RHSA-2026:89197
Vulnerability from csaf_redhat - Published: 2026-10-27 22:03 - Updated: 2026-10-29 13:59Summary
Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.22.20 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.22.
Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.20. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/{RPM_ADVISORY}
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* ca-certificates: Distrust eMudhra intermediate CA certificates due to
security concerns (CVE-2026-114406)
* kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via
improper value handling (CVE-2025-35973)
* libpcap: libpcap: Out-of-bounds read and write vulnerability allows
arbitrary memory access (CVE-2026-0799)
* bind: BIND: Denial of Service via malformed DNS64 responses
(CVE-2026-19666)
* bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in
DNS negative cache handling (CVE-2026-19667)
* openssh: OpenSSH sshd: Security bypass due to incorrect handling of
forwarding and tunneling options (CVE-2026-59999)
* libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling
(CVE-2026-63382)
* libevent: Libevent: Denial of Service via malformed RPC data
(CVE-2026-63383)
* libevent: Libevent: Denial of Service via integer conversion error in
`evtag_unmarshal_header` (CVE-2026-63384)
* libevent: Libevent: HTTP header handling bugs create risk of access
control bypass. (CVE-2026-63385)
* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of
service or data corruption (CVE-2026-63387)
* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write
in AF_UNIX handling (CVE-2026-63388)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
(CVE-2026-64564)
* expat: Expat: Denial of Service via quadratic complexity in attribute
processing (CVE-2026-66046)
* kernel: drm/amdgpu/vce: fix integer overflow in image size
(CVE-2026-68108)
* kernel: openvswitch: fix GSO userspace truncation underflow
(CVE-2026-68123)
* bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
* kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device
(CVE-2026-81003)
* libxml2: libxml2: Arbitrary code execution via stack-based buffer
overflow in xmlSnprintfElements (CVE-2026-86140)
* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via
crafted regular expressions (CVE-2026-86145)
* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
(CVE-2026-89161)
* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
(CVE-2026-89481)
* kernel: nfsd: revoke copy-notify stateids before dropping their reference
(CVE-2026-89663)
* kernel: nfsd: initialize copy-notify stateid before publishing it
(CVE-2026-89669)
* kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF
(CVE-2026-89690)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension
(CVE-2026-89811)
* kernel: media: cx231xx: reject geometry changes while the VBI queue is
busy (CVE-2026-89894)
* kernel: nvme: add missing SRCU grace period in error path
(CVE-2026-89972)
* kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
(CVE-2026-90036)
* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
(CVE-2026-90227)
* kernel: netfilter: nfnetlink_log: wait for rcu grace period before
freeing pernet state (CVE-2026-93288)
* kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
* expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)
* rpcbind: Unbounded memory allocation in rpcbind statistics tracking
allows unauthenticated remote denial of service (CVE-2026-94640)
* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
(CVE-2026-97417)
* kernel: ipv4: validate checksum_start before completing checksum
(CVE-2026-99999)
* pcre2: pcre2: Out-of-bounds write via crafted regular expression
(CVE-2026-103111)
* tornado: Tornado: Denial of Service via decompression bomb in
CurlAsyncHTTPClient (CVE-2026-103262)
* gnutls: gnutls: Information disclosure via heap overread in RSA key
exchange (CVE-2026-5260)
* curl: curl: Cookie injection via malicious HTTP server using super
cookies (CVE-2026-8924)
* URI: URI (for Perl): Security bypass due to incorrect hostname encoding
via missing Unicode normalization (CVE-2026-19953)
* gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c
(CVE-2026-40467)
* gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
* gnutls: gnutls: Security bypass due to incorrect name constraint handling
(CVE-2026-42011)
* gnutls: gnutls: Certificate validation bypass due to improper handling of
URI and SRV SANs (CVE-2026-42012)
* gnutls: gnutls: Certificate validation bypass due to oversized Subject
Alternative Name (CVE-2026-42013)
* openssh: OpenSSH: sftp client allows attacker to control downloaded file
location (CVE-2026-59995)
* kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
(CVE-2026-68257)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound
(CVE-2026-80887)
* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
(CVE-2026-86138)
* libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to
xpointer length saturation (CVE-2026-86142)
* libxml2: libxml2: Data integrity issues due to integer overflow in write
callbacks (CVE-2026-86143)
* libxml2: libxml2: Information disclosure, SSRF, or denial of service due
to improper parseFlags propagation. (CVE-2026-86144)
* kernel: nvme-tcp: reject a read that transferred too few bytes
(CVE-2026-89480)
* kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody()
entry (CVE-2026-93207)
* kernel: svcrdma: Reject Write/Reply chunks with segcount 0
(CVE-2026-93228)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Intel(R) Processors within Ring 0, affecting the kernel, hypervisor, and bare metal operating systems. Improper handling of values may allow an authorized adversary with privileged user access to perform a local, high-complexity attack. This can lead to an escalation of privilege, potentially resulting in high impact to the confidentiality and integrity of the system.
7.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter in libpcap does not properly validate register indexes in BPF instructions. A local attacker could craft a malicious filter program to trigger an out-of-bounds read and write vulnerability. This could allow the attacker to read and write arbitrary operating system process memory, potentially leading to information disclosure or arbitrary code execution.
8.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in `bind9`'s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the URI component for Perl. This vulnerability occurs because the `nameprep` function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.
7.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in gawk. A Use After Free vulnerability exists in the do_getline_redir() routine within the io.c program file. This vulnerability can be triggered by an attacker, potentially leading to a system crash and causing a Denial of Service (DoS).
4.0 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability.
4.4 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.
5.4 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in libevent. The evhttp parser in libevent's http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches.
7.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Libevent. An incorrect integer conversion in the `evtag_unmarshal_header` function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in libevent. The evhttp_decode_uri_internal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes /admin/secret, bypassing path-based access controls. Additionally, evhttp_header_is_valid_value accepts obsolete HTTP header line folding (CRLF followed by SP/HT), which RFC 9112 states new implementations should reject, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent accepts it. This could lead to access control bypass, header injection, or request smuggling.
7.7 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the `dnsname_to_labels` function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the process, resulting in a denial of service or potential information disclosure and integrity impact.
8.6 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services.
8.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the `drm/amdgpu/vce` component of the Linux kernel. Malicious VCE (Video Codec Engine) command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead to system instability or potentially arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Open vSwitch component of the Linux kernel. This vulnerability arises from an underflow condition when handling Generic Segmentation Offload (GSO) packets in userspace. A length calculation error can lead to a buffer underflow when data is processed by the `skb_zerocopy()` function. This issue could result in memory corruption, potentially leading to a denial of service or other unpredictable system behavior.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's `drm/amdkfd` component. An integer overflow vulnerability exists in the calculation of a memory allocation size. When processing large input values, this calculation can result in an undersized memory region, which can then be overrun by firmware. This could lead to system instability or a denial of service.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the `drm/vmwgfx` component of the Linux kernel. An integer overflow vulnerability exists in the `vmw_shader_define()` function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in the Linux kernel's KVM s390 Virtual Shared Inter-Partition Emulation (VSIE) component. When shadowing crypto access bits from a format0 apcb, stale crypto bits were not properly cleared. This oversight could allow a nested guest to potentially access a device that should no longer be available, leading to unauthorized information disclosure or access to resources.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The `afiucv_hs_rcv()` function, responsible for receiving frames, does not properly filter incoming frames based on the ingress network device. This oversight allows a local attacker with specific network capabilities or a host on the same HiperSockets segment to send specially crafted frames. Successful exploitation can lead to a Denial of Service (DoS) by exhausting the accept-queue, injecting data into existing sockets, and disrupting established connections.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.
6.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw in libxml2's xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).
6.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.
6.9 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw in libxml2's XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.
5.6 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data, potentially leading to information disclosure or data integrity issues.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information.
7.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading to a use-after-free condition. This can cause system instability and potentially allow for unauthorized access.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the `nfsd` component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted `OFFLOAD_CANCEL` operation, leading to a race condition that frees the state ID prematurely. This could result in a use-after-free, potentially allowing for arbitrary code execution or denial of service.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the `nfsd` component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash (denial of service) or potentially allow an attacker to gain elevated privileges.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler (MES) fails to perform a necessary Translation Lookaside Buffer (TLB) invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access (DMA) descriptors to access memory that has already been unmapped, leading to page faults and potential GPU queue hangs, particularly during Shared Virtual Memory (SVM) page migration.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval (VBI) queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the NVMe (Non-Volatile Memory Express) driver of the Linux kernel. The nvme_alloc_ns() function's error handling path fails to wait for all SRCU (Sleepable Read-Copy Update) readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a freed memory region, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This can result in memory corruption when the system attempts to access freed memory, potentially leading to a denial of service or arbitrary code execution.
8.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's NVMe (Non-Volatile Memory Express) input/output control (ioctl) handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the `NVME_IOCTL_SUBMIT_IO` function. This allows them to perform unauthorized I/O operations on a partition device or write to a read-only file descriptor, potentially leading to privilege escalation or unauthorized data modification.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) component. Improper handling of credential data during the decoding process can lead to a dangling pointer, a form of memory corruption. This issue may allow a remote attacker to cause a denial of service by triggering early decode failures, leading to incorrect state management and potentially system instability.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in the Linux kernel's Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma). A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the segment count is greater than zero, it accepts and links degenerate chunk structures onto internal processing lists. This flaw may result in unexpected memory traversal or a Denial of Service (DoS).
5.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Moderate
A flaw was found in the Linux kernel's netfilter subsystem. When a network namespace is dismantled, the packet logging component frees memory without waiting for ongoing logging operations to complete, resulting in a use-after-free condition. A local attacker could exploit this flaw during network traffic processing to cause a system crash, leading to a Denial of Service (DoS), or potentially execute arbitrary code.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's performance events (perf) subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performance monitoring operations to cause a Denial of Service (DoS) through a system crash or potentially corrupt system memory.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel's netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options through a system running conntrack (e.g., Linux firewall/NAT using iptables/nftables), causing a memory access fault that leads to a kernel panic and Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.
8.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
7.6 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
A flaw was found in Tornado. A remote malicious server can cause a Denial of Service (DoS) when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly compressed payload (a decompression bomb) that expands to an enormous size. This unbounded memory consumption exhausts system resources and crashes the application.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Important
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
6.8 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-35973
Threats
Impact
Critical
References
384 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.22.20 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact\nof Critical. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.22.20. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/{RPM_ADVISORY}\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* ca-certificates: Distrust eMudhra intermediate CA certificates due to\nsecurity concerns (CVE-2026-114406)\n* kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via\nimproper value handling (CVE-2025-35973)\n* libpcap: libpcap: Out-of-bounds read and write vulnerability allows\narbitrary memory access (CVE-2026-0799)\n* bind: BIND: Denial of Service via malformed DNS64 responses\n(CVE-2026-19666)\n* bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in\nDNS negative cache handling (CVE-2026-19667)\n* openssh: OpenSSH sshd: Security bypass due to incorrect handling of\nforwarding and tunneling options (CVE-2026-59999)\n* libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling\n(CVE-2026-63382)\n* libevent: Libevent: Denial of Service via malformed RPC data\n(CVE-2026-63383)\n* libevent: Libevent: Denial of Service via integer conversion error in\n`evtag_unmarshal_header` (CVE-2026-63384)\n* libevent: Libevent: HTTP header handling bugs create risk of access\ncontrol bypass. (CVE-2026-63385)\n* libevent: Libevent: Off-by-one stack buffer overflow leading to denial of\nservice or data corruption (CVE-2026-63387)\n* libevent: Libevent: Arbitrary code execution via heap out-of-bounds write\nin AF_UNIX handling (CVE-2026-63388)\n* kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n(CVE-2026-64564)\n* expat: Expat: Denial of Service via quadratic complexity in attribute\nprocessing (CVE-2026-66046)\n* kernel: drm/amdgpu/vce: fix integer overflow in image size\n(CVE-2026-68108)\n* kernel: openvswitch: fix GSO userspace truncation underflow\n(CVE-2026-68123)\n* bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)\n* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)\n* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)\n* kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device\n(CVE-2026-81003)\n* libxml2: libxml2: Arbitrary code execution via stack-based buffer\noverflow in xmlSnprintfElements (CVE-2026-86140)\n* pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via\ncrafted regular expressions (CVE-2026-86145)\n* pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match\n(CVE-2026-89161)\n* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command\n(CVE-2026-89481)\n* kernel: nfsd: revoke copy-notify stateids before dropping their reference\n(CVE-2026-89663)\n* kernel: nfsd: initialize copy-notify stateid before publishing it\n(CVE-2026-89669)\n* kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF\n(CVE-2026-89690)\n* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension\n(CVE-2026-89811)\n* kernel: media: cx231xx: reject geometry changes while the VBI queue is\nbusy (CVE-2026-89894)\n* kernel: nvme: add missing SRCU grace period in error path\n(CVE-2026-89972)\n* kernel: NFSD: Prevent client use-after-free during blocked-lock reaping\n(CVE-2026-90036)\n* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()\n(CVE-2026-90227)\n* kernel: netfilter: nfnetlink_log: wait for rcu grace period before\nfreeing pernet state (CVE-2026-93288)\n* kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)\n* expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)\n* rpcbind: Unbounded memory allocation in rpcbind statistics tracking\nallows unauthenticated remote denial of service (CVE-2026-94640)\n* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()\n(CVE-2026-97417)\n* kernel: ipv4: validate checksum_start before completing checksum\n(CVE-2026-99999)\n* pcre2: pcre2: Out-of-bounds write via crafted regular expression\n(CVE-2026-103111)\n* tornado: Tornado: Denial of Service via decompression bomb in\nCurlAsyncHTTPClient (CVE-2026-103262)\n* gnutls: gnutls: Information disclosure via heap overread in RSA key\nexchange (CVE-2026-5260)\n* curl: curl: Cookie injection via malicious HTTP server using super\ncookies (CVE-2026-8924)\n* URI: URI (for Perl): Security bypass due to incorrect hostname encoding\nvia missing Unicode normalization (CVE-2026-19953)\n* gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c\n(CVE-2026-40467)\n* gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)\n* gnutls: gnutls: Security bypass due to incorrect name constraint handling\n(CVE-2026-42011)\n* gnutls: gnutls: Certificate validation bypass due to improper handling of\nURI and SRV SANs (CVE-2026-42012)\n* gnutls: gnutls: Certificate validation bypass due to oversized Subject\nAlternative Name (CVE-2026-42013)\n* openssh: OpenSSH: sftp client allows attacker to control downloaded file\nlocation (CVE-2026-59995)\n* kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation\n(CVE-2026-68257)\n* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound\n(CVE-2026-80887)\n* libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow\n(CVE-2026-86138)\n* libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to\nxpointer length saturation (CVE-2026-86142)\n* libxml2: libxml2: Data integrity issues due to integer overflow in write\ncallbacks (CVE-2026-86143)\n* libxml2: libxml2: Information disclosure, SSRF, or denial of service due\nto improper parseFlags propagation. (CVE-2026-86144)\n* kernel: nvme-tcp: reject a read that transferred too few bytes\n(CVE-2026-89480)\n* kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody()\nentry (CVE-2026-93207)\n* kernel: svcrdma: Reject Write/Reply chunks with segcount 0\n(CVE-2026-93228)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:89197",
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2462960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462960"
},
{
"category": "external",
"summary": "2467437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"category": "external",
"summary": "2467441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"category": "external",
"summary": "2467448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"category": "external",
"summary": "2467450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"category": "external",
"summary": "2496765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
},
{
"category": "external",
"summary": "2497927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497927"
},
{
"category": "external",
"summary": "2497942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497942"
},
{
"category": "external",
"summary": "2499655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655"
},
{
"category": "external",
"summary": "2499658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658"
},
{
"category": "external",
"summary": "2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "2513361",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513361"
},
{
"category": "external",
"summary": "2513372",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513372"
},
{
"category": "external",
"summary": "2513451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513451"
},
{
"category": "external",
"summary": "2514104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514104"
},
{
"category": "external",
"summary": "2517901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901"
},
{
"category": "external",
"summary": "2520654",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520654"
},
{
"category": "external",
"summary": "2520655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520655"
},
{
"category": "external",
"summary": "2520658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520658"
},
{
"category": "external",
"summary": "2520660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520660"
},
{
"category": "external",
"summary": "2520661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520661"
},
{
"category": "external",
"summary": "2520666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520666"
},
{
"category": "external",
"summary": "2526492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526492"
},
{
"category": "external",
"summary": "2528542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528542"
},
{
"category": "external",
"summary": "2528788",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528788"
},
{
"category": "external",
"summary": "2528986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
},
{
"category": "external",
"summary": "2528987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
},
{
"category": "external",
"summary": "2528989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
},
{
"category": "external",
"summary": "2528990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
},
{
"category": "external",
"summary": "2528992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
},
{
"category": "external",
"summary": "2528993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
},
{
"category": "external",
"summary": "2529093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529093"
},
{
"category": "external",
"summary": "2531066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531066"
},
{
"category": "external",
"summary": "2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "2532095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532095"
},
{
"category": "external",
"summary": "2532103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532103"
},
{
"category": "external",
"summary": "2532111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532111"
},
{
"category": "external",
"summary": "2532184",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532184"
},
{
"category": "external",
"summary": "2532231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532231"
},
{
"category": "external",
"summary": "2532515",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532515"
},
{
"category": "external",
"summary": "2535140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535140"
},
{
"category": "external",
"summary": "2535158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535158"
},
{
"category": "external",
"summary": "2535309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535309"
},
{
"category": "external",
"summary": "2535338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535338"
},
{
"category": "external",
"summary": "2535435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535435"
},
{
"category": "external",
"summary": "2535466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535466"
},
{
"category": "external",
"summary": "2535477",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535477"
},
{
"category": "external",
"summary": "2536346",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536346"
},
{
"category": "external",
"summary": "2538967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538967"
},
{
"category": "external",
"summary": "2540182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540182"
},
{
"category": "external",
"summary": "2540230",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540230"
},
{
"category": "external",
"summary": "2540391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540391"
},
{
"category": "external",
"summary": "2540479",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540479"
},
{
"category": "external",
"summary": "2540500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540500"
},
{
"category": "external",
"summary": "2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "2544534",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544534"
},
{
"category": "external",
"summary": "2553429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
},
{
"category": "external",
"summary": "2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_89197.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update",
"tracking": {
"current_release_date": "2026-10-29T13:59:21+00:00",
"generator": {
"date": "2026-10-29T13:59:21+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.3"
}
},
"id": "RHSA-2026:89197",
"initial_release_date": "2026-10-27T22:03:20+00:00",
"revision_history": [
{
"date": "2026-10-27T22:03:20+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-27T22:03:20+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-29T13:59:21+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.22",
"product": {
"name": "Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-4.22.9.8.202610241758-0",
"product": {
"name": "rhcos-aarch64-4.22.9.8.202610241758-0",
"product_id": "rhcos-aarch64-4.22.9.8.202610241758-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202610241758?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-4.22.9.8.202610241758-0",
"product": {
"name": "rhcos-ppc64le-4.22.9.8.202610241758-0",
"product_id": "rhcos-ppc64le-4.22.9.8.202610241758-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202610241758?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-4.22.9.8.202610241758-0",
"product": {
"name": "rhcos-s390x-4.22.9.8.202610241758-0",
"product_id": "rhcos-s390x-4.22.9.8.202610241758-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202610241758?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-4.22.9.8.202610241758-0",
"product": {
"name": "rhcos-x86_64-4.22.9.8.202610241758-0",
"product_id": "rhcos-x86_64-4.22.9.8.202610241758-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202610241758?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0"
},
"product_reference": "rhcos-aarch64-4.22.9.8.202610241758-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0"
},
"product_reference": "rhcos-ppc64le-4.22.9.8.202610241758-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0"
},
"product_reference": "rhcos-s390x-4.22.9.8.202610241758-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
},
"product_reference": "rhcos-x86_64-4.22.9.8.202610241758-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-35973",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-08-11T16:52:22.336117+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514104"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Intel(R) Processors within Ring 0, affecting the kernel, hypervisor, and bare metal operating systems. Improper handling of values may allow an authorized adversary with privileged user access to perform a local, high-complexity attack. This can lead to an escalation of privilege, potentially resulting in high impact to the confidentiality and integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat is aware of a hardware vulnerability affecting some Intel processors that could allow a local attacker who already has privileged access to escalate privileges by exploiting improper handling of internal processor values during Ring 0 execution. In the most severe case, this could allow a privileged workload running inside a virtual machine to escalate access into the underlying hypervisor. Exploitation requires local access, existing privileged access, and a high degree of attack complexity, including detailed knowledge of the processor\u0027s internal behavior.\n\nRed Hat products that provide workload isolation using a hypervisor, such as Red Hat OpenShift sandboxed containers (which uses Kata Containers), are assessed as Important severity because of the potential impact on isolation between different tenants\u0027 workloads if the underlying processor is vulnerable and has not been updated.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-35973"
},
{
"category": "external",
"summary": "RHBZ#2514104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514104"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-35973",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-35973"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-35973",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-35973"
},
{
"category": "external",
"summary": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html"
}
],
"release_date": "2026-08-11T16:28:25.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "This is a hardware-level vulnerability in the affected Intel processors. There is no code-level fix available in Red Hat OpenShift sandboxed containers or other affected Red Hat components; the issue must be addressed at the processor firmware layer.\n\nRed Hat recommends that customers apply the latest CPU microcode or system firmware update from their hardware manufacturer. Intel has released microcode updates addressing this issue; see Intel Security Advisory INTEL-SA-01428 (https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html) for affected processor families and update guidance.\n\nIntel has indicated that a further Trusted Computing Base (TCB) recovery is planned for this issue. Red Hat will update this guidance if additional remediation steps become necessary once that information is available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling"
},
{
"cve": "CVE-2026-0799",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-05T19:01:11.898118+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2529093"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter in libpcap does not properly validate register indexes in BPF instructions. A local attacker could craft a malicious filter program to trigger an out-of-bounds read and write vulnerability. This could allow the attacker to read and write arbitrary operating system process memory, potentially leading to information disclosure or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in libpcap where a flaw in the BPF interpreter\u0027s register index validation can lead to out-of-bounds memory access. Exploitation requires a local attacker to provide a specially crafted BPF filter program to an application utilizing libpcap, which is considered an uncommon use case. This could result in arbitrary read and write operations within the OS process memory.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-0799"
},
{
"category": "external",
"summary": "RHBZ#2529093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529093"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-0799",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-0799"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-0799",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0799"
},
{
"category": "external",
"summary": "https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7",
"url": "https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7"
}
],
"release_date": "2026-09-05T18:48:39.126000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access"
},
{
"acknowledgments": [
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-5260",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-05-06T19:50:31.302000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Moderate severity because exploitation requires a specialized server setup where RSA key exchange is negotiated using a private key hosted on a PKCS#11 token. In standard Red Hat Enterprise Linux deployments, system-wide crypto policies prioritize forward-secret (EC)DHE cipher suites, and PKCS#11 hardware tokens are not configured by default. Furthermore, the issue only triggers a bounded heap overread, resulting in limited information disclosure rather than arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-5260"
},
{
"category": "external",
"summary": "RHBZ#2467450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-5260",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-5260"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5260"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange"
},
{
"cve": "CVE-2026-8924",
"cwe": {
"id": "CWE-565",
"name": "Reliance on Cookies without Validation and Integrity Checking"
},
"discovery_date": "2026-07-03T07:01:32.981435+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496765"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl\u0027s cookie parsing logic. A malicious HTTP server can exploit this by setting \u0027super cookies\u0027 that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: curl: Cookie injection via malicious HTTP server using super cookies",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA\u0027s Critical (9.1). The scoring difference is due to two factors: first, exploitation requires the victim\u0027s curl to connect using a trailing-dot hostname (e.g., https://example.co.uk.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests \u2014 not exfiltration of victim data to the attacker. The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP communication are affected, but the trailing-dot precondition significantly limits real-world exploitability. This flaw has not been shown to enable impacts beyond session integrity modification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8924"
},
{
"category": "external",
"summary": "RHBZ#2496765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496765"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8924",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8924"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.html",
"url": "https://curl.se/docs/CVE-2026-8924.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8924.json",
"url": "https://curl.se/docs/CVE-2026-8924.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733905",
"url": "https://hackerone.com/reports/3733905"
}
],
"release_date": "2026-07-03T06:15:04.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "curl: curl: Cookie injection via malicious HTTP server using super cookies"
},
{
"cve": "CVE-2026-19666",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-09-16T14:34:53.189451+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535477"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. When a resolver is configured to use DNS64, a specially crafted, malformed answer from an authoritative server can cause the `named` process to exit unexpectedly. This can lead to a Denial of Service (DoS) for clients relying on the affected resolver.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via malformed DNS64 responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This denial of service vulnerability affects BIND resolvers configured to use the `dns64` feature. A specially crafted malformed DNS64 response from an authoritative server can cause the `named` process to unexpectedly terminate, leading to service unavailability. Exploitation requires the `dns64` feature to be explicitly enabled in the resolver\u0027s configuration.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19666"
},
{
"category": "external",
"summary": "RHBZ#2535477",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535477"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19666"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19666"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19666",
"url": "https://kb.isc.org/docs/cve-2026-19666"
}
],
"release_date": "2026-09-16T14:02:30.453000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via malformed DNS64 responses"
},
{
"cve": "CVE-2026-19667",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535435"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in `bind9`\u0027s `named` component. A remote attacker, by sending a specially crafted DNS negative answer of exactly 65536 bytes from an authoritative server, can cause a 16-bit length truncation. This results in a zero-byte negative cache entry. When `named` attempts to read this invalid entry, it will unexpectedly terminate, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in BIND 9\u0027s `named` service. An attacker-controlled authoritative server can trigger a `named` abort by sending a precisely sized negative DNS answer. This vulnerability primarily affects BIND instances configured as recursive resolvers that query untrusted authoritative servers, leading to service disruption.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19667"
},
{
"category": "external",
"summary": "RHBZ#2535435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535435"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19667",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19667"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19667"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19667",
"url": "https://kb.isc.org/docs/cve-2026-19667"
}
],
"release_date": "2026-09-16T13:46:56.783000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers.\n\nExample configuration in `named.conf`:\n```\noptions {\n forwarders { 192.0.2.1; 192.0.2.2; };\n forward only;\n};\n```\nReplace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling"
},
{
"cve": "CVE-2026-19953",
"cwe": {
"id": "CWE-838",
"name": "Inappropriate Encoding for Output Context"
},
"discovery_date": "2026-08-31T20:21:16.490285+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2526492"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the URI component for Perl. This vulnerability occurs because the `nameprep` function, responsible for encoding hostnames, does not properly normalize Unicode characters. As a result, a hostname that is not in a standard Unicode form (non-NFC) can be encoded into a non-standard label. This discrepancy can lead to a situation where security checks, such as allow lists or Server-Side Request Forgery (SSRF) filters, may incorrectly process hostnames, potentially allowing an attacker to bypass security restrictions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a pure logic bypass (CWE-1289), not a memory safety vulnerability. Successful exploitation requires a very specific, multi-condition application pattern: (1) the application accepts a URL from untrusted network input; (2) it parses the URL with `URI-\u003enew()`; (3) it extracts the hostname via `-\u003ehost()` and uses it for a security decision (e.g., SSRF filtering); and (4) it separately fetches the URL with a client that performs correct IDNA normalization. Only when all four conditions are simultaneously true can an attacker bypass the security control.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19953"
},
{
"category": "external",
"summary": "RHBZ#2526492",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526492"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19953",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19953"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19953",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19953"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/08/31/14",
"url": "http://www.openwall.com/lists/oss-security/2026/08/31/14"
},
{
"category": "external",
"summary": "https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch",
"url": "https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch"
},
{
"category": "external",
"summary": "https://github.com/libwww-perl/URI/pull/191",
"url": "https://github.com/libwww-perl/URI/pull/191"
},
{
"category": "external",
"summary": "https://metacpan.org/release/OALDERS/URI-5.36/changes",
"url": "https://metacpan.org/release/OALDERS/URI-5.36/changes"
},
{
"category": "external",
"summary": "https://www.rfc-editor.org/rfc/rfc5891#section-5.2",
"url": "https://www.rfc-editor.org/rfc/rfc5891#section-5.2"
}
],
"release_date": "2026-08-31T17:29:42.929000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization"
},
{
"cve": "CVE-2026-40467",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-13T13:01:40.927366+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499658"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gawk. A Use After Free vulnerability exists in the do_getline_redir() routine within the io.c program file. This vulnerability can be triggered by an attacker, potentially leading to a system crash and causing a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: A Use After Free vulnerability in gawk\u0027s `do_getline_redir()` routine can lead to a denial of service. This flaw, affecting gawk in Red Hat Hardened Images, requires a local attacker with low privileges to trick a user into interacting with specially crafted input, limiting its immediate impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40467"
},
{
"category": "external",
"summary": "RHBZ#2499658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499658"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40467"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40467",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8",
"url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8"
}
],
"release_date": "2026-07-13T12:07:52.006000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c"
},
{
"cve": "CVE-2026-40468",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-07-13T13:01:04.393054+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499655"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk\u0027s internal memory, potentially leading to system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gawk: gawk: Memory corruption via integer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: An integer overflow vulnerability in gawk\u0027s builtin.c could allow a local attacker to cause memory exhaustion and overwrite heap metadata. This could lead to system instability or a denial of service on affected Red Hat products, requiring local access to execute a malicious gawk script.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40468"
},
{
"category": "external",
"summary": "RHBZ#2499655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499655"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40468",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40468"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40468",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40468"
},
{
"category": "external",
"summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
"url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
},
{
"category": "external",
"summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7",
"url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7"
}
],
"release_date": "2026-07-13T12:07:54.910000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gawk: gawk: Memory corruption via integer overflow"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
}
],
"cve": "CVE-2026-42011",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:06:25.319000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467437"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Security bypass due to incorrect name constraint handling",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42011"
},
{
"category": "external",
"summary": "RHBZ#2467437",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467437"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42011"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Security bypass due to incorrect name constraint handling"
},
{
"acknowledgments": [
{
"names": [
"Oleh Konko"
],
"organization": "1Seal"
}
],
"cve": "CVE-2026-42012",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:16:02.753000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467441"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an active man-in-the-middle position or tricking a client into connecting to a rogue endpoint, along with obtaining a validly signed certificate containing specialized SAN fields. While GnuTLS is widely deployed across Red Hat products as a core cryptographic library, the impact is limited to hostname verification spoofing under specific certificate configurations. The issue does not permit remote code execution or direct compromise of the underlying system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42012"
},
{
"category": "external",
"summary": "RHBZ#2467441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42012"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs"
},
{
"acknowledgments": [
{
"names": [
"Haruto Kimura"
],
"organization": "Stella"
},
{
"names": [
"Joshua Rogers"
],
"organization": "AISLE Research Team"
}
],
"cve": "CVE-2026-42013",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-06T19:47:00.134000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2467448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Moderate impact across affected Red Hat products because successful exploitation requires an active man-in-the-middle network position as well as a certificate issued by a trusted authority matching the target hostname\u0027s Common Name. Although TLS clients using GnuTLS on Red Hat Enterprise Linux and OpenShift are susceptible to improper certificate acceptance under these conditions, modern certificate authorities rarely issue certificates that omit valid Subject Alternative Names, substantially restricting practical threat vectors. Applications functioning exclusively as TLS servers or utilizing alternative cryptographic libraries like OpenSSL are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42013"
},
{
"category": "external",
"summary": "RHBZ#2467448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42013"
},
{
"category": "external",
"summary": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8",
"url": "https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"
}
],
"release_date": "2026-04-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name"
},
{
"cve": "CVE-2026-59995",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-07-08T01:01:01.518880+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497927"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. The `sftp` client, when used to download files from a malicious server with the \u0027sftp server:/path .\u0027 command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or placing malicious files in sensitive directories on the client system, which could compromise system integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59995"
},
{
"category": "external",
"summary": "RHBZ#2497927",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497927"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59995",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59995"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59995"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:04:49.995000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root).",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssh: OpenSSH: sftp client allows attacker to control downloaded file location"
},
{
"cve": "CVE-2026-59999",
"cwe": {
"id": "CWE-358",
"name": "Improperly Implemented Security Check for Standard"
},
"discovery_date": "2026-07-08T01:01:55.619428+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497942"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in `sshd`, the OpenSSH server daemon. When `DisableForwarding=yes` is configured to prevent network traffic forwarding, it incorrectly fails to take precedence over `PermitTunnel=yes`. This allows a remote attacker to bypass intended security restrictions and establish a tunnel, potentially leading to unauthorized network access or circumvention of security policies, even when forwarding is explicitly disabled.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity flaw in OpenSSH `sshd` allows `PermitTunnel=yes` to override `DisableForwarding=yes`, potentially bypassing intended security controls. In Red Hat environments where `DisableForwarding` is used to restrict SSH session capabilities, an attacker who compromises a user\u0027s session could still establish a tunnel, leading to unauthorized network access or data exfiltration. This bypass occurs even when administrators explicitly attempt to prevent forwarding, though `PermitTunnel` is not enabled by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59999"
},
{
"category": "external",
"summary": "RHBZ#2497942",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497942"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59999"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59999"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:13:08.397000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy.\n\nAfter modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options"
},
{
"cve": "CVE-2026-63382",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-20T18:02:20.622823+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libevent. The evhttp parser in libevent\u0027s http.c component inconsistently handles HTTP Transfer-Encoding headers and chunked framing. This inconsistency allows an unauthenticated remote attacker to desynchronize request boundaries when libevent is used behind a proxy. Successful exploitation could lead to request smuggling, potentially bypassing access controls or poisoning caches.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63382"
},
{
"category": "external",
"summary": "RHBZ#2520660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63382",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63382"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63382",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63382"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6",
"url": "https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e",
"url": "https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660",
"url": "https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0",
"url": "https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"
}
],
"release_date": "2026-08-20T17:51:15.156000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling"
},
{
"cve": "CVE-2026-63383",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-08-20T18:01:02.048026+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520654"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. A remote attacker could exploit an out-of-bounds read vulnerability in the `decode_tag_internal()` function by sending specially crafted, attacker-controlled tagged RPC (Remote Procedure Call) data. This could lead to a denial of service, causing the process that decodes the data to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Denial of Service via malformed RPC data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libevent can lead to a denial of service. An attacker could send specially crafted RPC data to a service utilizing libevent, causing an out-of-bounds read and crashing the application. This vulnerability primarily affects applications that process untrusted RPC data using libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63383"
},
{
"category": "external",
"summary": "RHBZ#2520654",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520654"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63383",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63383"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63383",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63383"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321",
"url": "https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb",
"url": "https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"
}
],
"release_date": "2026-08-20T17:48:24.568000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Denial of Service via malformed RPC data"
},
{
"cve": "CVE-2026-63384",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-08-20T18:01:40.543023+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520658"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent. An incorrect integer conversion in the `evtag_unmarshal_header` function allows a remote attacker to provide a specially crafted payload length. This can lead to a wrapped large allocation request, resulting in a denial of service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. A remote attacker can trigger a denial of service in applications utilizing Libevent\u0027s event tagging feature by sending a specially crafted payload. The incorrect integer conversion can lead to excessive memory allocation, causing resource exhaustion.\nThis issue is fixed in versions 2.1.13 and 2.2.2-alpha.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63384"
},
{
"category": "external",
"summary": "RHBZ#2520658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520658"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63384",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63384"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63384",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63384"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda",
"url": "https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416",
"url": "https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"
}
],
"release_date": "2026-08-20T17:53:08.417000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`"
},
{
"cve": "CVE-2026-63385",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-08-20T18:11:18.605370+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520666"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libevent. The evhttp_decode_uri_internal function in http.c decodes percent-encoded %00 bytes into literal NUL characters without rejecting them, allowing an attacker to craft a URI such as /admin/secret%00.jpg where extension-based access checks see .jpg but the server processes /admin/secret, bypassing path-based access controls. Additionally, evhttp_header_is_valid_value accepts obsolete HTTP header line folding (CRLF followed by SP/HT), which RFC 9112 states new implementations should reject, creating a header injection vector in proxy chains where the frontend rejects obs-fold but libevent accepts it. This could lead to access control bypass, header injection, or request smuggling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: HTTP header handling bugs create risk of access control bypass.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux, OpenShift (RHCOS), RHIVOS, and community products (Fedora, Hummingbird) ship affected versions of libevent.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63385"
},
{
"category": "external",
"summary": "RHBZ#2520666",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520666"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63385"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63385",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63385"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0",
"url": "https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2",
"url": "https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"
}
],
"release_date": "2026-08-20T17:55:36.214000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: HTTP header handling bugs create risk of access control bypass."
},
{
"cve": "CVE-2026-63387",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-20T18:01:14.389593+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520655"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent, an event notification library. An off-by-one stack buffer overflow exists in the `dnsname_to_labels` function when processing a name-bearing DNS record. A remote attacker could send a specially crafted DNS server response, which may lead to a crash or corruption of the process, resulting in a denial of service or potential information disclosure and integrity impact.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in the libevent library\u0027s DNS parsing component can lead to a denial of service or data corruption due to an off-by-one stack buffer overflow. A remote attacker can exploit this flaw with low attack complexity by providing a specially crafted DNS server response to services utilizing libevent for DNS resolution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63387"
},
{
"category": "external",
"summary": "RHBZ#2520655",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520655"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63387",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63387"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63387",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63387"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"
}
],
"release_date": "2026-08-20T17:53:41.863000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption"
},
{
"cve": "CVE-2026-63388",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-20T18:02:33.843530+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2520661"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libevent. A heap out-of-bounds write vulnerability in the `bufferevent_socket_set_conn_address_` function allows an unauthenticated local peer to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can overwrite critical heap data, leading to memory corruption and potentially full control over the affected system. This can severely impact the confidentiality, integrity, and availability of data and services.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in libevent that allows an unauthenticated local attacker to achieve arbitrary code execution. By connecting to an AF_UNIX listener, an attacker can trigger a heap out-of-bounds write, leading to memory corruption and high impact on system confidentiality, integrity, and availability. The local attack vector limits the immediate threat, but the unauthenticated nature and severe consequences elevate its importance.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63388"
},
{
"category": "external",
"summary": "RHBZ#2520661",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520661"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63388",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63388"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63388",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63388"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9",
"url": "https://github.com/libevent/libevent/commit/52057cb33d0c20c0a0453fbabe6c0c96854931b9"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72",
"url": "https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha",
"url": "https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha"
},
{
"category": "external",
"summary": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338",
"url": "https://github.com/libevent/libevent/security/advisories/GHSA-cvq5-vrvr-j338"
}
],
"release_date": "2026-08-20T17:44:18.435000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling"
},
{
"cve": "CVE-2026-64564",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510890"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64564"
},
{
"category": "external",
"summary": "RHBZ#2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T"
}
],
"release_date": "2026-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content:\n\n```\ninstall sctp /bin/true\nblacklist sctp\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing"
},
{
"cve": "CVE-2026-66046",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"discovery_date": "2026-08-18T14:21:00.212292+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517901"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts() function, causing excessive CPU consumption and a denial of service",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: Expat: Denial of Service via quadratic complexity in attribute processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important severity denial of service vulnerability exists in the Expat library due to inefficient algorithmic complexity when processing XML attributes. Applications parsing untrusted XML are susceptible to remote, unauthenticated attacks where a specially crafted XML payload causes excessive CPU exhaustion, ultimately resulting in service unavailability.\n\nThis vulnerability could affect Firefox and Thunderbird, but the DoS attack impact is limited just to the slowdown of tab which loads affected page. The benefit of such attack is questionable, and there are a lot of different ways to cause similar DoS effect. The CVE-2026-76641 fixes CVE-2026-66046.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-66046"
},
{
"category": "external",
"summary": "RHBZ#2517901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517901"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-66046",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66046"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66046"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1321",
"url": "https://github.com/libexpat/libexpat/pull/1321"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity",
"url": "https://www.vulncheck.com/advisories/expat-denial-of-service-via-storeatts-quadratic-complexity"
}
],
"release_date": "2026-08-18T14:10:05.176000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing"
},
{
"cve": "CVE-2026-68108",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513361"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `drm/amdgpu/vce` component of the Linux kernel. Malicious VCE (Video Codec Engine) command streams with oversized dimensions can cause a 32-bit integer overflow. This overflow bypasses validation, allowing the GPU firmware to perform out-of-bound memory access. This could lead to system instability or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: drm/amdgpu/vce: fix integer overflow in image size",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68108"
},
{
"category": "external",
"summary": "RHBZ#2513361",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513361"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68108",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68108"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68108",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68108"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081053-CVE-2026-68108-4308@gregkh/T"
}
],
"release_date": "2026-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module.\n\nTo blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content:\n\n```\nblacklist amdgpu\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: drm/amdgpu/vce: fix integer overflow in image size"
},
{
"cve": "CVE-2026-68123",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513451"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Open vSwitch component of the Linux kernel. This vulnerability arises from an underflow condition when handling Generic Segmentation Offload (GSO) packets in userspace. A length calculation error can lead to a buffer underflow when data is processed by the `skb_zerocopy()` function. This issue could result in memory corruption, potentially leading to a denial of service or other unpredictable system behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: openvswitch: fix GSO userspace truncation underflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Linux kernel packages (kernel and kernel-rt) shipped in Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and other Red Hat products that reuse the kernel are affected by this IMPORTANT severity flaw in the Open vSwitch datapath code. When an Open vSwitch flow applies the packet truncation action (OVS_ACTION_ATTR_TRUNC) to a packet that is later segmented for a Generic Segmentation Offload (GSO) userspace action, the kernel reuses a truncation delta computed against the original, larger packet for each smaller segment. A segment can then reach queue_userspace_packet() with a truncation length greater than the segment length, and the underflowed length passed to skb_zerocopy() causes an out-of-bounds access and kernel memory corruption. The likely consequences are a kernel crash, denial of service, or other unpredictable system behavior. Exploitation requires local access and the ability to trigger the affected Open vSwitch userspace action path under specific, complex conditions, which is reflected in the Red Hat rating of 7.0 IMPORTANT (CVSS 3.1: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). This differs from the upstream CVE record, which assigns 9.8 CRITICAL using a network attack vector; Red Hat rates the flaw lower because the verified attack path is local and requires high attack complexity and privileges rather than unauthenticated remote exploitation. A fix is being pursued for the affected Red Hat product streams. The Red Hat Enterprise Linux for NVIDIA kernel is not affected because the vulnerable code is not present in that build.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68123"
},
{
"category": "external",
"summary": "RHBZ#2513451",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513451"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68123",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68123"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68123",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68123"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68123-49d8@gregkh/T"
}
],
"release_date": "2026-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: openvswitch: fix GSO userspace truncation underflow"
},
{
"cve": "CVE-2026-68257",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513372"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s `drm/amdkfd` component. An integer overflow vulnerability exists in the calculation of a memory allocation size. When processing large input values, this calculation can result in an undersized memory region, which can then be overrun by firmware. This could lead to system instability or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68257"
},
{
"category": "external",
"summary": "RHBZ#2513372",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513372"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68257",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68257"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68257",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68257"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081021-CVE-2026-68257-994c@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081021-CVE-2026-68257-994c@gregkh/T"
}
],
"release_date": "2026-08-10T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation"
},
{
"cve": "CVE-2026-80274",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-09-16T14:31:05.646441+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535466"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker, by sending a specially crafted DNSSEC-signed authoritative zone reply, can trigger an unexpected program exit in the validating resolver. This can lead to a Denial of Service (DoS) for the affected BIND resolver.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via crafted DNSSEC reply",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in BIND resolvers. When DNSSEC validation is enabled, a specially crafted DNSSEC reply from an authoritative server can cause the BIND resolver to unexpectedly exit, leading to a disruption of DNS resolution services. This impacts the availability of DNS resolution on affected Red Hat systems configured with DNSSEC.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80274"
},
{
"category": "external",
"summary": "RHBZ#2535466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535466"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80274",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80274"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80274"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.20.29",
"url": "https://downloads.isc.org/isc/bind9/9.20.29"
},
{
"category": "external",
"summary": "https://downloads.isc.org/isc/bind9/9.21.26",
"url": "https://downloads.isc.org/isc/bind9/9.21.26"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-80274",
"url": "https://kb.isc.org/docs/cve-2026-80274"
}
],
"release_date": "2026-09-16T14:07:20.058000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via crafted DNSSEC reply"
},
{
"cve": "CVE-2026-80792",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528542"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ipv6: fix use-after-free in ip6_finish_output2()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80792"
},
{
"category": "external",
"summary": "RHBZ#2528542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80792",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80792"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80792",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80792"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: ipv6: fix use-after-free in ip6_finish_output2()"
},
{
"cve": "CVE-2026-80887",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528788"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `drm/vmwgfx` component of the Linux kernel. An integer overflow vulnerability exists in the `vmw_shader_define()` function due to improper validation of user-supplied shader window size and offset. When the offset value is close to its maximum, an unsigned addition can wrap around, causing the size check to pass incorrectly. This allows an unbounded offset to be used, which could lead to memory corruption and potentially privilege escalation or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the Linux kernel drm/vmwgfx driver, which Red Hat Product Security rates as IMPORTANT (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The vmw_shader_define() function validates a user-supplied shader window against its backing buffer using an unsigned addition of size and offset. Because drm_vmw_shader_create_arg::offset is a 64-bit user-controlled value, an offset near U64_MAX causes the addition to wrap around, so the resulting small value incorrectly passes the bounds check. The unbounded offset is then stored in res-\u003eguest_memory_offset and forwarded to the host SVGA shader-create commands. A local unprivileged attacker with access to the vmwgfx DRM device, such as within a guest virtual machine using VMware graphics, could exploit this integer overflow to cause memory corruption, potentially leading to privilege escalation or denial of service; successful exploitation is judged to require high attack complexity. Currently affected products include the Red Hat Enterprise Linux 8, 9, and 10 kernels (kernel and kernel-rt) and Red Hat In-Vehicle OS, for which fixes are being pursued. Several older update streams (RHEL 7 ELS, RHEL 8.4, 8.6, and 8.8 z streams, and RHEL 9.2.0.z) are not affected because the vulnerable code is not present in those kernels.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80887"
},
{
"category": "external",
"summary": "RHBZ#2528788",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528788"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80887",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80887"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80887",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80887"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80887.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80887.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, prevent the vmwgfx kernel module from loading if VMware virtual graphics acceleration is not needed:\n\n1. Create a configuration file to prevent the module from being loaded:\n# echo \"install vmwgfx /bin/true\" \u003e /etc/modprobe.d/disable-vmwgfx.conf\n\n2. If the module is currently loaded, reboot the system for the change to take effect:\n# reboot\n\nWarning: Disabling this module prevents VMware guest graphics acceleration and may impair graphical desktop environments running inside VMware virtual machines. A reboot is necessary if the driver is already active in memory.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound"
},
{
"cve": "CVE-2026-80921",
"cwe": {
"id": "CWE-908",
"name": "Use of Uninitialized Resource"
},
"discovery_date": "2026-09-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531066"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s KVM s390 Virtual Shared Inter-Partition Emulation (VSIE) component. When shadowing crypto access bits from a format0 apcb, stale crypto bits were not properly cleared. This oversight could allow a nested guest to potentially access a device that should no longer be available, leading to unauthorized information disclosure or access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: KVM: s390: vsie: zero stale crypto bits",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80921"
},
{
"category": "external",
"summary": "RHBZ#2531066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531066"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80921",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80921"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80921",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80921"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80921.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80921.mbox"
}
],
"release_date": "2026-09-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: KVM: s390: vsie: zero stale crypto bits"
},
{
"cve": "CVE-2026-81003",
"cwe": {
"id": "CWE-940",
"name": "Improper Verification of Source of a Communication Channel"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532515"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The `afiucv_hs_rcv()` function, responsible for receiving frames, does not properly filter incoming frames based on the ingress network device. This oversight allows a local attacker with specific network capabilities or a host on the same HiperSockets segment to send specially crafted frames. Successful exploitation can lead to a Denial of Service (DoS) by exhausting the accept-queue, injecting data into existing sockets, and disrupting established connections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw rated IMPORTANT by Red Hat Product Security was found in the Linux kernel\u0027s AF_IUCV protocol implementation, used for the z/VM IUCV and HiperSockets transports on the s390x (IBM Z) architecture. The afiucv_hs_rcv() receive path selected a target socket from the global socket list by matching only the four 8-byte name fields in the frame\u0027s transport header, without checking the network device the frame arrived on. As a result, a frame received on any network device could be delivered to an AF_IUCV socket bound to a different device or to the classic z/VM IUCV transport. A local attacker holding only the CAP_NET_RAW capability inside an unprivileged user and network namespace could send a raw ETH_P_AF_IUCV frame on its own loopback device and have it matched against sockets in the initial network namespace; similarly, a host on the same shared HiperSockets segment could direct frames at sockets bound to a different HiperSockets device. Successful exploitation could exhaust a listening socket\u0027s accept queue (denial of service), inject data into existing AF_IUCV connections, control the peer identity of accepted child sockets, and disrupt or kill established connections. Multiple Red Hat Enterprise Linux kernel and kernel-rt update streams and Red Hat In-Vehicle OS kernel streams are affected, and fixes are being pursued in the respective product streams; the kernel-ivos-qualcomm component of Red Hat In-Vehicle OS is not affected because the vulnerable code is not present in that kernel. The Red Hat severity of IMPORTANT (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L) is lower than the upstream CVE.org rating of 8.1 (AV:A/AC:L/PR:N): Red Hat assessed the dominant exploitation path as local, requiring privileges and high attack complexity, whereas the upstream rating emphasizes the adjacent-network HiperSockets vector requiring no privileges. Note that AF_IUCV over HiperSockets provides no per-connection authentication, so the fix reduces the attack surface to peers present on the same HiperSockets segment but does not change that protocol-level property.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-81003"
},
{
"category": "external",
"summary": "RHBZ#2532515",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532515"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-81003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-81003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-81003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81003"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81003.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81003.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device"
},
{
"cve": "CVE-2026-86138",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-09-05T04:31:00.379678+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528986"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2, a software library for parsing XML documents. An integer overflow within the `xmlDictAddQString` function can lead to a heap-based buffer overflow. This vulnerability could allow a local attacker to execute arbitrary code on the system, potentially compromising its integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate severity heap-based buffer overflow in libxml2, specifically within the `xmlDictAddQString` function, could enable arbitrary code execution. While no user interaction or privileges are required, the high attack complexity and local attack vector reduce the overall risk in Red Hat environments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86138"
},
{
"category": "external",
"summary": "RHBZ#2528986",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528986"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86138",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86138"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86138"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4",
"url": "https://github.com/GNOME/libxml2/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:21:53.127000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Bound XML document and QName (prefix + local name) size before intern. Cap process and cgroup memory so a ~4 GiB dictionary pool cannot be built. Keep FORTIFY_SOURCE and heap hardening on Red Hat binaries.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow"
},
{
"cve": "CVE-2026-86140",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-09-05T04:41:05.796692+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528989"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libxml2. A local attacker could exploit a stack-based buffer overflow in the `xmlSnprintfElements` function to achieve arbitrary code execution. This vulnerability in a fundamental system library could lead to significant system compromise if successfully exploited.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in libxml2 allows a local attacker to achieve arbitrary code execution due to a stack-based buffer overflow. While requiring local access, the vulnerability\u0027s presence in a fundamental system library could lead to significant system compromise if exploited.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86140"
},
{
"category": "external",
"summary": "RHBZ#2528989",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528989"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86140",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86140"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86140"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340",
"url": "https://github.com/GNOME/libxml2/commit/d1686f91dbda141a752200419d35639fd6b38340"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:26:13.860000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this, administrators should disable DTD processing and validation for untrusted documents within libxml2 parsers and restrict network access so only authorized users can submit XML data to the application. For robust defense-in-depth against buffer overflow exploitation, ensure the library and dependent applications are compiled with memory safety flags like stack canaries (-fstack-protector-strong) and bounds checking (_FORTIFY_SOURCE=2), while verifying that standard OS-level protections such as ASLR and Data Execution Prevention (NX/XD Bit) are active on the host system.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements"
},
{
"cve": "CVE-2026-86142",
"cwe": {
"id": "CWE-805",
"name": "Buffer Access with Incorrect Length Value"
},
"discovery_date": "2026-09-05T04:41:08.714165+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528990"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s xmlXPtrEvalXPtrPart function allows a local attacker to cause a heap-based buffer overflow. An integer overflow while processing an oversized xpointer() expression leads to incorrect memory allocation and an out-of-bounds write, potentially resulting in information disclosure, data corruption, or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A heap-based buffer overflow in libxml2\u0027s xmlXPtrEvalXPtrPart function enables an out-of-bounds write during the evaluation of oversized xpointer() expressions. The flaw is assigned a Moderate severity rating because exploitation strictly requires local access and complex, multi-gigabyte payload inputs, effectively mitigating the threat of remote or automated system compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86142"
},
{
"category": "external",
"summary": "RHBZ#2528990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528990"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86142"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58",
"url": "https://github.com/GNOME/libxml2/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113"
}
],
"release_date": "2026-09-05T04:29:33.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this applications should avoid passing untrusted XPointer expressions into xmlXPtrEval or XInclude xpointer= attributes and strictly cap input length well below INT_MAX. Additionally, administrators should enforce process or cgroup memory limits to prevent the construction of multi-gigabyte scheme bodies, relying on heap allocator hardening rather than standard fortify flags, which cannot stop this byte-store loop.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation"
},
{
"cve": "CVE-2026-86143",
"cwe": {
"id": "CWE-192",
"name": "Integer Coercion Error"
},
"discovery_date": "2026-09-05T04:40:59.552825+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528987"
}
],
"notes": [
{
"category": "description",
"text": "An integer overflow in the libxml2 xmlIO module occurs when data backlogs exceed maximum integer limits. This flaw passes negative length values to downstream write callbacks, creating an unsafe state that can lead to data corruption or compromise application confidentiality and integrity.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate impact: This flaw in libxml2, a widely used XML parsing library, is due to an integer overflow in write callbacks. This can lead to negative lengths being passed to write operations, potentially causing data integrity issues in applications that process untrusted XML input and utilize affected write callbacks. The impact is limited to applications that specifically trigger this overflow condition.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86143"
},
{
"category": "external",
"summary": "RHBZ#2528987",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528987"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86143"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35",
"url": "https://github.com/GNOME/libxml2/commit/90f293ba74d28b1d570920382e707586f68ebf35"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111"
}
],
"release_date": "2026-09-05T04:31:21.187000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Cap process and cgroup memory so a process cannot build a \u22652 GiB libxml2 output backlog. Keep FORTIFY_SOURCE-built Red Hat binaries so some callback copies of the truncated length abort instead of corrupting memory",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks"
},
{
"cve": "CVE-2026-86144",
"cwe": {
"id": "CWE-669",
"name": "Incorrect Resource Transfer Between Spheres"
},
"discovery_date": "2026-09-05T04:50:58.626617+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528992"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in libxml2\u0027s XInclude processing (xmlXIncludeProcess and xmlXIncludeProcessTree) fails to propagate parser flags like XML_PARSE_NONET. This allows custom resource loaders to fetch external network resources, potentially enabling Server-Side Request Forgery (SSRF), XML External Entity (XXE) injection, or Denial of Service (DoS) attacks.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A Moderate-severity flaw in libxml2 XInclude processing allows custom resource loaders to bypass network restriction flags, enabling unintended external network connections that could cause SSRF, information disclosure, or Denial of Service (DoS). Exploitation requires local access alongside high attack complexity, limiting its immediate widespread impact.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86144"
},
{
"category": "external",
"summary": "RHBZ#2528992",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528992"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86144"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61",
"url": "https://github.com/GNOME/libxml2/commit/b63cd517afecb76582dd9488c55e54ceaf50de61"
},
{
"category": "external",
"summary": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4",
"url": "https://github.com/GNOME/libxml2/compare/v2.15.3...v2.15.4"
}
],
"release_date": "2026-09-05T04:34:43.972000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Do not expand untrusted XInclude; parse without XML_PARSE_XINCLUDE and do not call xmlXIncludeProcess / xmlXIncludeProcessTree. If XInclude is required, pass XML_PARSE_NONET (and XML_PARSE_NO_XXE where available) via xmlXIncludeProcessFlags, and restrict outbound fetches.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation."
},
{
"cve": "CVE-2026-86145",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-05T05:20:54.676360+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528993"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the `pcre2_dfa_match` function due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: An out-of-bounds write vulnerability in the PCRE2 library, specifically within the `pcre2_dfa_match` function, could allow arbitrary code execution. This flaw is exploitable in Red Hat products when processing attacker-controlled regular expressions or when a recursive pattern is used in conjunction with a small, API-set heap limit, making it dependent on specific application usage patterns.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-86145"
},
{
"category": "external",
"summary": "RHBZ#2528993",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528993"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-86145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-86145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86145"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf"
}
],
"release_date": "2026-09-05T05:09:25.571000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this Improper Protection of Alternate Path vulnerability, ensure that secondary execution branches\u2014such as the reuse of cached memory workspaces\u2014enforce the exact same size and boundary checks as the primary memory allocation paths. Limit exposure by preventing untrusted user input from directly controlling PCRE2 regular expressions, and strictly avoid utilizing recursive matching patterns when operating under a low heap limit. Apply a defense-in-depth strategy by validating all inputs comprehensively.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions"
},
{
"cve": "CVE-2026-89161",
"cwe": {
"id": "CWE-1341",
"name": "Multiple Releases of Same Resource or Handle"
},
"discovery_date": "2026-09-11T04:21:06.963234+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2531747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PCRE2, a library for processing regular expressions. The `pcre2_jit_match` function, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important memory corruption vulnerability in PCRE2\u0027s JIT compiler. An attacker could exploit a flaw in `pcre2_jit_match` when a previously copied subject is passed as context, potentially leading to arbitrary code execution or denial of service. The high attack complexity and local attack vector reduce the overall risk, but the widespread use of PCRE2 and the potential for severe impact warrant the Important classification.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89161"
},
{
"category": "external",
"summary": "RHBZ#2531747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89161",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89161"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89161"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/pull/937",
"url": "https://github.com/PCRE2Project/pcre2/pull/937"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
"url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
}
],
"release_date": "2026-09-11T04:11:51.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match"
},
{
"cve": "CVE-2026-89480",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532095"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the NVMe-TCP implementation of the Linux kernel. This vulnerability occurs when the system completes a data read request even if the connected controller transfers fewer bytes than expected. As a result, the user application receives a mix of legitimate and stale data, potentially leading to information disclosure or data integrity issues.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nvme-tcp: reject a read that transferred too few bytes",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89480"
},
{
"category": "external",
"summary": "RHBZ#2532095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532095"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89480",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89480"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89480",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89480"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89480.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89480.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Prevent the nvme-tcp kernel module from loading if NVMe-over-TCP storage connectivity is not required on the host:\n\n1. Create a configuration file to blacklist the driver and prevent it from loading:\n# echo \"install nvme-tcp /bin/true\" \u003e /etc/modprobe.d/nvme-tcp.conf\n# echo \"blacklist nvme-tcp\" \u003e\u003e /etc/modprobe.d/nvme-tcp.conf\n\n2. If the module is currently loaded, unload it:\n# modprobe -r nvme-tcp\n\nCaveats:\nApplying this operational workaround disables all NVMe-over-TCP initiator functionality and prevents connections to NVMe-oF network storage fabrics. If the module is actively in use by mounted file systems or active block devices, it cannot be safely unloaded at runtime without first unmounting those targets, and a system reboot may be required to cleanly unload the driver.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: nvme-tcp: reject a read that transferred too few bytes"
},
{
"cve": "CVE-2026-89481",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532184"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s NVMe (Non-Volatile Memory Express) over TCP (nvme-tcp) component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer (R2T) command for a read request. The host system, failing to properly validate the request direction, will then send the contents of its read destination buffer to the controller. This can lead to the disclosure of stale kernel memory data, potentially revealing sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nvme-tcp: fix host memory disclosure on R2T for a read command",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89481"
},
{
"category": "external",
"summary": "RHBZ#2532184",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532184"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89481",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89481"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89481",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89481"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89481.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Prevent the nvme-tcp kernel module from loading if NVMe over TCP storage is not required on the system.\n\n1. Add an entry to /etc/modprobe.d to prevent the module from loading:\n# echo \"install nvme-tcp /bin/true\" \u003e\u003e /etc/modprobe.d/disable-nvme-tcp.conf\n\n2. If the module is currently loaded and not in use by any storage target, unload it:\n# modprobe -r nvme-tcp\n\nCaveats:\nDisabling this module prevents the system from connecting to NVMe over TCP block storage devices.\n\nWarning:\nDo not attempt to unload this module if active NVMe over TCP storage is mounted or in use, as doing so will cause I/O failure and potential data loss. If the module cannot be cleanly unloaded, a system restart is required for the change to take full effect. Additionally, restrict NVMe-oF connections to verified, trusted storage targets over isolated or encrypted network fabrics.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nvme-tcp: fix host memory disclosure on R2T for a read command"
},
{
"cve": "CVE-2026-89663",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532231"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Network File System Daemon (nfsd). This vulnerability arises from improper handling of \"copy-notify stateids\" during their revocation. When a stateid\u0027s reference is dropped without unlinking it, the memory can be freed while still in use by a reader, leading to a use-after-free condition. This can cause system instability and potentially allow for unauthorized access.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nfsd: revoke copy-notify stateids before dropping their reference",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89663"
},
{
"category": "external",
"summary": "RHBZ#2532231",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532231"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89663"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89663",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89663"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89663.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89663.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, disable the NFS server service or restrict access to trusted networks:\n\n1. If the system does not require NFS server functionality, stop and disable the service:\n```\nsystemctl stop nfs-server.service\nsystemctl disable --now nfs-server.service\n```\n\nTo prevent the kernel module from being automatically loaded, create a modprobe configuration:\n```\necho \"install nfsd /bin/true\" \u003e /etc/modprobe.d/disable-nfsd.conf\n```\n\n2. If the NFS server must remain operational, restrict network access to port 2049 using firewalld to ensure only authorized clients can connect:\n```\nfirewall-cmd --permanent --remove-service=nfs\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_OR_SUBNET\u003e\nfirewall-cmd --permanent --zone=trusted --add-service=nfs\nfirewall-cmd --reload\n```\n\nCaveats: Stopping the NFS server or blacklisting nfsd prevents all NFS exports. Applying firewall rules or disabling the service will disconnect active NFS clients and requires a firewall reload or service restart.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nfsd: revoke copy-notify stateids before dropping their reference"
},
{
"cve": "CVE-2026-89669",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `nfsd` component of the Linux kernel. A use-after-free vulnerability exists due to improper initialization of the copy-notify state ID before its publication. A remote attacker could exploit this by sending a crafted `OFFLOAD_CANCEL` operation, leading to a race condition that frees the state ID prematurely. This could result in a use-after-free, potentially allowing for arbitrary code execution or denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nfsd: initialize copy-notify stateid before publishing it",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89669"
},
{
"category": "external",
"summary": "RHBZ#2532111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89669"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89669",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89669"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89669.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89669.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nfsd: initialize copy-notify stateid before publishing it"
},
{
"cve": "CVE-2026-89690",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2532103"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `nfsd` component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead to memory corruption. This could result in a system crash (denial of service) or potentially allow an attacker to gain elevated privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89690"
},
{
"category": "external",
"summary": "RHBZ#2532103",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532103"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89690",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89690"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89690",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89690"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89690.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89690.mbox"
}
],
"release_date": "2026-09-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF"
},
{
"cve": "CVE-2026-89811",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535309"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s drm/amdkfd component. This vulnerability arises from a race condition where the Micro Engine Scheduler (MES) fails to perform a necessary Translation Lookaside Buffer (TLB) invalidation after unmapping queues. This oversight allows in-flight Direct Memory Access (DMA) descriptors to access memory that has already been unmapped, leading to page faults and potential GPU queue hangs, particularly during Shared Virtual Memory (SVM) page migration.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89811"
},
{
"category": "external",
"summary": "RHBZ#2535309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535309"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89811",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89811"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89811",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89811"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89811.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Prevent the amdgpu kernel module from loading:\n\n1. Create a configuration file to prevent module loading:\n# echo \"install amdgpu /bin/true\" \u003e /etc/modprobe.d/disable-amdgpu.conf\n\n2. Rebuild the initial RAM disk:\n# dracut -f\n\nWarning: A system reboot is required for this change to take effect if the driver is currently loaded. Disabling the amdgpu driver prevents graphical acceleration and GPU compute operations on systems with AMD graphics hardware, and display servers may fail or revert to basic framebuffer mode.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension"
},
{
"cve": "CVE-2026-89894",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s cx231xx media driver. A local attacker can exploit this vulnerability by manipulating video and Vertical Blanking Interval (VBI) queue operations. This allows for a heap out-of-bounds write, which could lead to arbitrary code execution or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: media: cx231xx: reject geometry changes while the VBI queue is busy",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this Important severity flaw in the Linux kernel\u0027s cx231xx USB video capture (media) driver, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and in Red Hat In-Vehicle OS 2. The driver\u0027s vidioc_s_fmt_vid_cap() and vidioc_s_std() operations change device-wide geometry (dev-\u003ewidth / dev-\u003enorm) but only refuse the change when the video queue is busy. Because the VBI node shares those ioctl operations, a local attacker with access to the cx231xx device can allocate a small VBI videobuf2 plane and then enlarge dev-\u003ewidth or switch dev-\u003enorm through the video node while the VBI stream is running. cx231xx_do_vbi_copy() then recomputes the copy destination offset from the larger live geometry and memcpy()s device-delivered data past the end of the smaller, already allocated plane, producing a heap out-of-bounds write with an attacker-chosen offset. This kernel memory corruption can lead to privilege escalation, arbitrary code execution, or a system crash (denial of service). Red Hat Enterprise Linux 6, 7, and 8, including their kernel-rt builds, are not affected because the vulnerable code is not present in those kernels. Red Hat scores this flaw 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), slightly lower than the upstream 7.8 score, because reliable exploitation requires precise manipulation of VBI queue geometry and device-delivered data in addition to local access to the video device. Fixes for the affected products are being pursued through the standard Red Hat update process.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89894"
},
{
"category": "external",
"summary": "RHBZ#2535338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89894",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89894"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89894",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89894"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89894.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89894.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: media: cx231xx: reject geometry changes while the VBI queue is busy"
},
{
"cve": "CVE-2026-89972",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535140"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the NVMe (Non-Volatile Memory Express) driver of the Linux kernel. The nvme_alloc_ns() function\u0027s error handling path fails to wait for all SRCU (Sleepable Read-Copy Update) readers to complete before freeing a namespace structure. This oversight allows a concurrent reader to access a freed memory region, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause a system crash or achieve arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nvme: add missing SRCU grace period in error path",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89972"
},
{
"category": "external",
"summary": "RHBZ#2535140",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535140"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89972",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89972"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89972",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89972"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89972.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89972.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nvme: add missing SRCU grace period in error path"
},
{
"cve": "CVE-2026-90036",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535158"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Network File System Daemon (NFSD). A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client\u0027s lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This can result in memory corruption when the system attempts to access freed memory, potentially leading to a denial of service or arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: NFSD: Prevent client use-after-free during blocked-lock reaping",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A use-after-free flaw rated IMPORTANT by Red Hat was found in the Linux kernel\u0027s NFS server (NFSD) blocked-lock handling. When the per-network-namespace laundromat reaps a blocked lock whose lock owner holds only a raw pointer to its nfs4_client, without any reference keeping that client alive, a concurrent client expiry can free the client before nfs4_put_stateowner() runs, causing the client\u0027s cl_lock to be dereferenced in freed memory. This memory corruption can lead to a kernel panic (denial of service) or potentially arbitrary code execution. Exploitation requires winning a race condition between blocked-lock reaping and forced client expiry on the NFS server, which makes reliable exploitation difficult. Red Hat products that ship the affected kernel code are impacted, including Red Hat Enterprise Linux (kernel and kernel-rt) and Red Hat In-Vehicle OS (kernel); a fix is being pursued by the responsible engineering teams. The kernel-ivos-qualcomm components in Red Hat In-Vehicle OS are not affected because the vulnerable code is not present. Red Hat rates this flaw lower (CVSS 7.0, IMPORTANT) than the upstream CVE.org assessment (CVSS 9.8, CRITICAL) because triggering the flaw requires a successful race on the server rather than a straightforward unauthenticated network attack.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90036"
},
{
"category": "external",
"summary": "RHBZ#2535158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535158"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90036",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90036"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90036",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90036"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90036.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90036.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this issue, stop and disable the NFS server service if NFS exports are not required:\n```\nsystemctl stop nfs-server\nsystemctl mask nfs-server\n```\n\nAlternatively, if the NFS server must remain operational, restrict network reachability to trusted clients or subnets using firewall rules:\n```\nfirewall-cmd --permanent --remove-service=nfs\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_client_IP_or_CIDR\u003e\nfirewall-cmd --permanent --zone=trusted --add-service=nfs\nfirewall-cmd --reload\n```\n\nCaveats: Disabling the service stops all file sharing functionality, and firewall rules will block any unlisted clients from mounting or accessing exports.\nWarning: Stopping the NFS service or reloading firewall configurations will disconnect existing client sessions and disrupt active file operations.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: NFSD: Prevent client use-after-free during blocked-lock reaping"
},
{
"cve": "CVE-2026-90227",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-09-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2536346"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s NVMe (Non-Volatile Memory Express) input/output control (ioctl) handling. An unprivileged local user could exploit this vulnerability by bypassing access checks in the `NVME_IOCTL_SUBMIT_IO` function. This allows them to perform unauthorized I/O operations on a partition device or write to a read-only file descriptor, potentially leading to privilege escalation or unauthorized data modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90227"
},
{
"category": "external",
"summary": "RHBZ#2536346",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536346"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90227",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90227"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90227",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90227"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90227.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90227.mbox"
}
],
"release_date": "2026-09-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()"
},
{
"cve": "CVE-2026-93207",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540182"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s SUNRPC (Sun Remote Procedure Call) component. Improper handling of credential data during the decoding process can lead to a dangling pointer, a form of memory corruption. This issue may allow a remote attacker to cause a denial of service by triggering early decode failures, leading to incorrect state management and potentially system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of moderate impact was found in the Linux kernel\u0027s SUNRPC subsystem, in the server-side GSS credential decoding path svcauth_gss_decode_credbody(). The function writes the caller\u0027s rpc_gss_wire_cred field by field and assigns gc_ctx.len only on the success tail, while the destination storage (svcdata-\u003eclcred in the per-svc_rqst gss_svc_data) is pooled and reused across requests. Early decode failures therefore leave partially decoded state mixed with residue from the previous request. In the sharpest case, the trailing body_len tightness check leaves gc_ctx.data pointing into the current request\u0027s XDR pages while gc_ctx.len retains a stale value from a prior request; once those pages are released, the pooled credential carries a dangling pointer paired with a stale length, which length-driven consumers such as gss_svc_searchbyctx() may otherwise walk, a form of memory corruption. Per the CVE description, a remote attacker able to trigger early decode failures against an RPC service using GSS authentication (for example NFS with RPCSEC_GSS) could use this issue to cause a denial of service through incorrect state management and system instability. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL 9 CoreOS are affected, and fixes are being pursued for those streams. RHEL 6, 7, 8, and 9.2, and OpenShift Container Platform releases built on RHEL 8 CoreOS, are not affected because the vulnerable code is not present in those kernels. Red Hat\u0027s severity assessment (impact Moderate, CVSS 3.1 score 7.0, vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) differs significantly from the upstream CVEORG rating of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): the Red Hat vector reflects a local attack vector with high attack complexity and some privileges required, whereas the upstream record treats the flaw as remotely exploitable without privileges; the primary documented consequence is denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93207"
},
{
"category": "external",
"summary": "RHBZ#2540182",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540182"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93207"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93207",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93207"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93207.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93207.mbox"
}
],
"release_date": "2026-09-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Updating to kernel packages that contain the upstream fix resolves the issue; fixes have already shipped for some affected Red Hat Enterprise Linux streams and are being pursued for the remaining affected streams.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry"
},
{
"cve": "CVE-2026-93228",
"cwe": {
"id": "CWE-839",
"name": "Numeric Range Comparison Without Minimum Check"
},
"discovery_date": "2026-09-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540230"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma). A remote peer can exploit this issue by transmitting a malformed Write or Reply chunk with a segment count of zero. Because the kernel fails to validate that the segment count is greater than zero, it accepts and links degenerate chunk structures onto internal processing lists. This flaw may result in unexpected memory traversal or a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: svcrdma: Reject Write/Reply chunks with segcount 0",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw of moderate impact was found in the Linux kernel\u0027s Remote Procedure Call over Remote Direct Memory Access (RPC-over-RDMA) server component (svcrdma) as shipped in Red Hat Enterprise Linux and Red Hat In-Vehicle OS. The XDR chunk validation (xdr_check_write_chunk()) only rejected segment counts above the allowed maximum, so a Write or Reply chunk with a segment count of zero passed the range check, and a degenerate zero-segment chunk structure was linked onto the server\u0027s internal parsed chunk lists. A remote peer able to send requests to the svcrdma transport could transmit such a malformed chunk, which could lead to unexpected memory traversal or a denial of service of the affected kernel. Confidentiality and integrity are not affected; the impact is limited to availability.\n\nRed Hat Enterprise Linux 6 is out of support scope, and Red Hat Enterprise Linux 7 (kernel and kernel-rt) as well as the Red Hat Enterprise Linux 8.4 z-stream are not affected because the vulnerable code is not present in those kernels. The affected Red Hat Enterprise Linux 8, 9, and 10 update streams (including kernel-rt) and Red Hat In-Vehicle OS 2 are affected, and fixes are being pursued through the delegated update streams.\n\nThe CVE.org record scores this flaw 9.1 (Critical) using a network attack vector with high confidentiality and availability impact, whereas Red Hat scores it 5.5 (Moderate) with no confidentiality or integrity impact, reflecting Red Hat\u0027s assessment of the limited security impact on the affected kernel.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93228"
},
{
"category": "external",
"summary": "RHBZ#2540230",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540230"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93228",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93228"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93228",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93228"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93228.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93228.mbox"
}
],
"release_date": "2026-09-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: svcrdma: Reject Write/Reply chunks with segcount 0"
},
{
"cve": "CVE-2026-93288",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540500"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s netfilter subsystem. When a network namespace is dismantled, the packet logging component frees memory without waiting for ongoing logging operations to complete, resulting in a use-after-free condition. A local attacker could exploit this flaw during network traffic processing to cause a system crash, leading to a Denial of Service (DoS), or potentially execute arbitrary code.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93288"
},
{
"category": "external",
"summary": "RHBZ#2540500",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540500"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93288",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93288"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93288",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93288"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93288.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93288.mbox"
}
],
"release_date": "2026-09-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Prevent the nfnetlink_log kernel module from being loaded by creating a configuration file:\n\n# echo \"install nfnetlink_log /bin/true\" \u003e /etc/modprobe.d/disable-nfnetlink_log.conf\n\nIf the module is currently loaded, attempt to unload it:\n\n# modprobe -r nfnetlink_log\n\nCaveats: If the module is in use, unloading it dynamically will fail, and a system reboot will be required for the configuration to take effect. Disabling nfnetlink_log prevents netfilter from logging packets via this netlink interface.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state"
},
{
"cve": "CVE-2026-93817",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540391"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s performance events (perf) subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performance monitoring operations to cause a Denial of Service (DoS) through a system crash or potentially corrupt system memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: perf: Fix addr_filter_ranges lifetime",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93817"
},
{
"category": "external",
"summary": "RHBZ#2540391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540391"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93817",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93817"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93817",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93817"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93817.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-93817.mbox"
}
],
"release_date": "2026-09-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Restrict unprivileged access to the perf event subsystem by setting the `kernel.perf_event_paranoid` sysctl parameter.\n\n1. Apply the setting immediately:\n```\nsysctl -w kernel.perf_event_paranoid=3\n```\n\n2. Persist the configuration across system reboots:\n```\necho \u0027kernel.perf_event_paranoid = 3\u0027 \u003e /etc/sysctl.d/99-perf.conf\n```\n\nCaveats:\nSetting `kernel.perf_event_paranoid` to 3 disables the use of the `perf_event_open()` system call for unprivileged users, preventing them from using performance monitoring tools such as `perf`. Only processes with `CAP_SYS_ADMIN` or `CAP_PERFMON` capabilities will be permitted to access performance events.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: perf: Fix addr_filter_ranges lifetime"
},
{
"cve": "CVE-2026-93990",
"cwe": {
"id": "CWE-176",
"name": "Improper Handling of Unicode Encoding"
},
"discovery_date": "2026-09-22T21:50:24.320578+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2538967"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enable XML injection attacks, potentially leading to information disclosure or other integrity impacts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: Expat: XML Injection via Malformed UTF-16 Input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in Expat, which can lead to XML injection. The vulnerability arises from improper validation of UTF-16 surrogate pairs, allowing attackers to craft malformed XML that can bypass parser security checks. This could result in data integrity compromise in applications processing untrusted XML input.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-93990"
},
{
"category": "external",
"summary": "RHBZ#2538967",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2538967"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-93990",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93990"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-93990",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93990"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat",
"url": "https://github.com/libexpat/libexpat"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a",
"url": "https://github.com/libexpat/libexpat/commit/ff6e1d7e750bbe245178f51a47a965dc8342861a"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1282",
"url": "https://github.com/libexpat/libexpat/pull/1282"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate",
"url": "https://www.vulncheck.com/advisories/expat-through-2.8.4-malformed-utf-16-acceptance-via-unchecked-surrogate"
}
],
"release_date": "2026-09-19T22:58:11.224000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "To mitigate this restrict which hosts can send XML (including UTF-16) to Expat-based services with a host firewall and network segmentation. Where applications allow, prefer UTF-8-only input and reject unexpected encodings.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: Expat: XML Injection via Malformed UTF-16 Input"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-94640",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2026-04-26T20:30:43+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2462960"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedure Call) statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage. This can degrade or exhaust service availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94640"
},
{
"category": "external",
"summary": "RHBZ#2462960",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462960"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94640",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94640"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94640",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94640"
}
],
"release_date": "2026-07-22T07:45:42.927000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Restrict network access to the `rpcbind` service on port 111 to trusted systems. This can be achieved by configuring firewall rules to limit inbound connections. For example, using `firewalld` on Red Hat Enterprise Linux:\n\n```bash\n# To allow access only from a specific trusted network (e.g., 192.168.1.0/24)\nfirewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"111\" protocol=\"tcp\" accept\u0027\nfirewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"192.168.1.0/24\" port port=\"111\" protocol=\"udp\" accept\u0027\nfirewall-cmd --reload\n```\n\nIf `rpcbind` is only required for local services, ensure it is configured to listen only on the loopback interface or is otherwise protected from external network exposure. Applying these firewall rules will take effect immediately upon `firewall-cmd --reload` and may temporarily interrupt existing connections to `rpcbind`.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service"
},
{
"cve": "CVE-2026-97417",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"discovery_date": "2026-09-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2540479"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s netfilter connection tracking subsystem. The TCP option processing mechanism improperly assumes memory alignment when reading packet headers. A remote attacker could exploit this vulnerability by sending crafted TCP packets with misaligned SACK options through a system running conntrack (e.g., Linux firewall/NAT using iptables/nftables), causing a memory access fault that leads to a kernel panic and Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97417"
},
{
"category": "external",
"summary": "RHBZ#2540479",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2540479"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97417",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97417"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97417",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97417"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97417.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-97417.mbox"
}
],
"release_date": "2026-09-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Systems that do not require stateful firewall, NAT, or connection tracking can eliminate exposure by unloading the nf_conntrack kernel module. On systems where conntrack is required, exposure can be reduced by applying NOTRACK rules in the raw table to bypass connection tracking on untrusted or internet-facing interfaces, ensuring the vulnerable TCP SACK parsing code path in tcp_sack() is not reached for attacker-controlled traffic.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()"
},
{
"cve": "CVE-2026-99999",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ipv4: validate checksum_start before completing checksum",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT-severity flaw affects the Linux kernel as shipped in Red Hat products, including the kernel and kernel-rt packages in Red Hat Enterprise Linux and the kernels shipped in Red Hat In-Vehicle OS. The IPv4 networking subsystem does not validate packet checksum metadata before completing a checksum: when a packet with a malformed checksum_start value enters the IPv4 stack, skb_checksum_help() can write out of bounds and corrupt the network header and other kernel memory (CWE-787). A local attacker or an untrusted guest virtual machine able to transmit such packets into an affected host could exploit this to crash the system (denial of service), disclose sensitive kernel memory, or potentially execute arbitrary code on the host. Red Hat tracks this flaw as a KEV active-exploit case. All currently tracked Red Hat product streams are marked affected, and fixes are being pursued by the responsible Red Hat product teams under delegated resolution. Red Hat\u0027s severity differs from the upstream assessment: Red Hat assigns a CVSS 3.1 score of 8.8 (IMPORTANT, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the CVE.org record assigns 9.3 (CRITICAL, AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); the two assessments differ on the privileges-required metric.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-99999"
},
{
"category": "external",
"summary": "RHBZ#2553429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-99999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox"
}
],
"release_date": "2026-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: ipv4: validate checksum_start before completing checksum"
},
{
"cve": "CVE-2026-103111",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-30T04:40:56.869940+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2543797"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "pcre2: pcre2: Out-of-bounds write via crafted regular expression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because applications that compile untrusted regular expressions using PCRE2 Just-In-Time (JIT) execution interfaces may allow memory corruption and arbitrary code execution. The risk is primarily confined to specific custom applications or specialized network services that process external regular expressions using vulnerable JIT routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103111"
},
{
"category": "external",
"summary": "RHBZ#2543797",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543797"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103111"
},
{
"category": "external",
"summary": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m",
"url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m"
}
],
"release_date": "2026-09-30T04:13:59.115000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression"
},
{
"cve": "CVE-2026-103262",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-10-01T10:56:14.609538+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2544534"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tornado. A remote malicious server can cause a Denial of Service (DoS) when an application using the CurlAsyncHTTPClient component fetches an untrusted web address. Because the client fails to enforce limits on incoming response sizes, the attacker can return a small, highly compressed payload (a decompression bomb) that expands to an enormous size. This unbounded memory consumption exhausts system resources and crashes the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability has been rated as Important because an untrusted remote server can remotely terminate an application process through memory exhaustion without requiring credentials. By default, Tornado deploys the SimpleAsyncHTTPClient implementation, which includes built-in thresholds for decompressed and raw payload sizes and remains unaffected by this flaw. However, systems that explicitly configure CurlAsyncHTTPClient\u2014typically enabled for custom proxy routing or advanced transport options\u2014bypass these protections and do not enforce body size constraints. When such client applications fetch resources from compromised or malicious web endpoints, the resulting decompression bomb can consume all available system memory, leading to an immediate denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-103262"
},
{
"category": "external",
"summary": "RHBZ#2544534",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2544534"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-103262",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-103262"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-103262",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103262"
},
{
"category": "external",
"summary": "https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9",
"url": "https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9"
},
{
"category": "external",
"summary": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp",
"url": "https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient",
"url": "https://www.vulncheck.com/advisories/tornado-before-6.5.9-denial-of-service-via-curlasynchttpclient"
}
],
"release_date": "2026-10-01T10:42:04.913000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "Restrict outbound HTTP client requests to trusted destinations and avoid using the CurlAsyncHTTPClient backend when fetching untrusted web content.\n\n1. Application configuration: Configure Tornado applications to utilize the default SimpleAsyncHTTPClient instead of CurlAsyncHTTPClient, provided specialized libcurl functionality (such as custom proxy configurations or specific TLS options) is not required. The default client enforces strict size boundaries on compressed and uncompressed response bodies.\n2. Network egress filtering: Implement firewall rules or egress network policies to restrict outbound HTTP/HTTPS connections exclusively to verified, trustworthy endpoints, preventing the client from contacting potentially malicious third-party servers.\n3. Operational controls: Ensure that user-supplied or untrusted URLs are validated, sanitized, or rejected before initiating outbound retrieval requests.\n\nCaveats: Switching the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient may disrupt services that depend on libcurl-specific features. Enforcing egress filtering may block connections to unlisted external services.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient"
},
{
"cve": "CVE-2026-114406",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-20T09:01:55.916000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556046"
}
],
"notes": [
{
"category": "description",
"text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "RHBZ#2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
}
],
"release_date": "2026-10-20T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T22:03:20+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813\n\n (For s390x architecture)\n The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e\n\n (For ppc64le architecture)\n The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2\n\n (For aarch64 architecture)\n The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:89197"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202610241758-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202610241758-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.