RHSA-2026:67935

Vulnerability from csaf_redhat - Published: 2026-09-24 11:01 - Updated: 2026-09-30 23:35
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.16.71 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.16.71 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.16.71. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:67934 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ Security Fix(es): * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-11822

A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-11824

A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-191 - Integer Underflow (Wrap or Wraparound)
Affected products
Fixed 4 products, the same list as for CVE-2026-11822
Threats
Impact Important
CVE-2026-14164

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-415 - Double Free
Affected products
Fixed 4 products, the same list as for CVE-2026-11822
Threats
Impact Moderate
CVE-2026-16313

A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.

7.6 (High)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
Affected products
Fixed 4 products, the same list as for CVE-2026-11822
Threats
Impact Important
CVE-2026-46323

A flaw was found in the Linux kernel's Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-123 - Write-what-where Condition
Affected products
Fixed 4 products, the same list as for CVE-2026-11822
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:67935 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2479832 external
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://bugzilla.redhat.com/show_bug.cgi?id=2493411 external
https://bugzilla.redhat.com/show_bug.cgi?id=2502845 external
https://issues.redhat.com/browse/OCPBUGS-67206 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-11822 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487258 external
https://www.cve.org/CVERecord?id=CVE-2026-11822 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11822 external
https://sqlite.org/releaselog/3_53_2.html external
https://sqlite.org/src/info/061febcf41ca external
https://sqlite.org/src/info/4a5ad516ea93 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-11824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2487269 external
https://www.cve.org/CVERecord?id=CVE-2026-11824 external
https://nvd.nist.gov/vuln/detail/CVE-2026-11824 external
https://www.vulncheck.com/advisories/sqlite-befor… external
https://access.redhat.com/security/cve/CVE-2026-14164 self
https://bugzilla.redhat.com/show_bug.cgi?id=2493411 external
https://www.cve.org/CVERecord?id=CVE-2026-14164 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14164 external
https://github.com/libarchive/libarchive/issues/3069 external
https://github.com/libarchive/libarchive/pull/3071 external
https://access.redhat.com/security/cve/CVE-2026-16313 self
https://bugzilla.redhat.com/show_bug.cgi?id=2502845 external
https://www.cve.org/CVERecord?id=CVE-2026-16313 external
https://nvd.nist.gov/vuln/detail/CVE-2026-16313 external
https://github.com/doug-gilbert/sg3_utils/pull/83 external
https://access.redhat.com/security/cve/CVE-2026-46323 self
https://bugzilla.redhat.com/show_bug.cgi?id=2479832 external
https://www.cve.org/CVERecord?id=CVE-2026-46323 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46323 external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://git.kernel.org/pub/scm/linux/kernel/git/s… external
https://lore.kernel.org/netdev/4d583fc5401298453d… external
https://lore.kernel.org/netdev/agVpIsaSherjHTYg@s… external
Acknowledgments
Shaomin Chen
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.16.71 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.16.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.16.71. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:67934\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)\n* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)\n* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:67935",
        "url": "https://access.redhat.com/errata/RHSA-2026:67935"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2479832",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
      },
      {
        "category": "external",
        "summary": "2487258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
      },
      {
        "category": "external",
        "summary": "2487269",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
      },
      {
        "category": "external",
        "summary": "2493411",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
      },
      {
        "category": "external",
        "summary": "2502845",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
      },
      {
        "category": "external",
        "summary": "OCPBUGS-67206",
        "url": "https://issues.redhat.com/browse/OCPBUGS-67206"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67935.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.16.71 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-09-30T23:35:35+00:00",
      "generator": {
        "date": "2026-09-30T23:35:35+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.0"
        }
      },
      "id": "RHSA-2026:67935",
      "initial_release_date": "2026-09-24T11:01:55+00:00",
      "revision_history": [
        {
          "date": "2026-09-24T11:01:55+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-24T11:01:55+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-30T23:35:35+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.16",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.16",
                  "product_id": "9Base-RHOSE-4.16",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.16::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-416.94.202609140240-0",
                "product": {
                  "name": "rhcos-aarch64-416.94.202609140240-0",
                  "product_id": "rhcos-aarch64-416.94.202609140240-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609140240?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-416.94.202609140240-0",
                "product": {
                  "name": "rhcos-ppc64le-416.94.202609140240-0",
                  "product_id": "rhcos-ppc64le-416.94.202609140240-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609140240?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-416.94.202609140240-0",
                "product": {
                  "name": "rhcos-s390x-416.94.202609140240-0",
                  "product_id": "rhcos-s390x-416.94.202609140240-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609140240?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-416.94.202609140240-0",
                "product": {
                  "name": "rhcos-x86_64-416.94.202609140240-0",
                  "product_id": "rhcos-x86_64-416.94.202609140240-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@416.94.202609140240?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-416.94.202609140240-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0"
        },
        "product_reference": "rhcos-aarch64-416.94.202609140240-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-416.94.202609140240-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0"
        },
        "product_reference": "rhcos-ppc64le-416.94.202609140240-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-416.94.202609140240-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0"
        },
        "product_reference": "rhcos-s390x-416.94.202609140240-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-416.94.202609140240-0 as a component of Red Hat OpenShift Container Platform 4.16",
          "product_id": "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        },
        "product_reference": "rhcos-x86_64-416.94.202609140240-0",
        "relates_to_product_reference": "9Base-RHOSE-4.16"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11822",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-06-09T20:01:15.006955+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
        }
      ],
      "release_date": "2026-06-09T19:08:31.019000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T11:01:55+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:e8d2a7b9f0565993f40582cdd56c27672720917d577da9b557ab11a554a71824\n\n      (For s390x architecture)\n      The image digest is sha256:ee3eedf869e038de1cf4875f01ea4d62551a7be850fd796af1828d925d1029e2\n\n      (For ppc64le architecture)\n      The image digest is sha256:b2d122c178ca0783c1477519ebacbfd745de5a63d3f19a8593132307b3b5a649\n\n      (For aarch64 architecture)\n      The image digest is sha256:bf9e95ecba75dc376153b32f6278389d2eab173ac661b47f09241ef3af7d8c31\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67935"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
    },
    {
      "cve": "CVE-2026-11824",
      "cwe": {
        "id": "CWE-191",
        "name": "Integer Underflow (Wrap or Wraparound)"
      },
      "discovery_date": "2026-06-09T20:02:19.874232+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2487269"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2487269",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/releaselog/3_53_2.html",
          "url": "https://sqlite.org/releaselog/3_53_2.html"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/061febcf41ca",
          "url": "https://sqlite.org/src/info/061febcf41ca"
        },
        {
          "category": "external",
          "summary": "https://sqlite.org/src/info/4a5ad516ea93",
          "url": "https://sqlite.org/src/info/4a5ad516ea93"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
          "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
        }
      ],
      "release_date": "2026-06-09T19:21:42.603000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T11:01:55+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:e8d2a7b9f0565993f40582cdd56c27672720917d577da9b557ab11a554a71824\n\n      (For s390x architecture)\n      The image digest is sha256:ee3eedf869e038de1cf4875f01ea4d62551a7be850fd796af1828d925d1029e2\n\n      (For ppc64le architecture)\n      The image digest is sha256:b2d122c178ca0783c1477519ebacbfd745de5a63d3f19a8593132307b3b5a649\n\n      (For aarch64 architecture)\n      The image digest is sha256:bf9e95ecba75dc376153b32f6278389d2eab173ac661b47f09241ef3af7d8c31\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67935"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
    },
    {
      "cve": "CVE-2026-14164",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-06-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2493411"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2493411",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/issues/3069",
          "url": "https://github.com/libarchive/libarchive/issues/3069"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/3071",
          "url": "https://github.com/libarchive/libarchive/pull/3071"
        }
      ],
      "release_date": "2026-05-24T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T11:01:55+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:e8d2a7b9f0565993f40582cdd56c27672720917d577da9b557ab11a554a71824\n\n      (For s390x architecture)\n      The image digest is sha256:ee3eedf869e038de1cf4875f01ea4d62551a7be850fd796af1828d925d1029e2\n\n      (For ppc64le architecture)\n      The image digest is sha256:b2d122c178ca0783c1477519ebacbfd745de5a63d3f19a8593132307b3b5a649\n\n      (For aarch64 architecture)\n      The image digest is sha256:bf9e95ecba75dc376153b32f6278389d2eab173ac661b47f09241ef3af7d8c31\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67935"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Shaomin Chen"
          ],
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2026-16313",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
      },
      "discovery_date": "2026-06-01T18:13:24+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2502845"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "sg3_utils versions 1.34 through 1.48 contain a command injection flaw in the export_dev_ids() function of sg_inq. When sg_inq --export processes SCSI device identification data from VPD page 0x83, the SCSI name string designator (type 8) and the ATA vendor-ID subfield are printed without sanitizing embedded control characters. A crafted SCSI/USB device can embed a newline in this field, splitting sg_inq\u0027s udev KEY=VALUE output into two lines and injecting an arbitrary udev property, including REMOVE_CMD. On systems whose default udev rules invoke sg_inq --export for SCSI device identification and act on REMOVE_CMD when a device is removed, this allows a local attacker with physical access to a USB/SCSI port to achieve arbitrary command execution as root simply by disconnecting the crafted device.\n\nExploitation requires physical access to attach the malicious device, consistent with Red Hat\u0027s Physical (AV:P) attack vector scoring. The upstream fix (udev-conforming character escaping for this field) has not yet been included in any tagged sg3_utils release; all Red Hat-shipped versions of sg3_utils in the 1.34-1.48 range are affected.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "RHBZ#2502845",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502845"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-16313",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16313"
        },
        {
          "category": "external",
          "summary": "https://github.com/doug-gilbert/sg3_utils/pull/83",
          "url": "https://github.com/doug-gilbert/sg3_utils/pull/83"
        }
      ],
      "release_date": "2026-06-01T18:13:24+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T11:01:55+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:e8d2a7b9f0565993f40582cdd56c27672720917d577da9b557ab11a554a71824\n\n      (For s390x architecture)\n      The image digest is sha256:ee3eedf869e038de1cf4875f01ea4d62551a7be850fd796af1828d925d1029e2\n\n      (For ppc64le architecture)\n      The image digest is sha256:b2d122c178ca0783c1477519ebacbfd745de5a63d3f19a8593132307b3b5a649\n\n      (For aarch64 architecture)\n      The image digest is sha256:bf9e95ecba75dc376153b32f6278389d2eab173ac661b47f09241ef3af7d8c31\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67935"
        },
        {
          "category": "workaround",
          "details": "Remove or comment out the REMOVE_CMD rule from 50-udev-default.rules to prevent command execution on device removal. Alternatively, if automatic SCSI device identification is not required, disable the udev rule that invokes sg_inq --export on device connection.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export"
    },
    {
      "cve": "CVE-2026-46323",
      "cwe": {
        "id": "CWE-123",
        "name": "Write-what-where Condition"
      },
      "discovery_date": "2026-05-19T11:49:44.372000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2479832"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. This vulnerability occurs when `skb_gro_receive()` attempts to merge zerocopy socket buffers (skbs) without properly managing page reference counts, specifically when the `SKBFL_MANAGED_FRAG_REFS` flag is set. An attacker could potentially exploit this to trigger a Use-After-Free (UAF) condition, which is a memory corruption vulnerability that can lead to system instability or potentially arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in the Linux kernel\u0027s Generic Receive Offload (GRO) networking subsystem. The vulnerability, a variant of Fragnesia, stems from improper management of page reference counts when merging zerocopy socket buffers. An attacker could exploit this Use-After-Free condition to achieve arbitrary code execution or cause system instability on affected Red Hat Enterprise Linux and OpenShift Container Platform systems.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
          "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "RHBZ#2479832",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479832"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46323",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46323",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46323"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1f9c828556416fbe3f49386708ce999fc4d4da06"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=44bea2032af0425e4ce6d26a8af0ede79db49ec1"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=479084ae0e1d9cb7929cb4298d35623de189f80a"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4db79a322db8c97f7b73b8a347395ef4d685eb40"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e334cbf3388fd9334503a778a82d9e9f14dd2f71"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/",
          "url": "https://lore.kernel.org/netdev/4d583fc5401298453d0a2f1b4719a15be30c8e49.1779194090.git.sd@queasysnail.net/"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/",
          "url": "https://lore.kernel.org/netdev/agVpIsaSherjHTYg@sultan-box/"
        }
      ],
      "release_date": "2026-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-24T11:01:55+00:00",
          "details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:e8d2a7b9f0565993f40582cdd56c27672720917d577da9b557ab11a554a71824\n\n      (For s390x architecture)\n      The image digest is sha256:ee3eedf869e038de1cf4875f01ea4d62551a7be850fd796af1828d925d1029e2\n\n      (For ppc64le architecture)\n      The image digest is sha256:b2d122c178ca0783c1477519ebacbfd745de5a63d3f19a8593132307b3b5a649\n\n      (For aarch64 architecture)\n      The image digest is sha256:bf9e95ecba75dc376153b32f6278389d2eab173ac661b47f09241ef3af7d8c31\n\nAll OpenShift Container Platform 4.16 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:67935"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-RHOSE-4.16:rhcos-aarch64-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-ppc64le-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-s390x-416.94.202609140240-0",
            "9Base-RHOSE-4.16:rhcos-x86_64-416.94.202609140240-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.