CVE-2026-31431 취약점 업데이트 (Oracle Linux 인 경우)

[취약점 개요 및 영향도]

1.    취약점 개요

A.     CVE ID : CVE-2026-31431

B.     심각도 : Important (CVSS 7.8 / HIGH)

C.     영향 범위 : Linux Kernel 4.14 이상 (RHEL 8, 9, 10)

D.     취약점 : crypto: algif_aead (커널 암호화 인터페이스)

 

2.    취약점 영향도

A.     커널 암호화 인터페이스(algif_aead)의 연산 오류로 인해, 로컬 사용자가 페이지 캐시 조작을 통해 root 권한을 획득할 수 있는 취약점

B.     로컬 권한 상승(LPE) 취약점으로, 시스템에 일반 사용자 접근 권한이 있어야 악용이 가능

C.   공격 형태: 일반 유저 계정으로 Linux 암호화 API를 악용해 메모리 속 파일을 변조, root 권한을 획득하는 로컬 권한 상승(LPE) 공격

D.   공격 대상: 2017년 이후 출시된 Linux 커널(4.14~)을 사용하는 모든 서버, VM, 컨테이너 환경

 

[조치 안내]

해당 CVE는 아래 커널 버전에서 수정 되었습니다.

• UEK8: 6.12.0-201.74.2.2
• UEK7: 5.15.0-319.201.4.4
• UEK6: 5.4.17-2136.354.4.2
• CVE Errata https://linux.oracle.com/cve/CVE-2026-31431.html
  https://linux.oracle.com/errata/ELSA-2026-50255.html

====================================================

 

- kernel Update 작업 테스트

 

[root@rhel97 ~]# id
uid=0(root) gid=0(root) groups=0(root)

[root@rhel97 ~]# uname -a
Linux rhel97 6.12.0-105.51.5.el9uek.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Oct 14 19:55:41 PDT 2025 x86_64 x86_64 x86_64 GNU/Linux

[root@rhel97 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 9.7 (Plow)


[root@rhel97 ~]# dnf clean all
24 files removed

[root@rhel97 ~]# dnf updateinfo list --cve CVE-2026-31431
Oracle Linux 9 BaseOS Latest (x86_64)                                                                33 MB/s | 122 MB     00:03    
Oracle Linux 9 Application Stream Packages (x86_64)                                                  30 MB/s |  90 MB     00:03    
Oracle Linux 9 UEK Release 8 (x86_64)                                                                19 MB/s |  42 MB     00:02    
Last metadata expiration check: 0:00:04 ago on Wed 20 May 2026 10:46:14 AM KST.
ELSA-2026-13565 Important/Sec. kernel-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-core-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-modules-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-modules-core-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-tools-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-13565 Important/Sec. kernel-tools-libs-5.14.0-611.54.1.el9_7.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-core-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-core-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-core-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-core-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-desktop-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-desktop-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-extra-netfilter-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-usb-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-usb-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-50254 Important/Sec. kernel-uek-modules-wireless-6.12.0-201.74.2.2.el9uek.x86_64
ELSA-2026-50260 Important/Sec. kernel-uek-modules-wireless-6.12.0-202.76.4.1.el9uek.x86_64
ELSA-2026-13565 Important/Sec. python3-perf-5.14.0-611.54.1.el9_7.x86_64
[root@rhel97 ~]# dnf update kernel-uek
Last metadata expiration check: 0:00:47 ago on Wed 20 May 2026 10:46:14 AM KST.
Dependencies resolved.
====================================================================================================================================
 Package                                      Architecture     Version                                    Repository           Size
====================================================================================================================================
Upgrading:
 dracut                                       x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           689 k
 dracut-config-rescue                         x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           8.9 k
 dracut-network                               x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           144 k
 dracut-squash                                x86_64           057-104.git20250919.0.3.el9_7              ol9_UEKR8           8.9 k
Installing group/module packages:
 kernel-uek                                   x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           1.5 M
Installing dependencies:
 kernel-uek-core                              x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            21 M
 kernel-uek-modules                           x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            32 M
 kernel-uek-modules-core                      x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            39 M
 kernel-uek-modules-desktop                   x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8            21 M
 kernel-uek-modules-extra-netfilter           x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           2.4 M
 kernel-uek-modules-usb                       x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           2.5 M
 kernel-uek-modules-wireless                  x86_64           6.12.0-202.76.4.2.el9uek                   ol9_UEKR8           9.5 M

Transaction Summary
====================================================================================================================================
Install  8 Packages
Upgrade  4 Packages

Total download size: 130 M
Is this ok [y/N]: y
Downloading Packages:
(1/12): kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                              4.3 MB/s | 1.5 MB     00:00    
(2/12): kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                          11 MB/s |  21 MB     00:01    
(3/12): kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                       12 MB/s |  32 MB     00:02    
(4/12): kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64.rpm                       11 MB/s | 2.4 MB     00:00    
(5/12): kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64.rpm                               17 MB/s |  21 MB     00:01    
(6/12): kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                   15 MB/s | 2.5 MB     00:00    
(7/12): kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64.rpm                                  13 MB/s |  39 MB     00:02    
(8/12): dracut-057-104.git20250919.0.3.el9_7.x86_64.rpm                                             5.9 MB/s | 689 kB     00:00    
(9/12): dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64.rpm                               250 kB/s | 8.9 kB     00:00    
(10/12): dracut-network-057-104.git20250919.0.3.el9_7.x86_64.rpm                                    2.9 MB/s | 144 kB     00:00    
(11/12): dracut-squash-057-104.git20250919.0.3.el9_7.x86_64.rpm                                     255 kB/s | 8.9 kB     00:00    
(12/12): kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64.rpm                             24 MB/s | 9.5 MB     00:00    
------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                37 MB/s | 130 MB     00:03     
Oracle Linux 9 UEK Release 8 (x86_64)                                                               3.6 MB/s | 6.2 kB     00:00    
Importing GPG key 0x8D8B756F:
 Userid     : "Oracle Linux (release key 1) <secalert_us@oracle.com>"
 Fingerprint: 3E6D 826D 3FBA B389 C2F3 8E34 BC4D 06A0 8D8B 756F
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
Is this ok [y/N]: y
Key imported successfully
Importing GPG key 0x8B4EFBE6:
 Userid     : "Oracle Linux (backup key 1) <secalert_us@oracle.com>"
 Fingerprint: 9822 3175 9C74 6706 5D0C E9B2 A7DD 0708 8B4E FBE6
 From       : /etc/pki/rpm-gpg/RPM-GPG-KEY-oracle
Is this ok [y/N]: y
Key imported successfully
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                            1/1 
  Upgrading        : dracut-057-104.git20250919.0.3.el9_7.x86_64                                                               1/16 
  Installing       : kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                   2/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Installing       : kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           3/16 
  Installing       : kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        4/16 
  Running scriptlet: kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        4/16 
  Installing       : kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Running scriptlet: kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Installing       : kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Running scriptlet: kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Installing       : kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Running scriptlet: kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Installing       : kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Running scriptlet: kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Installing       : kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                                                                9/16 
  Upgrading        : dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64                                                10/16 
  Upgrading        : dracut-network-057-104.git20250919.0.3.el9_7.x86_64                                                      11/16 
  Upgrading        : dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                                                       12/16 
  Cleanup          : dracut-squash-057-102.git20250818.0.1.el9.x86_64                                                         13/16 
  Cleanup          : dracut-network-057-102.git20250818.0.1.el9.x86_64                                                        14/16 
  Cleanup          : dracut-config-rescue-057-102.git20250818.0.1.el9.x86_64                                                  15/16 
  Cleanup          : dracut-057-102.git20250818.0.1.el9.x86_64                                                                16/16 
  Running scriptlet: kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                  16/16 
  Running scriptlet: kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                          16/16 
  Running scriptlet: kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                       16/16 
  Running scriptlet: dracut-057-102.git20250818.0.1.el9.x86_64                                                                16/16 
  Verifying        : kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                                                                1/16 
  Verifying        : kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                                                           2/16 
  Verifying        : kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64                                                        3/16 
  Verifying        : kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64                                                   4/16 
  Verifying        : kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64                                                5/16 
  Verifying        : kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64                                        6/16 
  Verifying        : kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64                                                    7/16 
  Verifying        : kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64                                               8/16 
  Verifying        : dracut-057-104.git20250919.0.3.el9_7.x86_64                                                               9/16 
  Verifying        : dracut-057-102.git20250818.0.1.el9.x86_64                                                                10/16 
  Verifying        : dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64                                                11/16 
  Verifying        : dracut-config-rescue-057-102.git20250818.0.1.el9.x86_64                                                  12/16 
  Verifying        : dracut-network-057-104.git20250919.0.3.el9_7.x86_64                                                      13/16 
  Verifying        : dracut-network-057-102.git20250818.0.1.el9.x86_64                                                        14/16 
  Verifying        : dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                                                       15/16 
  Verifying        : dracut-squash-057-102.git20250818.0.1.el9.x86_64                                                         16/16 

Upgraded:
  dracut-057-104.git20250919.0.3.el9_7.x86_64                   dracut-config-rescue-057-104.git20250919.0.3.el9_7.x86_64          
  dracut-network-057-104.git20250919.0.3.el9_7.x86_64           dracut-squash-057-104.git20250919.0.3.el9_7.x86_64                 
Installed:
  kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64                   kernel-uek-core-6.12.0-202.76.4.2.el9uek.x86_64                     
  kernel-uek-modules-6.12.0-202.76.4.2.el9uek.x86_64           kernel-uek-modules-core-6.12.0-202.76.4.2.el9uek.x86_64             
  kernel-uek-modules-desktop-6.12.0-202.76.4.2.el9uek.x86_64   kernel-uek-modules-extra-netfilter-6.12.0-202.76.4.2.el9uek.x86_64  
  kernel-uek-modules-usb-6.12.0-202.76.4.2.el9uek.x86_64       kernel-uek-modules-wireless-6.12.0-202.76.4.2.el9uek.x86_64         

Complete!

[root@rhel97 ~]# reboot

[root@rhel97 ~]# uname -r
6.12.0-202.76.4.2.el9uek.x86_64

[root@rhel97 ~]# rpm -q kernel-uek
kernel-uek-6.12.0-105.51.5.el9uek.x86_64
kernel-uek-6.12.0-202.76.4.2.el9uek.x86_64