-
Tue Aug 04 2026 EL Errata <el-errata_ww@oracle.com> [4.18.0-553.151.1.el8_10.OL8]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]
-
Mon Aug 03 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.151.1.el8_10]
- net: dns_resolver: allow shorter names in dns_query() (Paulo Alcantara) [RHEL-213976]
- net/dns_resolver: use kasprintf + kmemdup_nul to simplify dns_query (Paulo Alcantara) [RHEL-213976]
- net/dns_resolver: consolidate namelen checks in dns_query (Paulo Alcantara) [RHEL-213976]
- dns: remove redundant zero length namelen check (Paulo Alcantara) [RHEL-213976]
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188216] {CVE-2026-52923}
- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183880]
-
Wed Jul 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.150.1.el8_10]
- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213300] {CVE-2026-64530}
- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173877] {CVE-2026-43116}
-
Tue Jul 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.149.1.el8_10]
- rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- net: validate veth and vxcan peer ifindexes (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnl: move rtnl_newlink_create() (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnl: split __rtnl_newlink() into two functions (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- rtnl: allocate more attr tables on the heap (Guillaume Nault) [RHEL-172526] {CVE-2026-31692}
- fanotify: fix false positive on permission events (Miklos Szeredi) [RHEL-180075] {CVE-2026-46150}
-
Mon Jul 27 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.148.1.el8_10]
- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192211] {CVE-2026-53006}
-
Thu Jul 23 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.147.1.el8_10]
- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807}
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341]
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341]
- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341]
- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341]
- KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341]
- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026}
- KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228]
- KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228]
- KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228]
- KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228]
- serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191]
- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993}
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324]
- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059}
- xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174]
- selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738]
- selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738]
- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738]
- mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655]
- mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655]
- mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655]
-
Mon Jul 20 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.146.1.el8_10]
- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117}
- PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916]
-
Thu Jul 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.145.1.el8_10]
- Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188327] {CVE-2026-53071}
-
Tue Jul 14 2026 Jan Stancek <jstancek@redhat.com> [4.18.0-553.144.1.el8_10]
- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180170] {CVE-2026-46116}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193938]
- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179325] {CVE-2026-46086}
-
Thu Jul 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.143.1.el8_10]
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166}
- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499}