Oracle Linux Kernel USN-8879-1 Update: Null Pointer Dereference and Privilege Escalation CVEs

Vulnerability Overview Vulnerability ID: USN-8879-1 Publication Date: October 6, 2026 Description: - The LMX clock driver fails to properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker may exploit this vulnerability to cause a system crash (denial of service). - Certain ARM processors may complete broadcast Translation Lookaside Buffer (TLB) invalidation prior to memory write, making the invalidation visible globally. A local attacker may exploit this vulnerability to write to memory even after permissions have been revoked, thereby bypassing memory protections or escalating privileges. Affected Systems Affected System: Linux Kernel (Oracle) Specific Versions: - 20.04 LTS (focal) - linux-image-5.15.0-1114-oracle – 5.15.0.1114.120–20.04.1 - linux-image-oracle – 5.15.0.1114.120–20.04.1 - linux-image-oracle-5.15 – 5.15.0.1114.120–20.04.1 Remediation Update Instructions: - A system restart is required after standard system updates to apply all necessary changes. - Due to unavoidable ABI changes, kernel updates have been assigned new version numbers, requiring recompilation and reinstallation of all installed third-party kernel modules. Unless the standard kernel meta-packages (such as linux-generic, linux-generic-lts-release, linux-virtual, linux-powerpc) are manually uninstalled, standard system upgrades will perform this action automatically. - Resolve the issue by updating the system to the following package versions: - 20.04 LTS (focal) - linux-image-5.15.0-1114-oracle – 5.15.0.1114.120–20.04.1 - linux-image-oracle – 5.15.0.1114.120–20.04.1 - linux-image-oracle-5.15 – 5.15.0.1114.120–20.04.1 References CVE-2026-89774 CVE-2026-89902 CVE-2026-89890 CVE-2026-89886 CVE-2026-89881 CVE-2026-89880 CVE-2026-89879 CVE-2026-89877 CVE-2026-89876 CVE-2026-89875 Related Notices USN-8906-1 USN-8905-1 USN-8904-1 USN-8903-1 USN-8889-1 USN-8888-1 USN-8888-2 USN-8887-1 USN-8887-2 USN-8886-1 Additional Information Reducing Security Exposure: Ubuntu Pro offers ten years of security coverage for packages in the main and universe repositories (over 25,000 packages), available for free on up to five machines. Summary This vulnerability involves multiple security issues within the Linux kernel, including null pointer dereferences and memory protection bypasses. The affected systems are primarily Linux kernel versions running on Oracle Cloud infrastructure. The remediation involves updating the system to the specified versions and potentially recompiling and installing third-party kernel modules.

Goal Reached Thanks to every supporter — we hit 100%!

Oracle Linux Kernel USN-8879-1 Update: Null Pointer Dereference and Privilege Escalation CVEs