Detections
Analytics

Oracle Linux 7 / 8 : Unbreakable Enterprise kernel (ELSA-2026-500573)

medium Nessus Plugin ID 375470

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

The remote Oracle Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500573 advisory.

 - drbd: fix 'LOGIC BUG' in drbd_al_begin_io_nonblock() (Lars Ellenberg) [Orabug: 39130967] {CVE-2026-23356}
 - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40165812] {CVE-2026-99999}
 - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40165790] {CVE-2026-98432}
 - vhost: reset the vring metadata cache on vring reconfiguration (Jun Yang) [Orabug: 39917526] {CVE-2026-74580}
 - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40020673] {CVE-2026-81000}
 - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 39982188] {CVE-2026-80844}
 - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39972532] {CVE-2026-80590}
 - sctp: prevent peer transport count overflow (Asim Viladi Oglu Manizada) [Orabug: 39886843] {CVE-2026-74469}
 - pppoe: reload header pointer after dev_hard_header() (Asim Viladi Oglu Manizada) [Orabug: 39859408] {CVE-2026-68121}
 - crypto: ecc - Fix carry overflow in vli multiplication (Anastasia Tishchenko) [Orabug: 39785911] {CVE-2026-64313}
 - crypto: pcrypt - restore callback for non-parallel fallback (Ruijie Li) [Orabug: 39785907] {CVE-2026-64312}
 - crypto: drbg - Fix returning success on failure in CTR_DRBG (Eric Biggers) [Orabug: 39785894] {CVE-2026-64306}
 - KVM: x86: Use scratch field in MMIO fragment to hold small write values (Sean Christopherson) [Orabug:
 39273524] {CVE-2026-31588}
 - xfrm: clear trailing padding in build_polexpire() (Yasuaki Torimaru) [Orabug: 39262403] {CVE-2026-31664}
 - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Oleh Konko) [Orabug: 39262395] {CVE-2026-31662}
 - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Lukas Johannes Moller) [Orabug: 39167519] {CVE-2026-23457}
 - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (Jenny Guanni Qu) [Orabug: 39167511] {CVE-2026-23455}
 - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov) [Orabug: 39784513,39853776] {CVE-2026-68480}
 - x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (Thomas Gleixner) [Orabug:
 39784513] {CVE-2026-68480}
 - x86/alternative: Support relocations in alternatives (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Make debug-alternative selective (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Add alt_instr.flags (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/asm: Provide ALTERNATIVE_3 (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Optimize single-byte NOPs at an arbitrary position (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Align insn bytes vertically (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480} (H Peter Anvin) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Optimize optimize_nops() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86: Add insn_decode_kernel() (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - x86/insn: Add an insn_decode() API (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Support ALTERNATIVE_TERNARY (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Merge include files (Juergen Gross) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternative: Drop unused feature parameter from ALTINSTR_REPLACEMENT() (Juergen Gross) [Orabug:
 39784513] {CVE-2026-68480}
 - x86/insn: Support big endian cross-compiles (Martin Schwidefsky) [Orabug: 39784513] {CVE-2026-68480}
 - x86/tools: Use tools headers for instruction decoder selftests (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Get tools's linux/compiler.h closer to the kernel's (Arnaldo Carvalho de Melo) [Orabug:
 39784513] {CVE-2026-68480}
 - perf build: Allow nested externs to enable BUILD_BUG() usage (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - objtool: Allow nested externs to enable BUILD_BUG() (Vasily Gorbik) [Orabug: 39784513] {CVE-2026-68480}
 - objtool: Make relocation in alternative handling arch dependent (Julien Thierry) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Add pr_fmt() to debug macros (Borislav Petkov) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Adopt verbatim copy of compiletime_assert() from kernel sources (Arnaldo Carvalho de Melo) [Orabug: 39784513] {CVE-2026-68480}
 - x86/alternatives: Teach text_poke_bp() to emulate instructions (Peter Zijlstra) [Orabug: 39784513] {CVE-2026-68480}
 - tools headers: Synchronize linux/bits.h with the kernel sources (Arnaldo Carvalho de Melo) [Orabug:
 39784513] {CVE-2026-68480}
 - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug:
 39558751,39919265] {CVE-2026-74684}
 - ocfs2: fix possible deadlock between unlink and dio_end_io_write (Joseph Qi) [Orabug: 39273589] {CVE-2026-31598}
 - fs/ocfs2: fix comments mentioning i_mutex (Hongnan Li) [Orabug: 39273589] {CVE-2026-31598}
 - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Michal Kosiorek) [Orabug: 39460235] {CVE-2026-46116}
 - net/rds: zero per-item info buffer before handing it to visitors (Michael Bommarito) [Orabug:
 39621716,39638198] {CVE-2026-52995}

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-500573.html

Plugin Details

Severity: Medium

ID: 375470

File Name: oraclelinux_ELSA-2026-500573.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 11/3/2026

Updated: 11/3/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.72

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.6

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-23356

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:oracle:linux:7, cpe:/o:oracle:linux:8, p-cpe:/a:oracle:linux:kernel-uek-container-debug, p-cpe:/a:oracle:linux:kernel-uek-container, p-cpe:/a:oracle:linux:kernel-uek-debug-devel, p-cpe:/a:oracle:linux:kernel-uek-debug, p-cpe:/a:oracle:linux:kernel-uek-devel, p-cpe:/a:oracle:linux:kernel-uek-doc, p-cpe:/a:oracle:linux:kernel-uek-tools, p-cpe:/a:oracle:linux:kernel-uek

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/2/2026

Vulnerability Publication Date: 3/25/2026

Reference Information

CVE: CVE-2026-23356, CVE-2026-74580, CVE-2026-98432, CVE-2026-99999