Back Linuxsecurity

Oracle Linux 9 ELSA-2026-66180

Linuxsecurity •LinuxSecurity Advisories • September 14, 2026

Artifactory Alert: Chained flaws let attackers gain admin control. Check your version now ×

[5.14.0-687.46.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey [Orabug: 24817676] - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5] - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535] - Add Oracle Linux IMA certificates - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764] [5.14.0-687.46.1] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232236] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232633] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226126] {CVE-2026-46266} - ipv4: icmp: convert to dev_net_rcu() (Felix Maurer) [RHEL-226126] - ipv6: mcast: Fix use-after-free when processing MLD queries (F...

kernel-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-abi-stablelists-5.14.0-687.46.1.el9_8.noarch.rpm kernel-core-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-cross-headers-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-core-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-devel-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-devel-matched-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-modules-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-modules-core-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-modules-extra-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-debug-uki-virt-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-devel-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-devel-matched-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-doc-5.14.0-687.46.1.el9_8.noarch.rpm kernel-headers-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-modules-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-modules-core-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-modules-extra-5.14.0-687.46.1.el9_8.x86_64.rpm kernel-tools-5.14....

kernel-cross-headers-5.14.0-687.46.1.el9_8.aarch64.rpm kernel-headers-5.14.0-687.46.1.el9_8.aarch64.rpm kernel-tools-5.14.0-687.46.1.el9_8.aarch64.rpm kernel-tools-libs-5.14.0-687.46.1.el9_8.aarch64.rpm kernel-tools-libs-devel-5.14.0-687.46.1.el9_8.aarch64.rpm libperf-5.14.0-687.46.1.el9_8.aarch64.rpm perf-5.14.0-687.46.1.el9_8.aarch64.rpm python3-perf-5.14.0-687.46.1.el9_8.aarch64.rpm rtla-5.14.0-687.46.1.el9_8.aarch64.rpm rv-5.14.0-687.46.1.el9_8.aarch64.rpm

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Oracle Linux Kernel Vulnerabilities Expose Admin Control Risks Multiple vulnerabilities in Oracle Linux kernels (versions 4.18 and 5.14) have been identified, allowing attackers to gain administrative control through chained exploits. The vulnerabilities are linked to CVE-2026-46015 and CVE-2025-38004, with patches released for Oracle Linux 8 and 9. Affected systems include Oracle Linux 8 and 9, with specific kernel versions being 4.18.0-553.162.1 and 5.14.0-687.46.1. The vulnerabilities were disclosed recently, with the potential for exploitation confirmed. Administrators are urged to update their systems immediately to mitigate risks. The updates include disabling UKI signing and updating Oracle Linux certificates. The situation is critical due to the potential for mass exploitation if not addressed promptly. 4 sources 73

Extracted Entities

CVEs (17)

CVE-2026-43133 CVE-2026-43339 CVE-2026-43493 CVE-2026-46015 CVE-2026-46149 CVE-2026-46266 CVE-2026-46306 CVE-2026-46330 CVE-2026-53002 CVE-2026-53223 CVE-2026-53275 CVE-2026-53366 CVE-2026-64034 CVE-2026-64563 CVE-2026-64597 CVE-2026-72129 CVE-2026-74480

Platforms (2)

Linux Oracle Linux