kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0809)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0809 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle Linux 10 : kernel (ELSA-2026-27288)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-27288 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

CVE-2026-55998

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998

The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

SUSE CVE-2026-69247

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder, pkcs7decryptpem, and pkcs7decryptsmime reported the outcome of decrypting a RecipientInfo's encryptedKey in several distinguishable ways, one of which...

kernel security, bug fix, and enhancement update

4.18.0-553.151.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

Oracle Linux 9 : ELSA-2026-50141-0: / sg3_utils (ELSA-2026-501410)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-501410 advisory. 1.47-10.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188130 Tenable has extracted the preceding description block directly from the...

Oracle Linux 10 : kernel (ELSA-2026-49211)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49211 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-214082 CVE-2026-64530 - ksm: use range-walk function to jump over...

Oracle Linux 9 : kernel (ELSA-2026-49212)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49212 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213299 CVE-2026-64530 - ipc: limit nextid allocation to the valid I...

Oracle Linux 8 : mingw-glib2 (ELSA-2026-49512)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49512 advisory. - Fix CVE-2026-58010: off-by-one error in gvstupleisnormal Resolves: RHEL-212164 - Fix CVE-2026-58011: gdatetimeaddfull range validation Resolves:...

Oracle Linux 8 : kernel (ELSA-2026-49214)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-49214 advisory. - net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle CKI Backport Bot RHEL-213300 CVE-2026-64530 - netfilter: ctnetlink: ensure safe access to...

Oracle Linux 10 : ELSA-2026-50144-0: / libgcrypt (ELSA-2026-501440)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-501440 advisory. - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext Tenable has extracted the preceding description block directly from t...

Oracle Linux 10 : ldns (ELSA-2026-49836)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49836 advisory. 1.8.3-18.1 - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching RHEL-210690 Tenable has extracted the preceding...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

Oracle Linux 10 : ELSA-2026-50142-0: / sg3_utils (ELSA-2026-501420)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-501420 advisory. 1.48-7.1 - sginq output conformance for SCSI name string and ATA fields RHEL-188123 Tenable has extracted the preceding description block directly from the...

Oracle Linux 8 : ldns (ELSA-2026-49520)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49520 advisory. - Fix CVE-2026-10846: validate DNS response source address, transaction ID, and query section matching Tenable has extracted the preceding description block...

Oracle Linux 8 : thunderbird (ELSA-2026-49922)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-49922 advisory. 140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...