<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
<generator>
<oval:product_name>Oracle Errata System</oval:product_name>
<oval:product_version>Oracle Linux</oval:product_version>
<oval:schema_version>5.11</oval:schema_version>
<oval:timestamp>2026-09-17T10:19:37</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.oracle.elsa:def:2026651470" version="501" class="patch">
<metadata>
<title>
ELSA-2026-65147-0:  microcode_ctl security, bug fix, and enhancement update (IMPORTANT)
</title>
<affected family="unix">
<platform>Oracle Linux 8</platform>

</affected>
<reference source="elsa" ref_id="ELSA-2026-65147-0" ref_url="https://linux.oracle.com/errata/ELSA-2026-65147-0.html"/>
<reference source="CVE" ref_id="CVE-2025-31936" ref_url="https://linux.oracle.com/cve/CVE-2025-31936.html"/>
<reference source="CVE" ref_id="CVE-2025-35973" ref_url="https://linux.oracle.com/cve/CVE-2025-35973.html"/>

<description>
[4:20260812-1.0.3]
- disable late update for 06-ad-01
- add support for UEK7/UEK8 and ueknext kernels
- don't bother calling dracut if virtualized [Orabug: 35710077]
- ensure UEK also rebuilds initramfs [Orabug: 34280058]
- add support for UEK7 kernels
- enable early update for 06-4f-01
- remove no longer appropriate caveats for 06-2d-07 and 06-55-04
- enable early and late load on RHCK

[4:20260812-1]
- Update Intel CPU microcode to microcode-20260812 release (RHEL-240770)
- Security advisories:
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html
  CVE-2025-31936
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01404.html
  CVE-2025-31938
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01423.html
  CVE-2026-20917
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html
  CVE-2025-35973
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01435.html
  CVE-2026-20716
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01441.html
  CVE-2026-20760
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01442.html
  CVE-2026-20713, CVE-2026-20901
  https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01443.html
  CVE-2026-20707
- New microcode files (in hex):
  06-b7-04: Raptor Lake: revision 0137
  06-d5-01: Wildcat Lake: revision 000c
  06-d7-00: Bartlett Lake: revision 0137
- Microcode files (/platform_mask shown) with revision updates (in hex):
  06-6a-06/87: Ice Lake-X: d000421 to d000433
  06-6c-01/10: Ice Lake-D: 10002f1 to 1000301
  06-7e-05/80: Ice Lake-L: 00cc to 00ce
  06-8f-07/87: Sapphire Rapids: 2b000670 to 2b000685
  06-8f-08/10: Sapphire Rapids with HBM: 2c000421 to 2c000435
  06-8f-08/87: Sapphire Rapids: 2b000670 to 2b000685
  06-a7-01/02: Rocket Lake: 0065 to 0066
  06-ad-01/20: Granite Rapids-X: a000142 to a000151
  06-ad-01/95: Granite Rapids-X: 1000423 to 1000434
  06-ae-01/97: Granite Rapids-D: 1000307 to 1000309
  06-af-03/01: Crestmont (Sierra Forest): 30003a3 to 30003b2
  06-b5-00/80: Arrow Lake-U: 000d to 000e
  06-b7-01/36: Raptor Lake: 0133 to 0137, platform bit 04 added
  06-bd-01/80: Lunar Lake: 0126 to 0128
  06-c5-02/82: Arrow Lake-H: 0121 to 0122
  06-c6-02/82: Arrow Lake: 0121 to 0122
  06-cc-02/94: Panther Lake: 011b to 011c, platform bit 04 added, also used for 06-e5-02
  06-cc-03/94: Panther Lake: 011b to 011c, platform bit 04 added, also used for 06-e5-02
  06-cf-02/87: Emerald Rapids: 210002e0 to 210002f4
Resolves: RHEL-240770
</description>
<!--
 ~~~~~~~~~~~~~~~~~~~~   advisory details   ~~~~~~~~~~~~~~~~~~~ 
-->
<advisory>
<severity>IMPORTANT</severity>
<rights>Copyright 2026 Oracle, Inc.</rights>
<issued date="2026-09-16"/>
<cve cvss3="5.7/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N" href="https://linux.oracle.com/cve/CVE-2025-31936.html" public="20260811">CVE-2025-31936</cve>
<cve cvss3="7.2/CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N" href="https://linux.oracle.com/cve/CVE-2025-35973.html" public="20260811">CVE-2025-35973</cve>

<affected_cpe_list>
<cpe>cpe:/o:oracle:linux:8::baseos_latest</cpe>
<cpe>cpe:/o:oracle:linux:8:10:baseos_patch</cpe>
</affected_cpe_list>
</advisory>
</metadata>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:2026651470001" comment="Oracle Linux 8 is installed"/>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:2026651470002" comment="Oracle Linux arch is x86_64"/>
<criteria operator="AND">
<criterion test_ref="oval:com.oracle.elsa:tst:2026651470003" comment="microcode_ctl is earlier than 4:20260812-1.0.3.el8_10"/>
<criterion test_ref="oval:com.oracle.elsa:tst:2026651470004" comment="microcode_ctl is signed with the Oracle Linux 8 key"/>
</criteria>
</criteria>
</criteria>

</definition>
</definitions>
<!--
 ~~~~~~~~~~~~~~~~~~~~~   rpminfo tests   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<tests>
<rpminfo_test id="oval:com.oracle.elsa:tst:2026651470001"  version="501" comment="Oracle Linux 8 is installed" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:2026651470001" />
<state state_ref="oval:com.oracle.elsa:ste:2026651470002" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:2026651470002"  version="501" comment="Oracle Linux arch is x86_64" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:2026651470001" />
<state state_ref="oval:com.oracle.elsa:ste:2026651470003" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:2026651470003"  version="501" comment="microcode_ctl is earlier than 4:20260812-1.0.3.el8_10" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:2026651470002" />
<state state_ref="oval:com.oracle.elsa:ste:2026651470004" />
</rpminfo_test>
<rpminfo_test id="oval:com.oracle.elsa:tst:2026651470004"  version="501" comment="microcode_ctl is signed with the Oracle Linux 8 key" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">
<object object_ref="oval:com.oracle.elsa:obj:2026651470002" />
<state state_ref="oval:com.oracle.elsa:ste:2026651470001" />
</rpminfo_test>

</tests>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo objects   ~~~~~~~~~~~~~~~~~~~~ 
-->
<objects>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:2026651470002" version="501">
<name>microcode_ctl</name>
</rpminfo_object>
<rpminfo_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:obj:2026651470001" version="501">
<name>oraclelinux-release</name>
</rpminfo_object>
</objects>
<states>
<!--
 ~~~~~~~~~~~~~~~~~~~~   rpminfo states   ~~~~~~~~~~~~~~~~~~~~~ 
-->
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:2026651470001" version="501">
<signature_keyid operation="equals">82562ea9ad986da3</signature_keyid>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:2026651470002" version="501">
<version operation="pattern match">^8</version>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:2026651470003" version="501">
<arch operation="pattern match">x86_64</arch>
</rpminfo_state>
<rpminfo_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" id="oval:com.oracle.elsa:ste:2026651470004" version="501">
<evr datatype="evr_string" operation="less than">4:20260812-1.0.3.el8_10</evr>
</rpminfo_state>

</states>
</oval_definitions>
