Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Oracle Linux kernel may let attackers gain higher privileges
published 3 months ago
Summary
The Oracle Linux kernel packages contain two security bugs: one in the real‑time lock handling that could let a malicious program escape its limited rights, and another in the USB Pegasus driver that can be abused by a crafted USB device. Installing the latest kernel updates for Oracle Linux resolves both problems.
What to do
- Update oracle bpftool to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-debug to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-debug-devel to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-devel to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-headers to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-tools to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-tools-libs to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle kernel-tools-libs-devel to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle perf to version 3.10.0-1160.144.1.el7.tuxcare.els9.
- Update oracle python-perf to version 3.10.0-1160.144.1.el7.tuxcare.els9.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:7 | oracle | bpftool |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-debug |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-debug-devel |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-devel |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-headers |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-tools |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-tools-libs |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | kernel-tools-libs-devel |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | perf |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
| TuxCare:OracleLinux:7 | oracle | python-perf |
< 3.10.0-1160.144.1.el7.tuxcare.els9 Fix: upgrade to 3.10.0-1160.144.1.el7.tuxcare.els9
|
Original advisory text
kernel: Fix of 2 CVEs
- rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
- net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
- net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
References
- https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1783788376.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-23290 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-43499 Vendor Advisory
Timeline
Published11 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1783788376 · OSV
Track software like this
Free during beta