - Revert 'net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn' (Sharath Srinivasan) [Orabug: 38937481] - Revert 'net/rds: expand kref coverage to rds_notifier->n_conn' (Sharath Srinivasan) [Orabug: 38937481] [5.15.0-318.199.2] - drivers/soc/pensando/penfw: Add support for pcie serdes fw download. (Hiren Mehta) [Orabug: 38953591] - arm64: pensando: Add support for kpcimgr dynamic event queue (Rob Gardner) [Orabug: 38928823] - procfs: move dropping pde and pid from ->evict_inode() to ->free_inode() (Al Viro) [Orabug: 38945002] - ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38188749] - jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38188749] - Revert 'IB/mlx5: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923519] - Revert 'IB/core: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923519] - Revert 'IB/core: Fix off-by-one attr index in setup_hw_port_stats' (Sharath Srinivasan) [Orabug: 38923519] - drivers/soc/pensando/bsm: Fix various issues with secure-mode. (Hiren Mehta) [Orabug: 38944299] - net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928274] - net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928272] - net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928270] - net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923496] IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-31431 cpe:/a:oracle:linux:8::UEKR7 cpe:/o:oracle:linux:9:7:baseos_patch cpe:/a:oracle:linux:9::UEKR7 cpe:/o:oracle:linux:9::baseos_latest