kernel security update

2024-07-1800:00:00

linux.oracle.com

kernel update

security fixes

oracle linux

cve-2024-35958

cve-2024-36904

cve-2024-36886

cve-2024-38663

cve-2024-36270

cve-2024-38543

cve-2024-38586

cve-2024-38593

cve-2022-48627

cve-2024-26858

cve-2024-26783

cve-2023-52638

cve-2021-47548

cve-2024-27435

cve-2021-47596

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

Low

EPSS

0.001

Percentile

16.8%

JSON

[5.14.0-427.26.1_4.OL9]
Disable UKI signing [Orabug: 36571828]
Update Oracle Linux certificates (Kevin Lyons)
Disable signing for aarch64 (Ilya Okomin)
Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
Update x509.genkey [Orabug: 24817676]
Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5
Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
Add Oracle Linux IMA certificates
[5.14.0-427.26.1_4]
net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-39217 RHEL-37430] {CVE-2024-35958}
tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-41749 RHEL-39837] {CVE-2024-36904}
mm/mglru: Revert ‘don’t sync disk for each aging cycle’ (Waiman Long) [RHEL-44418]
tipc: fix UAF in error path (Xin Long) [RHEL-34848 RHEL-34280] {CVE-2024-36886}
selftest/cgroup: Update test_cpuset_prs.sh to match changes (Waiman Long) [RHEL-45139]
cgroup/cpuset: Make cpuset.cpus.exclusive independent of cpuset.cpus (Waiman Long) [RHEL-45139]
cgroup/cpuset: Delay setting of CS_CPU_EXCLUSIVE until valid partition (Waiman Long) [RHEL-45139]
selftest/cgroup: Fix test_cpuset_prs.sh problems reported by test robot (Waiman Long) [RHEL-45139]
cgroup/cpuset: Fix remote root partition creation problem (Waiman Long) [RHEL-45139]
cgroup/cpuset: Optimize isolated partition only generate_sched_domains() calls (Waiman Long) [RHEL-45139]
cgroup/cpuset: Fix retval in update_cpumask() (Waiman Long) [RHEL-45139]
cgroup/cpuset: Fix a memory leak in update_exclusive_cpumask() (Waiman Long) [RHEL-45139]
ice: implement AQ download pkg retry (Petr Oros) [RHEL-38907 RHEL-17318]
redhat: include resolve_btfids in kernel-devel (Viktor Malik) [RHEL-43426 RHEL-40707]
blk-cgroup: fix list corruption from resetting io stat (cki-backport-bot) [RHEL-44977] {CVE-2024-38663}
misc: rtsx: do clear express reg every SD_INT (David Arcari) [RHEL-39985 RHEL-33706]
misc: rtsx: Fix rts5264 driver status incorrect when card removed (David Arcari) [RHEL-39985 RHEL-33706]
netfilter: tproxy: bail out if IP has been disabled on the device (cki-backport-bot) [RHEL-44371] {CVE-2024-36270}
lib/test_hmm.c: handle src_pfns and dst_pfns allocation failure (cki-backport-bot) [RHEL-44263 RHEL-44261] {CVE-2024-38543}
r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44039] {CVE-2024-38586}
net: micrel: Fix receiving the timestamp in the frame for lan8841 (cki-backport-bot) [RHEL-43996] {CVE-2024-38593}
vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-43379 RHEL-27780] {CVE-2022-48627}
net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map (Kamal Heib) [RHEL-42728 RHEL-34192] {CVE-2024-26858}
locking/atomic: Make test_and_*_bit() ordered on failure (Paolo Bonzini) [RHEL-45896]
mm/vmscan: fix a bug calling wakeup_kswapd() with a wrong zone index (Rafael Aquini) [RHEL-42659 RHEL-31840] {CVE-2024-26783}
can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock (Jose Ignacio Tornos Martinez) [RHEL-42379 RHEL-31530] {CVE-2023-52638}
ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-42226 RHEL-38715] {CVE-2021-47548}
[5.14.0-427.25.1_4]
nvme: fix reconnection fail due to reserved tag allocation (Maurizio Lombardi) [RHEL-42896 RHEL-36896] {CVE-2024-27435}
net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg (cki-backport-bot) [RHEL-43625] {CVE-2021-47596}
scsi: sg: Avoid race in error handling & drop bogus warn (Ewan D. Milne) [RHEL-36106 RHEL-35659]
scsi: sg: Avoid sg device teardown race (Ewan D. Milne) [RHEL-36106 RHEL-35659]
netfilter: nf_tables: use timestamp to check for set element timeout (Florian Westphal) [RHEL-38032 RHEL-33985] {CVE-2024-27397}
netfilter: nft_set_rbtree: Remove unused variable nft_net (Florian Westphal) [RHEL-38032 RHEL-33985]
netfilter: nft_set_rbtree: prefer sync gc to async worker (Florian Westphal) [RHEL-38032 RHEL-33985]
netfilter: nft_set_rbtree: rename gc deactivate+erase function (Florian Westphal) [RHEL-38032 RHEL-33985]
netfilter: nf_tables: de-constify set commit ops function argument (Florian Westphal) [RHEL-38032 RHEL-33985]
octeontx2-af: avoid off-by-one read from userspace (Kamal Heib) [RHEL-40486 RHEL-39873] {CVE-2024-36957}

OSVersionArchitecturePackageVersionFilename
oracle linux9srckernel< 5.14.0-427.26.1.el9_4kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux9srckernel< 5.14.0-427.26.1.el9_4kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux9srckernel< 5.14.0-427.26.1.el9_4kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux9srckernel< 5.14.0-427.26.1.el9_4kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux9aarch64bpftool< 7.3.0-427.26.1.el9_4bpftool-7.3.0-427.26.1.el9_4.aarch64.rpm
oracle linux9aarch64bpftool< 7.3.0-427.26.1.el9_4bpftool-7.3.0-427.26.1.el9_4.aarch64.rpm
oracle linux9aarch64kernel-cross-headers< 5.14.0-427.26.1.el9_4kernel-cross-headers-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux9aarch64kernel-headers< 5.14.0-427.26.1.el9_4kernel-headers-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux9aarch64kernel-tools< 5.14.0-427.26.1.el9_4kernel-tools-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux9aarch64kernel-tools< 5.14.0-427.26.1.el9_4kernel-tools-5.14.0-427.26.1.el9_4.aarch64.rpm

OS	Version	Architecture	Package	Version	Filename
oracle linux	9	src	kernel	< 5.14.0-427.26.1.el9_4	kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux	9	src	kernel	< 5.14.0-427.26.1.el9_4	kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux	9	src	kernel	< 5.14.0-427.26.1.el9_4	kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux	9	src	kernel	< 5.14.0-427.26.1.el9_4	kernel-5.14.0-427.26.1.el9_4.src.rpm
oracle linux	9	aarch64	bpftool	< 7.3.0-427.26.1.el9_4	bpftool-7.3.0-427.26.1.el9_4.aarch64.rpm
oracle linux	9	aarch64	bpftool	< 7.3.0-427.26.1.el9_4	bpftool-7.3.0-427.26.1.el9_4.aarch64.rpm
oracle linux	9	aarch64	kernel-cross-headers	< 5.14.0-427.26.1.el9_4	kernel-cross-headers-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux	9	aarch64	kernel-headers	< 5.14.0-427.26.1.el9_4	kernel-headers-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux	9	aarch64	kernel-tools	< 5.14.0-427.26.1.el9_4	kernel-tools-5.14.0-427.26.1.el9_4.aarch64.rpm
oracle linux	9	aarch64	kernel-tools	< 5.14.0-427.26.1.el9_4	kernel-tools-5.14.0-427.26.1.el9_4.aarch64.rpm