Detections
Analytics

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500397)

critical Nessus Plugin ID 366662

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500397 advisory.

 - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167664] {CVE-2026-98432}
 - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167666] {CVE-2026-99999}
 - vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 40166458] {CVE-2026-74580}
 - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
 - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
 - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
 - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
 - pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}
 - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
 - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
 - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
 - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
 39273524] {CVE-2026-31588}
 - xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
 - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}
 - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
 - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
 39784513] {CVE-2026-68480}
 - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480} (H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug:
 39784513] {CVE-2026-68480}
 - x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
 - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug:
 39784513] {CVE-2026-68480}
 - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug:
 39784513] {CVE-2026-68480}
 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
 39558751,39919265] {CVE-2026-74684}
 - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026-31598}
 - fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235] {CVE-2026-46116}
 - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
 39621716,39638198] {CVE-2026-52995}
 - xfs: resample the data fork mapping after cycling ILOCK (Darrick Wong) [Orabug: 39776792] {CVE-2026-64600}
 - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [Orabug:
 39673871,39686461] {CVE-2026-53359}
 - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Sean Christopherson) [Orabug:
 39460223,39673871] {CVE-2026-46113}
 - net/sched: act_pedit: fix action bind logic (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: act_pedit: free pedit keys on bail from offset check (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) [Orabug:
 39567287,39680880] {CVE-2026-46331}
 - net/sched: act_pedit: Parse L3 Header for L4 offset (Max Tottenham) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: act_pedit: rate limit datapath messages (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: act_pedit: check static offsets a priori (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: act_pedit: remove extra check for key type (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: simplify tcf_pedit_act (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: transition act_pedit to rcu and percpu stats (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - net/sched: act_pedit: use NLA_POLICY for parsing 'ex' keys (Pedro Tammela) [Orabug: 39567287] {CVE-2026-46331}
 - RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (Hkbinbin) [Orabug: 39452261] {CVE-2026-46043}
 - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Davidlohr Bueso) [Orabug:
 39426001,39751168] {CVE-2026-43499,CVE-2026-53163}
 - rtmutex: Use waiter::task instead of current in remove_waiter() (Keenan Dong) [Orabug:
 39426001,39706958] {CVE-2026-43499}
 - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Eric Dumazet) [Orabug: 39300930] {CVE-2026-43038}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-500397.html

Plugin Details

Severity: Critical

ID: 366662

File Name: oraclelinux_ELSA-2026-500397.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 10/16/2026

Updated: 10/16/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.69

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 5.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-99999

CVSS v3

Risk Factor: Critical

Base Score: 9.3

Temporal Score: 8.4

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:oracle:linux:7, cpe:/o:oracle:linux:8, cpe:/o:oracle:linux:8:10:baseos_patch, p-cpe:/a:oracle:linux:kernel-uek-container-debug, p-cpe:/a:oracle:linux:kernel-uek-container, p-cpe:/a:oracle:linux:kernel-uek-debug-devel, p-cpe:/a:oracle:linux:kernel-uek-debug, p-cpe:/a:oracle:linux:kernel-uek-devel, p-cpe:/a:oracle:linux:kernel-uek-doc, p-cpe:/a:oracle:linux:kernel-uek-tools, p-cpe:/a:oracle:linux:kernel-uek

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/16/2026

Vulnerability Publication Date: 8/21/2026

Reference Information

CVE: CVE-2026-74580, CVE-2026-98432, CVE-2026-99999