RHSA-2026:82811
Vulnerability from csaf_redhat - Published: 2026-10-22 16:27 - Updated: 2026-10-31 15:44Summary
Red Hat Security Advisory: OpenShift Container Platform 4.15.70 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.15.70 is now available with updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.15.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.15.70. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:82810
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/
Security Fix(es):
* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)
* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)
* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
* kernel: sctp: prevent peer transport count overflow (CVE-2026-74469)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)
* glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list" (CVE-2026-58014)
* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Important
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Important
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Important
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Moderate
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
5.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Moderate
A flaw was found in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could potentially trigger this condition, causing memory corruption. This could result in a system crash (denial of service) or other unpredictable system behavior.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Low
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. An integer overflow occurs when the `transport_count` for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer addresses beyond the intended memory buffer, leading to an out-of-bounds write. This memory corruption can result in a denial of service (DoS) due to system instability or crashes.
8.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Low
A flaw was found in the Linux kernel's xfrm subsystem, specifically within the AH6 (Authentication Header for IPv6) module. The `ipv6_rearrange_rthdr()` function does not properly validate the `segments_left` field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacker to craft a malicious packet that can cause an out-of-bounds memory access, potentially leading to memory corruption.
8.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Low
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively large headroom request to the TUN or TAP device. Successful exploitation could lead to memory corruption, where network packet data is written outside its intended buffer, potentially causing a denial of service or other system instability.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2026-5260
Threats
Impact
Low
References
66 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.15.70 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.15.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.15.70. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:82810\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nSecurity Fix(es):\n\n* sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822)\n* sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824)\n* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)\n* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)\n* kernel: sctp: prevent peer transport count overflow (CVE-2026-74469)\n* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)\n* kernel: net: tun: bound receive headroom (CVE-2026-81000)\n* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)\n* glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\" (CVE-2026-58014)\n* glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive (CVE-2026-58015)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:82811",
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2467450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"category": "external",
"summary": "2487258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
},
{
"category": "external",
"summary": "2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "2513233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513233"
},
{
"category": "external",
"summary": "2517043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517043"
},
{
"category": "external",
"summary": "2528676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528676"
},
{
"category": "external",
"summary": "2532176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532176"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82811.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.15.70 bug fix and security update",
"tracking": {
"current_release_date": "2026-10-31T15:44:04+00:00",
"generator": {
"date": "2026-10-31T15:44:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.4"
}
},
"id": "RHSA-2026:82811",
"initial_release_date": "2026-10-22T16:27:06+00:00",
"revision_history": [
{
"date": "2026-10-22T16:27:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-22T16:27:06+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-31T15:44:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.15",
"product": {
"name": "Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.15::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-415.92.202610081130-0",
"product": {
"name": "rhcos-aarch64-415.92.202610081130-0",
"product_id": "rhcos-aarch64-415.92.202610081130-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202610081130?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-415.92.202610081130-0",
"product": {
"name": "rhcos-ppc64le-415.92.202610081130-0",
"product_id": "rhcos-ppc64le-415.92.202610081130-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202610081130?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-415.92.202610081130-0",
"product": {
"name": "rhcos-s390x-415.92.202610081130-0",
"product_id": "rhcos-s390x-415.92.202610081130-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202610081130?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-415.92.202610081130-0",
"product": {
"name": "rhcos-x86_64-415.92.202610081130-0",
"product_id": "rhcos-x86_64-415.92.202610081130-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@415.92.202610081130?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-415.92.202610081130-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0"
},
"product_reference": "rhcos-aarch64-415.92.202610081130-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-415.92.202610081130-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0"
},
"product_reference": "rhcos-ppc64le-415.92.202610081130-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-415.92.202610081130-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0"
},
"product_reference": "rhcos-s390x-415.92.202610081130-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-415.92.202610081130-0 as a component of Red Hat OpenShift Container Platform 4.15",
"product_id": "9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
},
"product_reference": "rhcos-x86_64-415.92.202610081130-0",
"relates_to_product_reference": "9Base-RHOSE-4.15"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-5260",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-05-06T19:50:31.302000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Moderate severity because exploitation requires a specialized server setup where RSA key exchange is negotiated using a private key hosted on a PKCS#11 token. In standard Red Hat Enterprise Linux deployments, system-wide crypto policies prioritize forward-secret (EC)DHE cipher suites, and PKCS#11 hardware tokens are not configured by default. Furthermore, the issue only triggers a bounded heap overread, resulting in limited information disclosure rather than arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5260"
},
{
"category": "external",
"summary": "RHBZ#2467450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5260"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange"
},
{
"cve": "CVE-2026-11822",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-09T20:01:15.006955+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "RHBZ#2487258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
"url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
}
],
"release_date": "2026-06-09T19:08:31.019000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
},
{
"cve": "CVE-2026-11824",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-09T20:02:19.874232+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "RHBZ#2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
"url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
}
],
"release_date": "2026-06-09T19:21:42.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58014",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-06-24T17:16:25.796000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "RHBZ#2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
},
{
"acknowledgments": [
{
"names": [
"Thepwnisher"
]
}
],
"cve": "CVE-2026-58015",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-24T17:22:00.405000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "RHBZ#2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
},
{
"cve": "CVE-2026-68121",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-10T12:25:51.369604+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could potentially trigger this condition, causing memory corruption. This could result in a system crash (denial of service) or other unpredictable system behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: pppoe: reload header pointer after dev_hard_header()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an authenticated local user can exploit a use-after-free condition to corrupt kernel memory, potentially achieving local privilege escalation or crashing the operating system. Although triggering the issue requires specific timing during packet transmission and network device manipulation, the potential blast radius involves compromise of kernel memory. Enterprise Red Hat Enterprise Linux installations rarely configure PPPoE interfaces, which significantly limits practical exposure in default environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68121"
},
{
"category": "external",
"summary": "RHBZ#2513233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513233"
},
{
"category": "external",
"summary": "RHSB-2026-011",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68121"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T"
}
],
"release_date": "2026-08-10T11:58:41.489000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: pppoe: reload header pointer after dev_hard_header()"
},
{
"cve": "CVE-2026-74469",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517043"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. An integer overflow occurs when the `transport_count` for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer addresses beyond the intended memory buffer, leading to an out-of-bounds write. This memory corruption can result in a denial of service (DoS) due to system instability or crashes.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: prevent peer transport count overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because heap buffer corruption within kernel memory can induce system crashes or arbitrary kernel memory manipulation. On Red Hat Enterprise Linux, the SCTP kernel module is not loaded by default, substantially reducing out-of-the-box exposure on standard installations. Successful exploitation requires an environment where SCTP is actively utilized and a socket diagnostic query is triggered after an association accumulates tens of thousands of unique peer addresses.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-74469"
},
{
"category": "external",
"summary": "RHBZ#2517043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517043"
},
{
"category": "external",
"summary": "RHSB-2026-011",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-74469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-74469"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74469",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74469"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-74469-d3f3@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081534-CVE-2026-74469-d3f3@gregkh/T"
}
],
"release_date": "2026-08-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: sctp: prevent peer transport count overflow"
},
{
"cve": "CVE-2026-80844",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528676"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s xfrm subsystem, specifically within the AH6 (Authentication Header for IPv6) module. The `ipv6_rearrange_rthdr()` function does not properly validate the `segments_left` field in routing headers when processing raw IPv6 HDRINCL packets. This oversight allows an attacker to craft a malicious packet that can cause an out-of-bounds memory access, potentially leading to memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: xfrm: ah6: validate routing header segments_left",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is classified as Important severity because exploitation can be achieved by a local attacker with unprivileged user access. An attack could leverage user namespaces to obtain elevated network permissions within the namespace, then sends specially crafted IPv6 packets with malformed Authentication Header routing headers. Exploitation is challenging but achievable due to complex setup including IPv6 AH/XFRM, ESP-in-UDP encapsulation, and specific timing and memory layout conditions. This memory corruption can enable local privilege escalation to root from an unprivileged user account.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80844"
},
{
"category": "external",
"summary": "RHBZ#2528676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528676"
},
{
"category": "external",
"summary": "RHSB-2026-011",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80844",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80844"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80844",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80844"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80844.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: xfrm: ah6: validate routing header segments_left"
},
{
"cve": "CVE-2026-81000",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532176"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively large headroom request to the TUN or TAP device. Successful exploitation could lead to memory corruption, where network packet data is written outside its intended buffer, potentially causing a denial of service or other system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: net: tun: bound receive headroom",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an attacker with local access or control over virtualized network traffic can trigger out-of-bounds kernel memory writes, potentially achieving system compromise or causing an immediate kernel panic. In typical enterprise environments, virtual network interfaces such as TUN and TAP are widely leveraged alongside software-defined networking and hypervisors. Although untrusted remote callers cannot directly reach these interfaces on default installations, the risk of kernel memory corruption from unprivileged local contexts or container boundaries justifies this rating.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-81000"
},
{
"category": "external",
"summary": "RHBZ#2532176",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532176"
},
{
"category": "external",
"summary": "RHSB-2026-011",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-81000",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81000"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81000",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81000"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81000.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-22T16:27:06+00:00",
"details": "For OpenShift Container Platform 4.15 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:75d3e0923552cf9db351f8301695cb2a0fecd9f71140885bd9c4d63cccb83aff\n\n (For s390x architecture)\n The image digest is sha256:cebb116deac8cbab25722ef996784a7e988a87d39bfca0a260d39dcb750af14f\n\n (For ppc64le architecture)\n The image digest is sha256:317636d528facd317a09b04f4a5437b039e7fb6870f51d891341507200483f01\n\n (For aarch64 architecture)\n The image digest is sha256:59c7df31559e4f7ccccfef1d52cd2a2b28afb7b411401e68c0e240d4c9c9ef0b\n\nAll OpenShift Container Platform 4.15 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:82811"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.15:rhcos-aarch64-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-ppc64le-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-s390x-415.92.202610081130-0",
"9Base-RHOSE-4.15:rhcos-x86_64-415.92.202610081130-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: net: tun: bound receive headroom"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.