-
Mon Mar 09 2026 EL Errata <el-errata_ww@oracle.com> [5.14.0-611.38.1.el9_7.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
-
Sat Feb 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.38.1.el9_7]
- mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143194] {CVE-2025-68800}
-
Thu Feb 26 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.37.1.el9_7]
- printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148302]
- printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148302]
- printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148302]
- printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148302]
- printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148302]
- printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148302]
- printk: nbcon: Use raw_cpu_ptr() instead of open coding (CKI Backport Bot) [RHEL-148302]
- backport "printk: Add helper for flush type logic" and associated changes (CKI Backport Bot) [RHEL-148302]
- printk: Remove redundant deferred check in vprintk() (CKI Backport Bot) [RHEL-148302]
- printk: Introduce force_legacy_kthread() macro (CKI Backport Bot) [RHEL-148302]
- printk: Add is_printk_legacy_deferred() (CKI Backport Bot) [RHEL-148302]
- io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137988]
- io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137988]
- io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137988] {CVE-2025-38106}
- io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137988]
- io_uring/sqpoll: annotate debug task == current with data_race() (Jeff Moyer) [RHEL-137988]
- macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144125] {CVE-2026-23001}
- net/smc: Fix lookup of netdev by using ib_device_get_netdev() (CKI Backport Bot) [RHEL-114786]
-
Tue Feb 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.36.1.el9_7]
- net/smc: Remove validation of reserved bits in CLC Decline message (Mete Durlu) [RHEL-143718]
- autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-149495]
- migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147266] {CVE-2026-23097}
- ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148166]
- fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Xin Long) [RHEL-144987]
- tools: ynl: Specify --no-line-number in ynl-regen.sh. (Xin Long) [RHEL-144987]
- gue: Fix skb memleak with inner IP protocol 0. (Xin Long) [RHEL-144987]
- netlink: specs: fou: replace underscores with dashes in names (Xin Long) [RHEL-144987]
- fou: fix initialization of grc (Xin Long) [RHEL-144987]
- fou: Fix null-ptr-deref in GRO. (Xin Long) [RHEL-144987]
- fou: remove warn in gue_gro_receive on unsupported protocol (Xin Long) [RHEL-144987]
- fou: Remove XRFM from NET_FOU Kconfig (Xin Long) [RHEL-144987]
- fou: remove sparse errors (Xin Long) [RHEL-144987]
- redhat: enable FOU modules in kernel-modules-extra (Xin Long) [RHEL-144987]
- s390/mm: Fix __ptep_rdp() inline assembly (Mete Durlu) [RHEL-143713]
- dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146357]
- dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-147459]
- dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-147459]
- dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-147459]
- i40e: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
- ice: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
- scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-146049]
- ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143545] {CVE-2025-71085}
- tick/sched: Limit non-timekeeper CPUs calling jiffies update (Phil Auld) [RHEL-141462]
- smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130017] {CVE-2025-40168}
-
Tue Feb 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.35.1.el9_7]
- page_pool: Fix use-after-free in page_pool_recycle_in_ring (Paolo Abeni) [RHEL-137841] {CVE-2025-38129}
- exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146403] {CVE-2025-38206}
-
Sat Feb 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.34.1.el9_7]
- scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-145183]
- smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-127498]
- smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-127498]
- smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-127498]
- cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-127498]
- smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126890] {CVE-2025-40064}
-
Thu Feb 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.33.1.el9_7]
- i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141877]
- x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT (Paolo Bonzini) [RHEL-128030]
- x86/sev: Evict cache lines during SNP memory validation (Paolo Bonzini) [RHEL-128030]
- ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132891] {CVE-2023-53034}
- fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137683] {CVE-2025-40304}
- crypto: iaa - Optimize rebalance_wq_table() (Jay Shin) [RHEL-137272]
- fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136942] {CVE-2025-40322}
- bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135137]
-
Tue Feb 03 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.32.1.el9_7]
- svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142790] {CVE-2025-68811}
- NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140260] {CVE-2025-68349}
-
Sat Jan 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.31.1.el9_7]
- nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144332] {CVE-2026-22998}
-
Thu Jan 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.30.1.el9_7]
- io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137329] {CVE-2025-38730}
- io_uring/kbuf: add io_kbuf_commit() helper (Jeff Moyer) [RHEL-137329]
- io_uring/kbuf: use 'bl' directly rather than req->buf_list (Jeff Moyer) [RHEL-137329]
- ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143296]
- net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Adrian Moreno) [RHEL-141404]
- atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137601] {CVE-2025-38459}
- dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139699]
- dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139699]
- dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139699]
- dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139699]
- dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139699]
- dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139699]
- dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139699]
- dpll: add reference sync get/set (Ivan Vecera) [RHEL-139699]
- dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139699]
- dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139699]
- net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129084] {CVE-2025-40170}
- ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-129084]
- net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (Hangbin Liu) [RHEL-129084]
- ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129018] {CVE-2025-40135}
- ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128982] {CVE-2025-40158}
- net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128982]
- ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128982]
- net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128982]
- net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128982]
- bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 (Hangbin Liu) [RHEL-128982]
- vrf: Fix lockdep splat in output path (Hangbin Liu) [RHEL-128982]
- ipv6: remove nexthop_fib6_nh_bh() (Hangbin Liu) [RHEL-128982]
- net: remove rcu_dereference_bh_rtnl() (Hangbin Liu) [RHEL-128982]
- neighbour: switch to standard rcu, instead of rcu_bh (Hangbin Liu) [RHEL-128982]
- ipv6: flowlabel: do not disable BH where not needed (Hangbin Liu) [RHEL-128982]
- ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() (Hangbin Liu) [RHEL-128982]
- neigh: introduce neigh_confirm() helper function (Hangbin Liu) [RHEL-128982]
- net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-132923]
- net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-132923]
- net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-132923]
- vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137697] {CVE-2025-38403}
- ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136909] {CVE-2025-40269}
- nvme: tcp: Fix compilation warning with W=1 (John Meneghini) [RHEL-129928]
- nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (John Meneghini) [RHEL-129928]