[ol8_MODRHCK] kernel-debug-core-4.18.0-553.162.1.0.1.el8_10.x86_64

The kernel package contains the Linux kernel (vmlinuz), the core of any
Linux operating system.  The kernel handles the basic functions
of the operating system:  memory allocation, process allocation, device
input and output, etc.

This variant of the kernel has numerous debugging options enabled.
It should only be installed when trying to gather additional information
on kernel bugs, as some of these options impact performance noticably.

Changelog (Show File list) (Show related packages)

• Thu Sep 10 2026 EL Errata <el-errata_ww@oracle.com> [4.18.0-553.162.1.0.1.el8_10.OL8]

  - scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]

• Thu Sep 10 2026 EL Errata <el-errata_ww@oracle.com> [4.18.0-553.162.1.el8_10.OL8]

  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
  - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]

• Wed Sep 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.162.1.el8_10]

  - scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117]
  - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801}
  - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117}
  - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971}
  - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917}
  - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315}
  - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376}
  - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300}
  - gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340]
  - gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340]
  - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202]
  - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246}
  - netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942}
  - netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986}
  - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745}
  - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149}

• Mon Sep 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.161.1.el8_10]

  - security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015}
  - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113}
  - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}
  - net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091}

• Thu Sep 03 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.160.1.el8_10]

  - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563}
  - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480}
  - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244910] {CVE-2026-72129}
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
  - crypto: pcrypt - Delay write to padata->info (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
  - crypto: pcrypt - Do not clear MAY_SLEEP flag in original request (Ricardo Robaina) [RHEL-226702] {CVE-2026-43493}
  - smb: client: validate DFS referral PathConsumed (CKI Backport Bot) [RHEL-237655] {CVE-2026-68343}
  - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CKI Backport Bot) [RHEL-228903] {CVE-2026-64007}
  - netfilter: conntrack: remove sprintf usage (CKI Backport Bot) [RHEL-224448] {CVE-2026-53002}

• Mon Aug 31 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.159.1.el8_10]

  - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246806] {CVE-2026-74581}
  - powerpc/pseries: lparcfg - fix kbuf[] underflow (Mamatha Inamdar) [RHEL-240144]
  - powerpc/pseries: Remove VLA from lparcfg_write() (Mamatha Inamdar) [RHEL-240144]
  - RHEL only: Disable zram writeback support on non-4k page size systems (Jeff Moyer) [RHEL-191437] {CVE-2026-53185}
  - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227780] {CVE-2026-53399}
  - NFSv4/flexfiles: reject zero filehandle version count (Scott Mayhew) [RHEL-229402] {CVE-2026-53392}
  - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234059] {CVE-2026-64298}
  - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228028] {CVE-2026-53391}
  - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226624] {CVE-2026-63800}
  - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225510] {CVE-2026-53397}
  - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230492] {CVE-2026-68480}
  - x86: Clean up names/macros conflicting with ptrace-abi.h (Waiman Long) [RHEL-230492]
  - x86/entry: Unify definitions from <asm/calling.h> and <asm/ptrace-abi.h> (Waiman Long) [RHEL-230492]
  - smc91x: fix broken irq-context in PREEMPT_RT (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
  - net: smc91x: Fix possible memory leak in smc_drv_probe() (CKI Backport Bot) [RHEL-231993] {CVE-2025-71132}
  - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229075] {CVE-2026-64018}
  - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225272] {CVE-2026-45970}
  - s390/cpum_sf: Handle CPU hotplug remove during sampling (CKI Backport Bot) [RHEL-228073] {CVE-2024-57849}
  - RDMA/siw: bound Read Response placement to the RREAD length (CKI Backport Bot) [RHEL-219521] {CVE-2026-64268}
  - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193045]

• Mon Aug 24 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.158.1.el8_10]

  - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (Maurizio Lombardi) [RHEL-219613] {CVE-2026-64320}
  - selinux: check connect-related permissions on TCP Fast Open (Ondrej Mosnacek) [RHEL-222800]
  - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232120] {CVE-2026-64191}
  - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
  - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231660] {CVE-2026-63886}
  - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231447] {CVE-2026-64277}
  - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230251] {CVE-2026-64276}
  - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CKI Backport Bot) [RHEL-229797] {CVE-2026-63913}
  - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227676] {CVE-2026-64189}
  - sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212400]
  - sctp: Hold sock lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
  - sctp: Prevent TOCTOU out-of-bounds write (Jamie Bainbridge) [RHEL-212400]
  - sctp: Hold RCU read lock while iterating over address list (Jamie Bainbridge) [RHEL-212400]
  - usb: hub: Make usb_hub_wq type depend on isolcpus/nohz_full setting (Waiman Long) [RHEL-178088]
  - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188193] {CVE-2026-52924}

• Wed Aug 19 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.157.1.el8_10]

  - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236195] {CVE-2026-68388}
  - mm, page_alloc: skip ->waternark_boost for atomic order-0 allocations (Jay Shin) [RHEL-219767]
  - mm, page_alloc: reset the zone->watermark_boost early (Jay Shin) [RHEL-219767]
  - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213227] {CVE-2026-63888}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (Abhishek Rawal) [RHEL-224189] {CVE-2024-56602}
  - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232546]
  - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232546]
  - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232546] {CVE-2026-52991}
  - sched/psi: Remove unused parameter nbytes of psi_trigger_create() (Waiman Long) [RHEL-232546]
  - psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n (Waiman Long) [RHEL-232546]
  - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234516] {CVE-2026-64379}
  - mm/huge_memory: update file PMD counter before folio_put() (Luiz Capitulino) [RHEL-231209] {CVE-2026-53189}
  - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230094] {CVE-2026-64048}
  - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CKI Backport Bot) [RHEL-213200] {CVE-2026-63887}
  - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180148] {CVE-2026-46120}

• Mon Aug 17 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.156.1.el8_10]

  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221327] {CVE-2026-43206}
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222576] {CVE-2026-64219}
  - drm/amdgpu: fix amdgpu_hmm_range_get_pages (CKI Backport Bot) [RHEL-222620] {CVE-2026-63879}
  - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222738] {CVE-2026-63884}
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222662] {CVE-2026-53329}
  - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222680] {CVE-2026-53136}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() (Luiz Capitulino) [RHEL-226551] {CVE-2025-39902}
  - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222656] {CVE-2026-53374}
  - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224556]
  - can: bcm: extend bcm_tx_lock usage for data and timer updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: add locking when updating filter and timer values (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: fix locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: add locking for bcm_op runtime updates (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: check the result of can_send() in bcm_can_tx() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: Use hrtimer_forward_now() (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet (Guillaume Nault) [RHEL-216711] {CVE-2026-17523}
  - sched/deadline: Update GRUB description in the documentation (Herton R. Krzesinski) [RHEL-189997]
  - sched/deadline: fix kABI breakage after the introduction of max_bw on dl_rq (Herton R. Krzesinski) [RHEL-189997]
  - sched/deadline: Fix bandwidth reclaim equation in GRUB (Herton R. Krzesinski) [RHEL-189997]
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188453] {CVE-2026-53016}

• Wed Aug 12 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.155.1.el8_10]

  - udf: fix partition descriptor append bookkeeping (Ravi Singh) [RHEL-179571] {CVE-2026-45991}
  - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-192193] {CVE-2026-53009}