elsa-2025-13589

{
  "cves": [
    "CVE-2021-47670",
    "CVE-2025-38159",
    "CVE-2025-21727",
    "CVE-2024-56644",
    "CVE-2025-38085",
    "CVE-2025-21759"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[4.18.0-553.69.1_10.OL8]\n- Update Oracle Linux certificates (Kevin Lyons)\n- Disable signing for aarch64 (Ilya Okomin)\n- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]\n- Update x509.genkey [Orabug: 24817676]\n- Conflict with shim-ia32 and shim-x64 = 15.3-1.0.3\n- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]\n- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]\n\n[4.18.0-553.69.1_10]\n- Revert 'sch_htb: make htb_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]\n- Revert 'sch_drr: make drr_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]\n- Revert 'sch_qfq: make qfq_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]\n- Revert 'codel: remove sch-q.qlen check before qdisc_tree_reduce_backlog()' (Denys Vlasenko) [RHEL-108140]\n- Revert 'sch_htb: make htb_deactivate() idempotent' (Denys Vlasenko) [RHEL-108140]\n- Revert 'net/sched: Always pass notifications when child class becomes empty' (Denys Vlasenko) [RHEL-108140]\n- Revert 'sch_cbq: make cbq_qlen_notify() idempotent' (Denys Vlasenko) [RHEL-108140]\n\n[4.18.0-553.68.1_10]\n- ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}\n- md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]\n- md/raid5: implement pers-bitmap_sector() (Nigel Croxon) [RHEL-57991]\n- md: add a new callback pers-bitmap_sector() (Nigel Croxon) [RHEL-57991]\n- md/md-bitmap: remove the last parameter for bimtap_ops-endwrite() (Nigel Croxon) [RHEL-57991]\n- md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]\n- md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]\n- md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]\n- md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]\n- md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]\n- md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]\n- raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]\n- md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]\n- sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]\n- net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- codel: remove sch-q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}\n- can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}\n- wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}\n- net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}\n\n[4.18.0-553.67.1_10]\n- mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}\n- mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}\n- mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}\n- mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}\n- mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}\n- padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}\n- redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)\n- ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]",
  "id": "ELSA-2025-13589",
  "ovalId": "oval:com.oracle.elsa:def:202513589",
  "source": "oracle_linux",
  "title": "ELSA-2025-13589:  kernel security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2025-13589.html"
}