elsa-2026-19225

{
  "cves": [
    "CVE-2026-23060",
    "CVE-2026-31431",
    "CVE-2026-31677",
    "CVE-2026-43284"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[5.14.0-687.5.3]\n- Disable UKI signing [Orabug: 36571828]\n- Update Oracle Linux certificates (Kevin Lyons)\n- Disable signing for aarch64 (Ilya Okomin)\n- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]\n- Update x509.genkey [Orabug: 24817676]\n- Conflict with shim-ia32 and shim-x64 = 15.3-1.0.5]\n- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]\n- Add Oracle Linux IMA certificates\n- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]\n\n[5.14.0-687.5.3]\n- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}\n\n[5.14.0-687.5.2]\n- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172543]\n- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172543]\n- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172543]\n- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172543]\n- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172543] {CVE-2026-31431}\n- crypto: authencesn - reject too-short AAD (assoclen8) to match ESP/ESN spec (Herbert Xu) [RHEL-172543] {CVE-2026-23060}\n- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172543]\n- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172543] {CVE-2026-31677}\n- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172543] {CVE-2026-31431}\n- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172543]\n\n[5.14.0-687.5.1]\n- kabi: enable check-kabi (Cestmir Kalina) [RHEL-153672]\n- kabi: add symbols to stablelist (Cestmir Kalina) [RHEL-153672]\n- RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}\n- net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}\n- iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]\n\n[5.14.0-687.4.1]\n- mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}\n- ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]\n- libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]\n- libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]\n- libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]\n- libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]\n- libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]\n- libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]\n- redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]\n- redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]\n- crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]\n- crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]\n- crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]\n- crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]\n- ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}\n- smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]\n- wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}\n\n[5.14.0-687.3.1]\n- HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}\n- NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]\n- perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]\n- perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]\n- perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]\n- scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}\n- nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]\n- redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)\n- gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]\n- io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]\n- netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}\n- net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}\n- net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]\n- macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]\n- macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}\n- spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]\n- spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]\n- spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]\n- spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]\n- spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]\n- spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]\n- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}\n- ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}\n\n[5.14.0-687.2.1]\n- netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}\n- bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}\n- Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]\n- Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]\n- vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]\n- vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]\n- vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]\n- vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]\n- vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]\n- virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]\n- vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]\n- vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]\n- vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]\n- vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]\n- vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]\n- vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]\n- dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]\n\n[5.14.0-687.1.1]\n- mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]\n- mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}\n- mm/hugetlb: fix copy_hugetlb_page_range() to use -pt_share_count (Rafael Aquini) [RHEL-150765]\n- mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}\n- mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]\n- mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]\n- x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}\n- mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]\n- mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}\n- redhat: update self-test data (Patrick Talbert)\n- redhat: set defaults for 9.8 (Patrick Talbert)\n- gitlab-ci: disttag override for 9.8 (Patrick Talbert)\n- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}\n\n[5.14.0-687]\n- cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]\n- cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]\n- smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]\n- smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]\n- Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]\n- Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]\n- Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]\n- Revert: Revert 'ipmi: fix msg stack when IPMI is disconnected' (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Rename 'user_data' to 'recv_msg' in an SMI message (Tony Camuso) [RHEL-149762]\n- Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]\n- Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]\n- nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]\n\n[5.14.0-686]\n- pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]\n- net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]\n- ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]\n- cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]\n- spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]\n- spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]",
  "id": "ELSA-2026-19225",
  "ovalId": "oval:com.oracle.elsa:def:202619225",
  "source": "oracle_linux",
  "title": "ELSA-2026-19225:  kernel security update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-19225.html"
}