Installing Kernel Updates on Exadata Database Servers

8.5.13 Installing Kernel Updates on Exadata Database Servers

You can perform online Oracle Linux kernel updates on Oracle Exadata database servers to address critical vulnerabilities.

Note:

Use this procedure to fix Oracle Linux kernel Common Vulnerabilities and Exposures (CVEs) that are not already addressed in an Oracle Exadata System Software update. Otherwise, whenever possible, use Exadata Live Update to apply the latest Exadata security updates while maximizing system availability.

Qualified Ksplice updates that address Common Vulnerabilities and Exposures (CVEs) are available for the Oracle Linux kernel on Oracle Exadata database servers. Ksplice Uptrack enables you to apply the latest security errata for CVEs without halting the system or restarting applications.

Exadata supports Ksplice Uptrack only in offline mode through the uptrack-offline package, which is included with Oracle Exadata System Software. Ksplice updates are supported only for the Oracle Linux kernel, not for user-space packages. Exadata does not use the Ksplice Enhanced Client.

Using Ksplice Uptrack in offline mode enables Ksplice updates to be received and applied to Exadata database servers without requiring the servers to connect directly to Unbreakable Linux Network (ULN). All available Ksplice updates for each supported kernel version are delivered through the uptrack-updates package, which is specific to that kernel version. The package is updated whenever a new set of Ksplice updates becomes available for the kernel.

To determine whether Ksplice updates are available for your system and kernel version, visit https://ksplice.oracle.com/inspector and enter the requested information.

Use the following procedure to install a Ksplice kernel update:

Get the Ksplice update

Ksplice updates are delivered through the uptrack-updates package. There are two ways to get the package:
- Mirror the channel containing Ksplice updates to a local repository.
  
  The channel name is ol8_x86_64_ksplice. See Using Software Distribution Mirrors in Managing Software in Oracle Linux.
- Download the uptrack-updates package from ULN.
  
  Download the specific package version that matches your Oracle Linux kernel version as follows:
  1. On the target system, run uname -r to determine the kernel version.
    
    For example:
```
# uname -r
5.15.0-318.199.3.6.el8uek.x86_64
```
  2. Log on to ULN at https://linux.oracle.com/.
  3. Navigate to Channels.
  4. In the Find a Channel search interface:
    - Enter Ksplice in the search field.
    - Select the appropriate release from the drop-down list of Oracle Linux releases. For example, Oracle Linux 8.
    - Select x86_64 from the drop-down list of platform architectures.
    Then, click View Channels.
  5. In the resulting list, click the link matching Ksplice for <Oracle Linux Release> (x86_64). For example, Ksplice for Oracle Linux 8 (x86_64).
  6. In the Find a Package search interface, enter the Oracle Linux kernel version in the search field.
    
    From the output of the uname -r command, enter only the numbers that precede the release and architecture details. For example, 5.15.0-318.199.3.6.
    
    Then, click Search Packages.
  7. Click the link for your kernel-specific uptrack-updates package. For example, uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.
  8. Finally, in the package details page, click Download.
Optionally, review the contents of the uptrack-updates package.

If you downloaded the uptrack-updates package, you can query the package and check the change log by running rpm -q -p </path/to/uptrack-updates-package-downloaded.rpm> --changelog.

For example:
```
# rpm -q -p ./uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.rpm --changelog
* Mon Jun 22 2026 Ksplice <email> 20260622-0
- [kjs1dll6] CVE-2026-<nnnnn>: <summary> [Orabug: <xxxxxxxx>]
...
```
Remove the relevant exadata-*-computenode-exact RPM from your system.

To install the uptrack-updates package you must first remove the relevant exadata-*-computenode-exact RPM from your system. Removing the RPM does not impact any functionality, but it removes a logical lock allowing you to update specific individual Linux RPMs. The relevant RPM depends on your system configuration:
- exadata-ib-computenode-exact: Bare-metal system with InfiniBand Network Fabric.
- exadata-sun-computenode-exact: Bare-metal system or KVM host with RoCE Network Fabric.
- exadata-sun-kvm-computenode-exact: Virtual machine (VM) guests on Oracle Linux KVM.
- exadata-sun-ovs-computenode-exact: Oracle VM Server (OVS) management domain (Dom0).
- exadata-sun-vm-computenode-exact: Oracle VM Server (OVS) user domain (DomU).
For example, to remove the RPM from a KVM guest, run:
```
[root@dm01]# rpm -e exadata-sun-kvm-computenode-exact
```
Note:
- Do not use yum or dnf, as these commands may also remove other RPMs in the dependency chain.
- When updating to a new Oracle Exadata System Software release, the patchmgr update utility attempts to restore the relevant exadata-*-computenode-exact package. If the exadata-*-computenode-exact RPM cannot be restored, the update utility falls back to using the exadata-*-computenode-minimum RPM.

Install the uptrack-updates package.

If you downloaded the uptrack-updates package, you can install the package by running yum install </path/to/uptrack-updates-package-downloaded.rpm>.

For example:

# yum install ./uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.rpm
Dependencies resolved.
================================================================================
 Package                                   Arch   Version    Repository    Size
================================================================================
Installing:
 uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64
                                           noarch 20260622-0 @commandline  51 M

Transaction Summary
================================================================================
Install  1 Package

Total size: 51 M
Installed size: 53 M
Is this ok [y/N]: y
...

If you are using a software distribution mirror, you can install the package by running yum install uptrack-updates-$(uname -r).

Apply the uptrack-updates package.

Regardless of how you install the uptrack-updates package, you must also run uptrack-upgrade to apply the kernel changes.

For example:
```
# uptrack-upgrade
The following steps will be taken:
Install [lfawlrvw] Enablement update for live patching.
Install [78bkrl8h] Known exploit detection.
Install [iouv9fm4] Known exploit detection for CVE-2019-<nnnn>.
...
```
Note:
- Installing and applying the uptrack-updates package does not interrupt the system availability and does not require a reboot.
- The kernel updates load automatically whenever the system is rebooted. There is no need to re-install or re-apply them when the system reboots.
- You can update a system that has Ksplice updates installed to a later Exadata software version by using normal update procedures. After the update, the kernel version will likely change, and you may need an additional uptrack-updates package to obtain Ksplice updates for the new kernel. The uptrack-updates package installed before the Exadata software update remains installed, but is no longer needed because it applies only to the earlier kernel version.
- If an uptrack-updates package is currently installed, you can update it to a later uptrack-updates package for the same kernel version by using the same yum install command used for the earlier installation.
Optionally, verify the update status.

You can use the uptrack-show command to list Ksplice updates applied to the system and to display the effective kernel version.

For example:
```
# uptrack-show
Installed updates:
[lfawlrvw] Enablement update for live patching.
[78bkrl8h] Known exploit detection.
[iouv9fm4] Known exploit detection for CVE-2019-<nnnn>.
...
Effective kernel version is 5.15.0-321.202.5.2.el8uek
```
You can also use uptrack-show --available to view available updates, which are updates delivered in the uptrack-updates package but not applied to the system.

If all updates are successfully applied, then the output shows no available updates.

For example:
```
# uptrack-show --available
Available updates:
None

Effective kernel version is 5.15.0-321.202.5.2.el8uek
```
If fixes are still listed as available after you apply updates by using the uptrack-upgrade command, an issue prevented the fixes from loading. The most common reason Ksplice fixes fail to load is that one or more kernel modules loaded by a third-party product have modified the kernel in a way that conflicts with an incoming Ksplice fix.

Use the following commands to show loaded proprietary and externally built kernel modules:
```
# grep -l P /sys/module/*/taint | cut -f4 -d/ | egrep -v 'oracle(acfs|advm|oks|edv)'
# grep -l O /sys/module/*/taint | cut -f4 -d/ | egrep -v 'oracle(acfs|advm|oks|edv)|ksplice'
```
If the output shows that third-party kernel modules are loaded, unload the modules, and then run the following command:
```
# uptrack-install --all -y
```
After all Ksplice fixes are installed, reload the third-party kernel modules that were unloaded. Refer to the third-party product documentation for instructions to unload and reload proprietary or externally built kernel modules.

Parent topic: Updating Oracle Exadata Database Servers