elsa-2026-34911

{
  "cves": [
    "CVE-2025-10263",
    "CVE-2026-43112",
    "CVE-2026-45998",
    "CVE-2026-46209",
    "CVE-2026-46244",
    "CVE-2026-46316",
    "CVE-2026-53362"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "IMPORTANT"
  },
  "description": "[6.12.0-211.34.1]\n- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]\n- Disable UKI signing [Orabug: 36571828]\n- Update Oracle Linux certificates (Kevin Lyons)\n- Disable signing for aarch64 (Ilya Okomin)\n- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]\n- Update x509.genkey [Orabug: 24817676]\n- Conflict with shim-ia32 and shim-x64 = 15.3-1.0.5]\n- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]\n- Add Oracle Linux IMA certificates\n- Update module name for cryptographic module [Orabug: 37400433]\n- Clean git history at setup stage\n\n[6.12.0-211.34.1]\n- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}\n- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]\n- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]\n\n[6.12.0-211.33.1]\n- futex/requeue: Revert 'Prevent NULL pointer dereference in remove_waiter() on self-deadlock'' (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}\n- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}\n- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}\n- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}\n- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}\n\n[6.12.0-211.32.1]\n- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359}\n- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113}\n- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066}\n- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227}\n\n[6.12.0-211.31.1]\n- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776]\n- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776]\n- eventpoll: drop vestigial epi-dying flag (Ian Kent) [RHEL-180776]\n- eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614}\n- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776]\n- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776]\n- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776]\n- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242}\n- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776]\n- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776]\n- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776]\n- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776]\n- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776]\n- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776]\n- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074}\n- epoll: annotate racy check (Ian Kent) [RHEL-180776]\n- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155}\n- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048]\n- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770]\n- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259}\n- net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341}\n- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}\n- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276}\n- net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140]\n\n[6.12.0-211.30.1]\n- ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]\n- ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349]\n- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112}\n- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263}\n- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537]\n- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537]\n- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537]\n- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537]\n- ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110]\n- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316}\n- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244}\n- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209}\n- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}\n- rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998}\n\n[6.12.0-211.29.1]\n- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176}\n- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739}\n- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759]\n- crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759]\n- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887]\n- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189}\n- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090}\n- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279}\n\n[6.12.0-211.28.1]\n- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117]\n- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198}\n- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414}\n- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117}\n- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898}\n- rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636}\n\n[6.12.0-211.27.1]\n- nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135}\n- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145}\n- ipv6: icmp: clear skb2-cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038}\n\n[6.12.0-211.26.1]\n- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331}\n- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173}\n- crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330}\n- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056}",
  "id": "ELSA-2026-34911",
  "ovalId": "oval:com.oracle.elsa:def:202634911",
  "source": "oracle_linux",
  "title": "ELSA-2026-34911:  kernel security, bug fix, and enhancement update (IMPORTANT)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-34911.html"
}