# ELSA-2026-500377: Security update for 19 packages ELSA-2026-500377, released October 7, 2026, fixes 79 CVEs across 19 products. None of them is reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/fix/linux/elsa-2026-500377 - Platform: Linux - Released: Oct 7, 2026 - Priority: Urgent (Closes CVE-2026-64564, rated Critical) - CVEs: 79, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-500377.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [bpftool](https://patchblox.com/security/data/product/linux/bpftool.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek](https://patchblox.com/security/data/product/linux/kernel-uek.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-container](https://patchblox.com/security/data/product/linux/kernel-uek-container.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-container-debug](https://patchblox.com/security/data/product/linux/kernel-uek-container-debug.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-core](https://patchblox.com/security/data/product/linux/kernel-uek-core.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug](https://patchblox.com/security/data/product/linux/kernel-uek-debug.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-core](https://patchblox.com/security/data/product/linux/kernel-uek-debug-core.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-devel](https://patchblox.com/security/data/product/linux/kernel-uek-debug-devel.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-modules](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-debug-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-debug-modules-extra.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-devel](https://patchblox.com/security/data/product/linux/kernel-uek-devel.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-doc](https://patchblox.com/security/data/product/linux/kernel-uek-doc.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-modules](https://patchblox.com/security/data/product/linux/kernel-uek-modules.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek-modules-extra.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k](https://patchblox.com/security/data/product/linux/kernel-uek64k.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-core](https://patchblox.com/security/data/product/linux/kernel-uek64k-core.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-devel](https://patchblox.com/security/data/product/linux/kernel-uek64k-devel.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-modules](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 8 | 0:5.15.0-325.220.5.el9uek | | [kernel-uek64k-modules-extra](https://patchblox.com/security/data/product/linux/kernel-uek64k-modules-extra.md) | ol 9 | 0:5.15.0-325.220.5.el9uek | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-64564](https://patchblox.com/security/data/cve/CVE-2026-64564.md) | Urgent | sctp: don't free the ASCONF's own transport in DEL-IP processing | 9.8 | 0.0143 | | | [CVE-2026-72323](https://patchblox.com/security/data/cve/CVE-2026-72323.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmp_gq_start_t... | 9.8 | 0.0072 | | | [CVE-2026-68476](https://patchblox.com/security/data/cve/CVE-2026-68476.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation... | 9.8 | 0.0071 | | | [CVE-2026-80557](https://patchblox.com/security/data/cve/CVE-2026-80557.md) | Urgent | linux: In the Linux kernel, the following vulnerability has been resolved: libceph: fix OOB read in decode_watchers() via m... | 9.8 | 0.0053 | | | [CVE-2025-39925](https://patchblox.com/security/data/cve/CVE-2025-39925.md) | Urgent | can: j1939: implement NETDEV_UNREGISTER notification handler | 9.8 | 0.0015 | | | [CVE-2025-68794](https://patchblox.com/security/data/cve/CVE-2025-68794.md) | High | iomap: adjust read range correctly for non-block-aligned positions | 9.8 | 0.0069 | | | [CVE-2026-80587](https://patchblox.com/security/data/cve/CVE-2026-80587.md) | High | mptcp: avoid combining some incoming suboptions | 9.8 | 0.0052 | | | [CVE-2026-68388](https://patchblox.com/security/data/cve/CVE-2026-68388.md) | High | smb/client: handle overlapping allocated ranges in fallocate | 9.8 | 0.0051 | | | [CVE-2026-74662](https://patchblox.com/security/data/cve/CVE-2026-74662.md) | High | inet: frags: publish queues before arming timer | 9.8 | 0.0051 | | | [CVE-2026-74626](https://patchblox.com/security/data/cve/CVE-2026-74626.md) | High | NTB: ntb_netdev: Preserve RX queue depth on allocation failure | 7.5 | 0.0050 | | | [CVE-2026-74628](https://patchblox.com/security/data/cve/CVE-2026-74628.md) | High | net/x25: fix use-after-free of the socket by its timers | 9.8 | 0.0050 | | | [CVE-2026-97509](https://patchblox.com/security/data/cve/CVE-2026-97509.md) | High | thunderbolt: Keep XDomain reference during the lifetime of a service | 8.8 | 0.0024 | | | [CVE-2026-68278](https://patchblox.com/security/data/cve/CVE-2026-68278.md) | High | drm/dp/mst: fix buffer overflows in sideband chunk accumulation | 8.1 | 0.0024 | | | [CVE-2026-80789](https://patchblox.com/security/data/cve/CVE-2026-80789.md) | High | nvmet-tcp: bound SGL data length before allocating command buffers | 7.5 | 0.0023 | | | [CVE-2025-40102](https://patchblox.com/security/data/cve/CVE-2025-40102.md) | High | KVM: arm64: Prevent access to vCPU events before init | 7.1 | 0.0022 | | | [CVE-2026-80840](https://patchblox.com/security/data/cve/CVE-2026-80840.md) | High | ipv6: seg6: clear IPv4 control block on IPIP decapsulation | 7.8 | 0.0021 | | | [CVE-2026-80824](https://patchblox.com/security/data/cve/CVE-2026-80824.md) | High | usb: usbfs: fix use-after-free of usb_device in usbdev_release() | 8.8 | 0.0020 | | | [CVE-2026-80792](https://patchblox.com/security/data/cve/CVE-2026-80792.md) | High | ipv6: fix use-after-free in ip6_finish_output2() | 8.1 | 0.0020 | | | [CVE-2026-80790](https://patchblox.com/security/data/cve/CVE-2026-80790.md) | High | nvmet-fc: fix invalid free in LS IOD error path | 7.8 | 0.0020 | | | [CVE-2026-80819](https://patchblox.com/security/data/cve/CVE-2026-80819.md) | High | Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept | 7.8 | 0.0020 | | | [CVE-2026-80788](https://patchblox.com/security/data/cve/CVE-2026-80788.md) | High | nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations | 7.5 | 0.0020 | | | [CVE-2026-80767](https://patchblox.com/security/data/cve/CVE-2026-80767.md) | High | HID: sensor: custom: Fix use-after-free in enable_sensor | 7.0 | 0.0020 | | | [CVE-2026-80808](https://patchblox.com/security/data/cve/CVE-2026-80808.md) | High | ext4: stop retrying saturated xattr cache entries | 7.0 | 0.0020 | | | [CVE-2026-80863](https://patchblox.com/security/data/cve/CVE-2026-80863.md) | High | RDMA/rxe: Fix OOB in free_rd_atomic_resources() | 7.8 | 0.0018 | | | [CVE-2026-80916](https://patchblox.com/security/data/cve/CVE-2026-80916.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: kcov: fix data corruption and race conditions on... | 7.8 | 0.0018 | | | [CVE-2025-38653](https://patchblox.com/security/data/cve/CVE-2025-38653.md) | High | proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al | 7.8 | 0.0018 | | | [CVE-2026-80842](https://patchblox.com/security/data/cve/CVE-2026-80842.md) | High | net: bridge: mcast: fix use-after-free of a master VLAN's multicast context | 7.8 | 0.0018 | | | [CVE-2026-80889](https://patchblox.com/security/data/cve/CVE-2026-80889.md) | High | can: isotp: fix timer drain order, wakeup handling and tx_gen ordering | 7.8 | 0.0018 | | | [CVE-2026-64582](https://patchblox.com/security/data/cve/CVE-2026-64582.md) | High | RDMA/rxe: Fix a use-after-free problem in rxe_mmap | 8.8 | 0.0017 | | | [CVE-2026-80908](https://patchblox.com/security/data/cve/CVE-2026-80908.md) | High | drm/amdgpu: Reject UVD message with dimensions above 4096 | 7.8 | 0.0017 | | | [CVE-2026-80909](https://patchblox.com/security/data/cve/CVE-2026-80909.md) | High | drm/amdgpu: Reject UVD message with invalid number of h265 refs | 7.8 | 0.0017 | | | [CVE-2026-43437](https://patchblox.com/security/data/cve/CVE-2026-43437.md) | High | linux: In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream r... | 7.8 | 0.0016 | | | [CVE-2026-80536](https://patchblox.com/security/data/cve/CVE-2026-80536.md) | High | xfs: bounds-check buffer log item's dirty bitmap | 8.4 | 0.0014 | | | [CVE-2026-80570](https://patchblox.com/security/data/cve/CVE-2026-80570.md) | High | Input: synaptics-rmi4 - zero report size on F54 work error | 7.8 | 0.0014 | | | [CVE-2026-74549](https://patchblox.com/security/data/cve/CVE-2026-74549.md) | High | hwmon: (nct6775-core) Prevent access to unsupported weight registers | 7.8 | 0.0013 | | | [CVE-2026-74632](https://patchblox.com/security/data/cve/CVE-2026-74632.md) | High | mm/huge_memory: fix huge_zero_pfn race | 7.8 | 0.0013 | | | [CVE-2026-74663](https://patchblox.com/security/data/cve/CVE-2026-74663.md) | High | net/sched: reject overly deep qdisc hierarchies | 7.8 | 0.0013 | | | [CVE-2026-74666](https://patchblox.com/security/data/cve/CVE-2026-74666.md) | High | packet: synchronize pressure clearing with ring reconfiguration | 7.8 | 0.0013 | | | [CVE-2026-74668](https://patchblox.com/security/data/cve/CVE-2026-74668.md) | High | packet: use consistent hard_header_len in TX_RING send path | 7.8 | 0.0013 | | | [CVE-2026-80737](https://patchblox.com/security/data/cve/CVE-2026-80737.md) | High | serial: amba-pl011: synchronize DMA teardown | 7.8 | 0.0013 | | | [CVE-2026-46158](https://patchblox.com/security/data/cve/CVE-2026-46158.md) | High | mptcp: pm: ADD_ADDR rtx: always decrease sk refcount | 7.0 | 0.0013 | | | [CVE-2026-46170](https://patchblox.com/security/data/cve/CVE-2026-46170.md) | High | mptcp: pm: ADD_ADDR rtx: free sk if last | 7.0 | 0.0013 | | | [CVE-2026-74637](https://patchblox.com/security/data/cve/CVE-2026-74637.md) | High | perf/core: Fix group leader use-after-free after sibling detach | 7.8 | 0.0013 | | | [CVE-2026-64581](https://patchblox.com/security/data/cve/CVE-2026-64581.md) | High | xfrm: fix sk_dst_cache double-free in xfrm_user_policy() | 7.8 | 0.0012 | | | [CVE-2026-74582](https://patchblox.com/security/data/cve/CVE-2026-74582.md) | High | packet: use consistent hard_header_len in non-ring send paths | 9.8 | 0.0012 | | | [CVE-2026-64585](https://patchblox.com/security/data/cve/CVE-2026-64585.md) | High | can: esd_usb: kill anchored URBs before freeing netdevs | 7.8 | 0.0012 | | | [CVE-2026-80569](https://patchblox.com/security/data/cve/CVE-2026-80569.md) | High | Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer | 7.8 | 0.0012 | | | [CVE-2026-53089](https://patchblox.com/security/data/cve/CVE-2026-53089.md) | High | bpf: Fix use-after-free in offloaded map/prog info fill | 7.8 | 0.0012 | | | [CVE-2026-53242](https://patchblox.com/security/data/cve/CVE-2026-53242.md) | High | ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams | 7.8 | 0.0010 | | | [CVE-2024-46754](https://patchblox.com/security/data/cve/CVE-2024-46754.md) | Routine | bpf: Remove tst_run from lwt_seg6local_prog_ops. | 5.5 | 0.0025 | | | [CVE-2026-68277](https://patchblox.com/security/data/cve/CVE-2026-68277.md) | Routine | drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers | 5.5 | 0.0022 | | | [CVE-2026-80814](https://patchblox.com/security/data/cve/CVE-2026-80814.md) | Routine | rndis_host: add overflow check in rndis_rx_fixup() | 6.8 | 0.0020 | | | [CVE-2026-80783](https://patchblox.com/security/data/cve/CVE-2026-80783.md) | Routine | HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event() | 6.6 | 0.0020 | | | [CVE-2026-80829](https://patchblox.com/security/data/cve/CVE-2026-80829.md) | Routine | ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output() | 6.6 | 0.0020 | | | [CVE-2026-80830](https://patchblox.com/security/data/cve/CVE-2026-80830.md) | Routine | usb: core: Add lock to usb_wakeup_notification() | 6.6 | 0.0020 | | | [CVE-2026-80782](https://patchblox.com/security/data/cve/CVE-2026-80782.md) | Routine | HID: magicmouse: do not keep a stale msc->input if no input is claimed | 6.4 | 0.0020 | | | [CVE-2026-80793](https://patchblox.com/security/data/cve/CVE-2026-80793.md) | Routine | ipv4: reject undersized MTUs in ip_do_fragment() | 5.5 | 0.0020 | | | [CVE-2026-80809](https://patchblox.com/security/data/cve/CVE-2026-80809.md) | Routine | ocfs2: fix missing metadata reservation for large xattrs | 5.5 | 0.0020 | | | [CVE-2026-80781](https://patchblox.com/security/data/cve/CVE-2026-80781.md) | Routine | HID: core: fix OOB read of field->usage in hid_set_field() | 5.3 | 0.0020 | | | [CVE-2026-80765](https://patchblox.com/security/data/cve/CVE-2026-80765.md) | Routine | HID: hyperv: validate initial device info bounds | 4.5 | 0.0020 | | | [CVE-2026-80805](https://patchblox.com/security/data/cve/CVE-2026-80805.md) | Routine | xfs: validate attr entry pointer before field access | 4.4 | 0.0020 | | | [CVE-2026-80843](https://patchblox.com/security/data/cve/CVE-2026-80843.md) | Routine | xfrm: fix xfrm_state_construct() auth-trunc leak | 4.4 | 0.0020 | | | [CVE-2026-80827](https://patchblox.com/security/data/cve/CVE-2026-80827.md) | Routine | USB: serial: option: fix slab OOB read in interrupt URB callback | 1.8 | 0.0020 | | | [CVE-2026-80828](https://patchblox.com/security/data/cve/CVE-2026-80828.md) | Routine | ALSA: usb-audio: Complete cleanup after system-resume errors | 4.3 | 0.0019 | | | [CVE-2026-68279](https://patchblox.com/security/data/cve/CVE-2026-68279.md) | Routine | drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers | 5.5 | 0.0018 | | | [CVE-2026-80890](https://patchblox.com/security/data/cve/CVE-2026-80890.md) | Routine | sctp: reject stale cookies with mismatched verification tags | 4.8 | 0.0018 | | | [CVE-2026-80854](https://patchblox.com/security/data/cve/CVE-2026-80854.md) | Routine | usb: gadget: f_tcm: keep port count until LUN teardown completes | 6.4 | 0.0018 | | | [CVE-2026-80855](https://patchblox.com/security/data/cve/CVE-2026-80855.md) | Routine | fuse: fix invalidate lock leak on open O_TRUNC DAX failure | 4.7 | 0.0018 | | | [CVE-2026-80856](https://patchblox.com/security/data/cve/CVE-2026-80856.md) | Routine | fuse: fix invalidate lock leak on setattr writeback failure | 4.7 | 0.0018 | | | [CVE-2026-80918](https://patchblox.com/security/data/cve/CVE-2026-80918.md) | Routine | HID: core: fix number/pointer type confusion on long items | 3.3 | 0.0018 | | | [CVE-2026-80812](https://patchblox.com/security/data/cve/CVE-2026-80812.md) | Routine | ALSA: dummy: Check card index validity at probe | 6.7 | 0.0018 | | | [CVE-2026-68411](https://patchblox.com/security/data/cve/CVE-2026-68411.md) | Routine | wifi: mac80211_hwsim: clamp virtio RX length before skb_put | 6.5 | 0.0018 | | | [CVE-2026-68139](https://patchblox.com/security/data/cve/CVE-2026-68139.md) | Routine | linux: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use sender devcom for MPV master-up... | 5.5 | 0.0018 | | | [CVE-2026-80806](https://patchblox.com/security/data/cve/CVE-2026-80806.md) | Routine | ext4: don't enable DAX on new encrypted files | 5.5 | 0.0017 | | | [CVE-2026-80923](https://patchblox.com/security/data/cve/CVE-2026-80923.md) | Routine | xhci: dbgtty: Fix unregister on tty_register_driver() failure | 6.4 | 0.0017 | | | [CVE-2026-80906](https://patchblox.com/security/data/cve/CVE-2026-80906.md) | Routine | net: packet: fix wrong transport_header when sending VLAN-tagged frame | 4.4 | 0.0017 | | | [CVE-2026-80913](https://patchblox.com/security/data/cve/CVE-2026-80913.md) | Routine | selinux: require every boolean value to be defined | 4.4 | 0.0017 | | | [CVE-2026-80917](https://patchblox.com/security/data/cve/CVE-2026-80917.md) | Routine | PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems | 4.1 | 0.0017 | | | [CVE-2026-52977](https://patchblox.com/security/data/cve/CVE-2026-52977.md) | Routine | futex: Prevent lockup in requeue-PI during signal/ timeout wakeup | 5.5 | 0.0012 | | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.