ELSA-2026-77690

[6.12.0-211.64.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5] - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535] - Add Oracle Linux IMA certificates - Update module name for cryptographic module [Orabug: 37400433] - Clean git history at setup stage - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5] - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535] - Add Oracle Linux IMA certificates - Update module name for cryptographic module [Orabug: 37400433] - Clean git history at setup stage [6.12.0-211.64.1] - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} [6.12.0-211.63.1] - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add 'auto' as a macro for '__auto_type' (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Hoiland-Jorgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Hoiland-Jorgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Hoiland-Jorgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} [6.12.0-211.62.1] - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix 'for a while' typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261]