Oracle Errata System Oracle Linux 5.11 2026-08-18T15:10:48 Oracle Linux 10 [7.0.3-5.0.1] - Fix unterminated backtick in pmlogger_janitor fix not to terminate unauthorized process patch [Orabug: 39270658] - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870] - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 39096683] - adds numastat process option in the tool - Added support for size based cleanup for pcp archives [Orabug: 38757778] - Implement sorting option in pcp ps based on %cpu, %mem [Orabug: 38719615] - Fixed pmlogger incorrectly attempts to terminate - unauthorized process [Orabug: 38598244] - Merges new PCP nfsiostat parser in OL [Orabug: 38817053] - pmdanfsclient: fix regex to correctly parse NFS op stats [Orabug: 38724847] - pmda/rocestat: pmda/rocestat: skip installation when IB is absent [Orabug: 38595797] [7.0.3-5] - Fix CVE-2026-16530: __pmLogLoadInDom OOB pointer dereference (RHEL-213746) - Fix CVE-2026-16531: pmproxy logger servlet path traversal (RHEL-213756) - Backport remaining PCP security hardening fixes from private-pcp - pmieconf and pmlogmv command injection hardening (CWE-78) - libpcp PDU decode OOB read and overflow guards (CWE-125/190/195) - timezone and zoneinfo string validation - pmdaroot peer credential verification (CWE-403) - pmproxy REST CERT_REQD enforcement and logger servlet authentication [7.0.3-4] - Fix CVE-2026-16524: linux_sockets PMDA command injection (RHEL-213659) - Fix CVE-2026-16526: FD_CLOEXEC privilege escalation via pmdaroot (RHEL-213695) - Fix CVE-2026-16527: pmproxy unauthenticated /store access (RHEL-213721) - Fix CVE-2026-16529: __pmGetPDU signed integer overflow DoS (RHEL-213732) IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-16524 CVE-2026-16526 CVE-2026-16527 CVE-2026-16529 cpe:/a:oracle:linux:10::appstream cpe:/a:oracle:linux:10::codeready_builder