8.6.9 Installing Kernel Updates on Oracle Exadata Storage Servers

You can perform online Oracle Linux kernel updates on Exadata storage servers to address critical vulnerabilities.

Note:

Use this procedure to update the Oracle Linux kernel on Exadata storage servers only in the following circumstances:

  1. To address a critical known security vulnerability with a Common Vulnerability Scoring System (CVSS) score of 9 or greater, and only when the update is not available in a regular Oracle Exadata System Software update. If the updated package is available in an Oracle Exadata System Software update, then you must apply the Exadata update.

  2. To address a Service Request (SR), but only with the express direction and approval of Oracle Support Services.

Qualified Ksplice updates that address Common Vulnerabilities and Exposures (CVEs) are available for the Oracle Linux kernel on Exadata storage servers. Ksplice Uptrack enables you to apply the latest security errata for CVEs without halting the system or restarting applications.

Exadata supports Ksplice Uptrack only in offline mode through the uptrack-offline package, which is included with Oracle Exadata System Software. Ksplice updates are supported only for the Oracle Linux kernel, not for user-space packages. Exadata does not use the Ksplice Enhanced Client.

Using Ksplice Uptrack in offline mode enables Ksplice updates to be received and applied to Exadata storage servers without requiring the servers to connect directly to Unbreakable Linux Network (ULN). All available Ksplice updates for each supported kernel version are delivered through the uptrack-updates package, which is specific to that kernel version. The package is updated whenever a new set of Ksplice updates becomes available for the kernel.

To determine whether Ksplice updates are available for your system and kernel version, visit https://ksplice.oracle.com/inspector and enter the requested information.

Use the following procedure to install a Ksplice kernel update:

  1. Get the Ksplice update

    Ksplice updates are delivered through the uptrack-updates package. There are two ways to get the package:

    • Mirror the channel containing Ksplice updates to a local repository.

      The channel name is ol8_x86_64_ksplice. See Using Software Distribution Mirrors in Managing Software in Oracle Linux.

    • Download the uptrack-updates package from ULN.

      Download the specific package version that matches your Oracle Linux kernel version as follows:

      1. On the target system, run uname -r to determine the kernel version.

        For example:

        # uname -r
5.15.0-318.199.3.6.el8uek.x86_64

      2. Log on to ULN at https://linux.oracle.com/.

      3. Navigate to Channels.

      4. In the Find a Channel search interface:

        • Enter Ksplice in the search field.

        • Select the appropriate release from the drop-down list of Oracle Linux releases. For example, Oracle Linux 8.

        • Select x86_64 from the drop-down list of platform architectures.

        Then, click View Channels.

      5. In the resulting list, click the link matching Ksplice for <Oracle Linux Release> (x86_64). For example, Ksplice for Oracle Linux 8 (x86_64).

      6. In the Find a Package search interface, enter the Oracle Linux kernel version in the search field.

        From the output of the uname -r command, enter only the numbers that precede the release and architecture details. For example, 5.15.0-318.199.3.6.

        Then, click Search Packages.

      7. Click the link for your kernel-specific uptrack-updates package. For example, uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.

      8. Finally, in the package details page, click Download.

  2. Optionally, review the contents of the uptrack-updates package.

    If you downloaded the uptrack-updates package, you can query the package and check the change log by running rpm -q -p </path/to/uptrack-updates-package-downloaded.rpm> --changelog.

    For example:

    # rpm -q -p ./uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.rpm --changelog
* Mon Jun 22 2026 Ksplice <email> 20260622-0
- [kjs1dll6] CVE-2026-<nnnnn>: <summary> [Orabug: <xxxxxxxx>]
...

  3. Install the uptrack-updates package.

    If you downloaded the uptrack-updates package, you can install the package by running yum install </path/to/uptrack-updates-package-downloaded.rpm>.

    For example:

    # yum install ./uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64-20260622-0.noarch.rpm
Dependencies resolved.
================================================================================
 Package                                   Arch   Version    Repository    Size
================================================================================
Installing:
 uptrack-updates-5.15.0-318.199.3.6.el8uek.x86_64
                                           noarch 20260622-0 @commandline  51 M

Transaction Summary
================================================================================
Install  1 Package

Total size: 51 M
Installed size: 53 M
Is this ok [y/N]: y
...

    If you are using a software distribution mirror, you can install the package by running yum install uptrack-updates-$(uname -r).

  4. Apply the uptrack-updates package.

    Regardless of how you install the uptrack-updates package, you must also run uptrack-upgrade to apply the kernel changes.

    For example:

    # uptrack-upgrade
The following steps will be taken:
Install [lfawlrvw] Enablement update for live patching.
Install [78bkrl8h] Known exploit detection.
Install [iouv9fm4] Known exploit detection for CVE-2019-<nnnn>.
...

    Note:

    • Installing and applying the uptrack-updates package does not interrupt the system availability and does not require a reboot.

    • The kernel updates load automatically whenever the system is rebooted. There is no need to re-install or re-apply them when the system reboots.

    • You can update a system that has Ksplice updates installed to a later Exadata software version by using normal update procedures. After the update, the kernel version will likely change, and you may need an additional uptrack-updates package to obtain Ksplice updates for the new kernel. The uptrack-updates package installed before the Exadata software update remains installed, but is no longer needed because it applies only to the earlier kernel version.

    • If an uptrack-updates package is currently installed, you can update it to a later uptrack-updates package for the same kernel version by using the same yum install command used for the earlier installation.

  5. Optionally, verify the update status.

    You can use the uptrack-show command to list Ksplice updates applied to the system and to display the effective kernel version.

    For example:

    # uptrack-show
Installed updates:
[lfawlrvw] Enablement update for live patching.
[78bkrl8h] Known exploit detection.
[iouv9fm4] Known exploit detection for CVE-2019-<nnnn>.
...
Effective kernel version is 5.15.0-321.202.5.2.el8uek

    You can also use uptrack-show --available to view available updates, which are updates delivered in the uptrack-updates package but not applied to the system.

    If all updates are successfully applied, then the output shows no available updates.

    For example:

    # uptrack-show --available
Available updates:
None

Effective kernel version is 5.15.0-321.202.5.2.el8uek

    If fixes are still listed as available after you apply updates by using the uptrack-upgrade command, an issue prevented the fixes from loading. Contact Oracle Support Services for assistance.

Parent topic: Updating Software on Oracle Exadata Storage Servers