Homepage

CVE-2025-68183 Affecting kernel-uek-doc package, versions <0:6.12.0-107.59.3.2.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.03% (7th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKDOC-15007699
  • published16 Jan 2026
  • disclosed16 Dec 2025
Report a new vulnerability Found a mistake?

Introduced: 16 Dec 2025

CVE-2025-68183  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-doc to version 0:6.12.0-107.59.3.2.el9uek or higher.
This issue was patched in ELSA-2026-50006.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-doc package and not the kernel-uek-doc package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr

Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file.

For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated,

# getfattr -m - -d -e hex /usr/bin/bash
# file: usr/bin/bash
security.ima=0x0404...

This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed.

Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL.

Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset.

Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL,

#include &lt;stdio.h&gt;
#include &lt;sys/xattr.h&gt;
#include &lt;fcntl.h&gt;
#include &lt;unistd.h&gt;
#include &lt;string.h&gt;
#include &lt;stdlib.h&gt;


int main() {
    const char* file_path = &#34;/usr/sbin/test_binary&#34;;
    const char* hex_string = &#34;030204d33204490066306402304&#34;;
    int length = strlen(hex_string);
    char* ima_attr_value;
    int fd;


fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644);
if (fd == -1) {
    perror(&amp;#34;Error opening file&amp;#34;);
    return 1;
}

ima_attr_value = (char*)malloc(length / 2 );
for (int i = 0, j = 0; i &amp;lt; length; i += 2, j++) {
    sscanf(hex_string + i, &amp;#34;%2hhx&amp;#34;, &amp;amp;ima_attr_value[j]);
}

if (fsetxattr(fd, &amp;#34;security.ima&amp;#34;, ima_attr_value, length/2, 0) == -1) {
    perror(&amp;#34;Error setting extended attribute&amp;#34;);
    close(fd);
    return 1;
}

const char* selinux_value= &amp;#34;system_u:object_r:bin_t:s0&amp;#34;;
if (fsetxattr(fd, &amp;#34;security.selinux&amp;#34;, selinux_value, strlen(selinux_value), 0) == -1) {
    perror(&amp;#34;Error setting extended attribute&amp;#34;);
    close(fd);
    return 1;
}

close(fd);

return 0;



}

CVSS Base Scores

version 3.1