Skip to content
Critical Security Flaws in Oracle Linux Kernels Require Immediate Attention

Critical Security Flaws in Oracle Linux Kernels Require Immediate Attention

First seen 19 Oct 2026, 14:51 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 19, 2026 at 16:21 UTC
  • •Critical vulnerabilities in Oracle Linux kernels could allow remote code execution.
  • •Patches for affected versions 7, 8, and 9 are available as of October 19, 2026.
  • •CVE-2026-99999 has a CVSS score of 9.3, indicating a critical threat level.

Oracle has released multiple security updates addressing critical vulnerabilities in its Linux kernels across various versions. The updates affect Oracle Linux 7, 8, 9, and the Unbreakable Enterprise Kernel (UEK) with CVEs including CVE-2026-98432 and CVE-2026-99999, which could allow remote code execution. The flaws were disclosed on October 15, 2026, and patches are now available. Attackers could exploit these vulnerabilities to execute arbitrary code on affected systems, posing a significant risk to organizations running self-managed GitLab. The updates include kernel versions 5.4.17, 5.15.0, and 6.12.0 across the different Oracle Linux distributions. Security professionals are urged to apply these patches immediately to mitigate potential exploitation. The vulnerabilities have been assigned high CVSS scores, indicating their severity and the urgency of remediation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-03-20
Public exploit for CVE-2026-99999 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-05-30
CVE-2026-46242 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-21
CVE-2026-74580 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-28
CVE-2026-80590 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-04
CVE-2026-80844 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-11
CVE-2026-81000 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-06
CVE-2026-98260 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
Vulnerabilities disclosed
Oracle disclosed critical vulnerabilities in its Linux kernels, including CVE-2026-98432 and CVE-2026-99999.
Linuxsecurity
2026-10-15
CVE-2026-98432 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-19
Patches released
Oracle released security updates for Oracle Linux 7, 8, and 9 to address the critical vulnerabilities.
Linuxsecurity

More articles in this cluster (6)

Following this threat?

Track CVE-2026-46242 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 2

Common questions

Which versions of Oracle Linux are affected?
Oracle Linux 7, 8, and 9 are affected, including the Unbreakable Enterprise Kernel.
What is the severity of the vulnerabilities?
The vulnerabilities have been assigned CVSS scores as high as 9.3, indicating a critical threat.
When should I apply the patches?
Patches should be applied immediately to mitigate the risk of exploitation.