RHSA-2026:90272
Vulnerability from csaf_redhat - Published: 2026-10-27 17:59 - Updated: 2026-10-30 00:51Summary
Red Hat Security Advisory: OpenShift Container Platform 4.12.102 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.12.102 is now available with updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.12.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.102. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:90271
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
Security Fix(es):
None
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system's boot and network behavior.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Important
A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Important
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Important
A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Important
A flaw was found in the Linux kernel's PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could potentially trigger this condition, causing memory corruption. This could result in a system crash (denial of service) or other unpredictable system behavior.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Low
A flaw was found in the Linux kernel's RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the `free_rd_atomic_resources()` function by updating the `max_dest_rd_atomic` value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a system crash, resulting in a denial of service (DoS).
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Moderate
A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker to cause a system crash and resulting in a Denial of Service (DoS).
7.0 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Moderate
A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Important
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
6.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2026-6893
Threats
Impact
Critical
References
65 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.12.102 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.12.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.12.102. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHSA-2026:90271\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nSecurity Fix(es):\n\nNone\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:90272",
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "2503147",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503147"
},
{
"category": "external",
"summary": "2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "2513233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513233"
},
{
"category": "external",
"summary": "2528646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528646"
},
{
"category": "external",
"summary": "2528665",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528665"
},
{
"category": "external",
"summary": "2553429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
},
{
"category": "external",
"summary": "2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_90272.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.12.102 bug fix and security update",
"tracking": {
"current_release_date": "2026-10-30T00:51:50+00:00",
"generator": {
"date": "2026-10-30T00:51:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.3"
}
},
"id": "RHSA-2026:90272",
"initial_release_date": "2026-10-27T17:59:35+00:00",
"revision_history": [
{
"date": "2026-10-27T17:59:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-10-27T17:59:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-10-30T00:51:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.12",
"product": {
"name": "Red Hat OpenShift Container Platform 4.12",
"product_id": "8Base-RHOSE-4.12",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.12::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-412.86.202610250235-0",
"product": {
"name": "rhcos-x86_64-412.86.202610250235-0",
"product_id": "rhcos-x86_64-412.86.202610250235-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@412.86.202610250235?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-412.86.202610250235-0 as a component of Red Hat OpenShift Container Platform 4.12",
"product_id": "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
},
"product_reference": "rhcos-x86_64-412.86.202610250235-0",
"relates_to_product_reference": "8Base-RHOSE-4.12"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"AISLE Research"
]
}
],
"cve": "CVE-2026-6893",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-04-21T02:37:23+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2459963"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP (Dynamic Host Configuration Protocol) options, such as a malicious hostname, to a system using dracut\u0027s legacy DHCP path. These options are improperly handled and written into temporary shell scripts without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs, potentially compromising the system\u0027s boot and network behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: Root code execution via DHCP options command injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in dracut\u0027s legacy DHCP client script (`dhclient-script.sh`) that allows command injection. An attacker on the adjacent network can exploit this by providing specially crafted DHCP options, leading to root code execution within the initramfs. This primarily affects systems configured to use DHCP for network setup during the initial boot phase.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6893"
},
{
"category": "external",
"summary": "RHBZ#2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6893",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6893"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6893"
}
],
"release_date": "2026-06-10T19:39:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "To mitigate this issue, ensure that systems configured to obtain network settings via DHCP in the initramfs are only booted on trusted networks. This vulnerability requires an attacker to control a DHCP server on the adjacent network segment. If network configuration via DHCP is not strictly necessary during the initramfs phase, consider using static network configuration.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: Root code execution via DHCP options command injection"
},
{
"acknowledgments": [
{
"names": [
"Pavel Valena"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-15816",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-06-10T19:21:21+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2500889"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw\u0027s impact as Important. Exploitation requires an attacker-controlled or spoofed DHCP server on the same network segment as a system performing network boot (root=dhcp/netroot=dhcp), and for the DHCP-supplied ROOT_PATH value to fail dracut\u0027s netroot handler resolution -- both fully within an adjacent-network attacker\u0027s control. Reaching the point where the poisoned hook script is actually sourced depends on dracut\u0027s boot-failure handling reinvoking the emergency shell mechanism, which occurs by default when the netroot handler cannot be resolved. This is a separate code path from CVE-2026-6893, which patched modules.d/35network-legacy/dhclient-script.sh but did not modify dracut-lib.sh\u0027s die() function. Systems that do not perform network/PXE boot, or that do not rely on DHCP-supplied ROOT_PATH values, are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15816"
},
{
"category": "external",
"summary": "RHBZ#2500889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500889"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15816"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/40network/netroot.sh"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh",
"url": "https://github.com/dracutdevs/dracut/blob/master/modules.d/99base/dracut-lib.sh"
}
],
"release_date": "2026-08-05T23:59:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "Restrict DHCP server access on networks used for network boot (DHCP snooping, dedicated/trusted provisioning VLANs) until a fix is available.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()"
},
{
"acknowledgments": [
{
"names": [
"Pavel Valena"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-16445",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-05-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2503147"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut\u0027s NetworkManager-based initrd network module. These options are improperly handled and written into a temporary shell script without proper escaping, leading to command injection. This allows the attacker to achieve root code execution within the initramfs during system boot.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in dracut\u0027s NetworkManager-based initrd network module (nm-run.sh) that allows command injection via crafted DHCP options. An attacker on the adjacent network can exploit this by acting as a DHCP server and providing specially crafted DHCP options, leading to root code execution within the initramfs. This affects systems configured to boot using dracut\u0027s network-manager module with a DHCP-derived netroot (for example, NFS-root configurations).",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16445"
},
{
"category": "external",
"summary": "RHBZ#2503147",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2503147"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16445",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16445"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16445",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16445"
},
{
"category": "external",
"summary": "https://access.redhat.com/errata/RHSA-2026:26534",
"url": "https://access.redhat.com/errata/RHSA-2026:26534"
},
{
"category": "external",
"summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2459963"
},
{
"category": "external",
"summary": "https://github.com/dracutdevs/dracut/commit/e509c638e6",
"url": "https://github.com/dracutdevs/dracut/commit/e509c638e6"
}
],
"release_date": "2026-07-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "Avoid using the root=dhcp/netroot=dhcp/root=dhcp6/netroot=dhcp6 kernel command-line options \u2014 these cause dracut to trust the DHCP server\u0027s root-path option to determine the boot target. Configuring the netroot target explicitly on the kernel/PXE command line instead (e.g. netroot=nfs:\u003cserver\u003e:\u003cpath\u003e or netroot=iscsi:... with a literal value).",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "dracut: dracut: Root code execution via DHCP options command injection in NetworkManager initrd module"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"cve": "CVE-2026-64564",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2510890"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. A remote attacker could send a specially crafted sequence of ASCONF (Add IP Address Configuration) chunks, including DEL-IP (Delete IP Address) parameters, to trigger a use-after-free condition. This memory corruption could lead to a system crash, resulting in a denial of service, and potentially allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64564"
},
{
"category": "external",
"summary": "RHBZ#2510890",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510890"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64564",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64564"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64564"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026080404-CVE-2026-64564-6762@gregkh/T"
}
],
"release_date": "2026-08-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content:\n\n```\ninstall sctp /bin/true\nblacklist sctp\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing"
},
{
"cve": "CVE-2026-68121",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-08-10T12:25:51.369604+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513233"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s PPPoE (Point-to-Point Protocol over Ethernet) implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could potentially trigger this condition, causing memory corruption. This could result in a system crash (denial of service) or other unpredictable system behavior.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: pppoe: reload header pointer after dev_hard_header()",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68121"
},
{
"category": "external",
"summary": "RHBZ#2513233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513233"
},
{
"category": "external",
"summary": "RHSB-2026-011",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68121"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081056-CVE-2026-68121-b20f@gregkh/T"
}
],
"release_date": "2026-08-10T11:58:41.489000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "kernel: pppoe: reload header pointer after dev_hard_header()"
},
{
"cve": "CVE-2026-80863",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528665"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s RDMA/rxe component. A local user could exploit a memory corruption vulnerability in the `free_rd_atomic_resources()` function by updating the `max_dest_rd_atomic` value before the old array is properly freed, leading to an out-of-bounds write. This issue can cause a system crash, resulting in a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An OOB write in RDMA/RXE free_rd_atomic_resources can occur because qp attr max_dest_rd_atomic is updated before the old rd atomic resources array is freed. The free path then uses the new larger bound while walking the old smaller allocation, which can write past the kmalloc object and corrupt slab memory. The issue is not directly network reachable because the triggering operation is a local uverbs control path rather than inbound RDMA traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80863"
},
{
"category": "external",
"summary": "RHBZ#2528665",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528665"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80863",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80863"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80863",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80863"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80863.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80863.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent module rdma_rxe from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources()"
},
{
"cve": "CVE-2026-80864",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528646"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local, unprivileged user could exploit a race condition during a queue pair modification operation. This could lead to a use-after-free vulnerability, allowing the attacker to cause a system crash and resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80864"
},
{
"category": "external",
"summary": "RHBZ#2528646",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528646"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80864"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80864.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80864.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the rdma_rxe kernel module from being loaded.\n\n1. Create a configuration file in /etc/modprobe.d to disable loading of the module:\n# echo \"install rdma_rxe /bin/true\" \u003e /etc/modprobe.d/disable-rdma_rxe.conf\n\n2. If the module is currently loaded, attempt to unload it:\n# modprobe -r rdma_rxe\n\nCaveats:\nDisabling this module prevents the creation and operation of software RDMA over Converged Ethernet (Soft-RoCE) devices. Applications requiring rdma_rxe will fail to initialize. If the module is currently in active use and cannot be unloaded dynamically, a system reboot is required to ensure the module is fully disabled.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp"
},
{
"cve": "CVE-2026-99999",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553429"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel. A local attacker or untrusted guest virtual machine can exploit this vulnerability by transmitting network packets containing malformed checksum metadata into the IPv4 networking subsystem. This failure to validate checksum metadata can corrupt memory during packet handling, potentially leading to arbitrary code execution on the host, a system crash resulting in Denial of Service (DoS), or information disclosure of sensitive memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ipv4: validate checksum_start before completing checksum",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT-severity flaw affects the Linux kernel as shipped in Red Hat products, including the kernel and kernel-rt packages in Red Hat Enterprise Linux and the kernels shipped in Red Hat In-Vehicle OS. The IPv4 networking subsystem does not validate packet checksum metadata before completing a checksum: when a packet with a malformed checksum_start value enters the IPv4 stack, skb_checksum_help() can write out of bounds and corrupt the network header and other kernel memory (CWE-787). A local attacker or an untrusted guest virtual machine able to transmit such packets into an affected host could exploit this to crash the system (denial of service), disclose sensitive kernel memory, or potentially execute arbitrary code on the host. Red Hat tracks this flaw as a KEV active-exploit case. All currently tracked Red Hat product streams are marked affected, and fixes are being pursued by the responsible Red Hat product teams under delegated resolution. Red Hat\u0027s severity differs from the upstream assessment: Red Hat assigns a CVSS 3.1 score of 8.8 (IMPORTANT, AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), while the CVE.org record assigns 9.3 (CRITICAL, AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); the two assessments differ on the privileges-required metric.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-99999"
},
{
"category": "external",
"summary": "RHBZ#2553429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553429"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-99999",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-99999"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99999"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99999.mbox"
}
],
"release_date": "2026-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: ipv4: validate checksum_start before completing checksum"
},
{
"cve": "CVE-2026-114406",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-10-20T09:01:55.916000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556046"
}
],
"notes": [
{
"category": "description",
"text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-114406"
},
{
"category": "external",
"summary": "RHBZ#2556046",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556046"
},
{
"category": "external",
"summary": "RHSB-2026-012",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-012"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-114406",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-114406"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114406"
}
],
"release_date": "2026-10-20T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-10-27T17:59:35+00:00",
"details": "For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n The sha value for the release is as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:3c8e5084a9c3a8e2e8ff8ef2d5c653a003f8d25f5db569e0d2b865af5443f076\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:90272"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"8Base-RHOSE-4.12:rhcos-x86_64-412.86.202610250235-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.