Linux · Oracle Linux · Security advisory · January 12, 2026

ELSA-2026-0453: Security update for 30 packages

ELSA-2026-0453, released January 12, 2026, fixes 9 CVEs across 30 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.0064
51st percentile

Priority of the 9 CVEs

Patch now 0 Urgent 0 High 9 Routine 0

Fixed package versions

ProductReleaseFixed in
kernelol 100:6.12.0-124.27.1.el10_1
kernel-abi-stablelistsol 100:6.12.0-124.27.1.el10_1
kernel-coreol 100:6.12.0-124.27.1.el10_1
kernel-cross-headersol 100:6.12.0-124.27.1.el10_1
kernel-debugol 100:6.12.0-124.27.1.el10_1
kernel-debug-coreol 100:6.12.0-124.27.1.el10_1
kernel-debug-develol 100:6.12.0-124.27.1.el10_1
kernel-debug-devel-matchedol 100:6.12.0-124.27.1.el10_1
kernel-debug-modulesol 100:6.12.0-124.27.1.el10_1
kernel-debug-modules-coreol 100:6.12.0-124.27.1.el10_1
kernel-debug-modules-extraol 100:6.12.0-124.27.1.el10_1
kernel-debug-uki-virtol 100:6.12.0-124.27.1.el10_1
kernel-develol 100:6.12.0-124.27.1.el10_1
kernel-devel-matchedol 100:6.12.0-124.27.1.el10_1
kernel-docol 100:6.12.0-124.27.1.el10_1
kernel-headersol 100:6.12.0-124.27.1.el10_1
kernel-modulesol 100:6.12.0-124.27.1.el10_1
kernel-modules-coreol 100:6.12.0-124.27.1.el10_1
kernel-modules-extraol 100:6.12.0-124.27.1.el10_1
kernel-modules-extra-matchedol 100:6.12.0-124.27.1.el10_1
kernel-toolsol 100:6.12.0-124.27.1.el10_1
kernel-tools-libsol 100:6.12.0-124.27.1.el10_1
kernel-tools-libs-develol 100:6.12.0-124.27.1.el10_1
kernel-uki-virtol 100:6.12.0-124.27.1.el10_1
kernel-uki-virt-addonsol 100:6.12.0-124.27.1.el10_1
libperfol 100:6.12.0-124.27.1.el10_1
perfol 100:6.12.0-124.27.1.el10_1
python3-perfol 100:6.12.0-124.27.1.el10_1
rtlaol 100:6.12.0-124.27.1.el10_1
rvol 100:6.12.0-124.27.1.el10_1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-40240 sctp: avoid NULL dereference when chunk data buffer is missing8.6 0.0064 None reported
High CVE-2025-40176 tls: wait for pending async decryptions if tls_strp_msg_hold fails9.8 0.0049 None reported
High CVE-2025-40277 drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE7.8 0.0025 None reported
High CVE-2025-39806 kernel-64k-core: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: H...7.8 0.0024 None reported
High CVE-2025-68287 usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths7.8 0.0023 None reported
High CVE-2025-39840 libperf: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: H...7.8 0.0015 None reported
High CVE-2025-39843 mm: slub: avoid wake up kswapd in set_track_prepare7.8 0.0012 None reported
High CVE-2025-39966 kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: c...7.8 0.0011 None reported
High CVE-2025-39905 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver7.8 0.0011 None reported
Showing 1 to 9 of 9 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.