RHSA-2026:94537

Vulnerability from csaf_redhat - Published: 2026-11-09 14:40 - Updated: 2026-11-10 13:13
Summary
Red Hat Security Advisory: OpenShift Container Platform 5.0.1 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 5.0.1 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 5.0. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 5.0.1. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:94536 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/ Security Fix(es): * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) * qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080) * openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) * cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) * kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) * kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824) * kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777) * libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936) * openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) * openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) * openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) * libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226) * libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) * libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) * kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003) * kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-31936

A flaw was found in Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within System Management Mode (SMM). Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This vulnerability could lead to high impact on confidentiality and integrity of the system.

5.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
CWE-823 - Use of Out-of-range Pointer Offset
Affected products
Product Identifier Version Remediation
Unresolved product id: 10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0 —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0 —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0 —
Vendor Fix fix
Workaround
Unresolved product id: 10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0 —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-12080

A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-61 - UNIX Symbolic Link (Symlink) Following
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-14456

A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-18798

A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-415 - Double Free
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-26007

A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-354 - Improper Validation of Integrity Check Value
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-63072

A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-63076

A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-68376

A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the `auth_hmacs` field within the `sctp_cookie` structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (`auth_chunks`) and can subsequently cause an out-of-bounds read when processing HMAC identifiers.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-71226

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.

7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-77206

A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-77207

A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 - NULL Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-77214

A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
CWE-125 - Out-of-bounds Read
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-80824

A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is prematurely freed before all pending operations are completed. Successful exploitation of this memory corruption flaw could lead to a system crash or potentially privilege escalation.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-89777

A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-90003

A flaw was found in the Linux kernel's futex component. A race condition during the FUTEX_CMP_REQUEUE_PI operation can lead to a use-after-free vulnerability in the rcuwait mechanism. This issue could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other system instability.

4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-94453

A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-416 - Use After Free
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-98222

A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel memory. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow privilege escalation.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 - Out-of-bounds Write
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Important
CVE-2026-98320

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Moderate
CVE-2026-98432

A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Fixed 8 products, the same list as for CVE-2025-31936
Threats
Impact Critical
References
URL Category
https://access.redhat.com/errata/RHSA-2026:94537 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2438762 external
https://bugzilla.redhat.com/show_bug.cgi?id=2462114 external
https://bugzilla.redhat.com/show_bug.cgi?id=2499603 external
https://bugzilla.redhat.com/show_bug.cgi?id=2513253 external
https://bugzilla.redhat.com/show_bug.cgi?id=2514115 external
https://bugzilla.redhat.com/show_bug.cgi?id=2515348 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517559 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517560 external
https://bugzilla.redhat.com/show_bug.cgi?id=2517561 external
https://bugzilla.redhat.com/show_bug.cgi?id=2528642 external
https://bugzilla.redhat.com/show_bug.cgi?id=2535066 external
https://bugzilla.redhat.com/show_bug.cgi?id=2535170 external
https://bugzilla.redhat.com/show_bug.cgi?id=2546385 external
https://bugzilla.redhat.com/show_bug.cgi?id=2546494 external
https://bugzilla.redhat.com/show_bug.cgi?id=2547476 external
https://bugzilla.redhat.com/show_bug.cgi?id=2550254 external
https://bugzilla.redhat.com/show_bug.cgi?id=2550256 external
https://bugzilla.redhat.com/show_bug.cgi?id=2550258 external
https://bugzilla.redhat.com/show_bug.cgi?id=2553390 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-31936 self
https://bugzilla.redhat.com/show_bug.cgi?id=2514115 external
https://www.cve.org/CVERecord?id=CVE-2025-31936 external
https://nvd.nist.gov/vuln/detail/CVE-2025-31936 external
https://intel.com/content/www/us/en/security-cent… external
https://access.redhat.com/security/cve/CVE-2026-12080 self
https://bugzilla.redhat.com/show_bug.cgi?id=2499603 external
https://www.cve.org/CVERecord?id=CVE-2026-12080 external
https://nvd.nist.gov/vuln/detail/CVE-2026-12080 external
https://gitlab.com/qemu-project/qemu/-/work_items/3929 external
https://access.redhat.com/security/cve/CVE-2026-14456 self
https://bugzilla.redhat.com/show_bug.cgi?id=2515348 external
https://www.cve.org/CVERecord?id=CVE-2026-14456 external
https://nvd.nist.gov/vuln/detail/CVE-2026-14456 external
https://github.com/openssl/openssl/commit/08e7756… external
https://github.com/openssl/openssl/commit/4084152… external
https://github.com/openssl/openssl/commit/f2f1465… external
https://openssl-library.org/news/secadv/20260813.txt external
https://access.redhat.com/security/cve/CVE-2026-18798 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517559 external
https://www.cve.org/CVERecord?id=CVE-2026-18798 external
https://nvd.nist.gov/vuln/detail/CVE-2026-18798 external
https://openssl-library.org/news/secadv/20260825.txt external
https://access.redhat.com/security/cve/CVE-2026-26007 self
https://bugzilla.redhat.com/show_bug.cgi?id=2438762 external
https://www.cve.org/CVERecord?id=CVE-2026-26007 external
https://nvd.nist.gov/vuln/detail/CVE-2026-26007 external
https://github.com/pyca/cryptography/commit/0eebb… external
https://github.com/pyca/cryptography/security/adv… external
https://access.redhat.com/security/cve/CVE-2026-63072 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517560 external
https://www.cve.org/CVERecord?id=CVE-2026-63072 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63072 external
https://access.redhat.com/security/cve/CVE-2026-63076 self
https://bugzilla.redhat.com/show_bug.cgi?id=2517561 external
https://www.cve.org/CVERecord?id=CVE-2026-63076 external
https://nvd.nist.gov/vuln/detail/CVE-2026-63076 external
https://access.redhat.com/security/cve/CVE-2026-68376 self
https://bugzilla.redhat.com/show_bug.cgi?id=2513253 external
https://www.cve.org/CVERecord?id=CVE-2026-68376 external
https://nvd.nist.gov/vuln/detail/CVE-2026-68376 external
https://lore.kernel.org/linux-cve-announce/202608… external
https://access.redhat.com/security/cve/CVE-2026-71226 self
https://bugzilla.redhat.com/show_bug.cgi?id=2462114 external
https://www.cve.org/CVERecord?id=CVE-2026-71226 external
https://nvd.nist.gov/vuln/detail/CVE-2026-71226 external
https://access.redhat.com/security/cve/CVE-2026-77206 self
https://bugzilla.redhat.com/show_bug.cgi?id=2550256 external
https://www.cve.org/CVERecord?id=CVE-2026-77206 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77206 external
https://libreswan.org/security/CVE-2026-77206/CVE… external
https://libreswan.org/security/CVE-2026-77206/lib… external
https://libreswan.org/security/CVE-2026-77206/lib… external
https://access.redhat.com/security/cve/CVE-2026-77207 self
https://bugzilla.redhat.com/show_bug.cgi?id=2550258 external
https://www.cve.org/CVERecord?id=CVE-2026-77207 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77207 external
https://libreswan.org/security/CVE-2026-77207/CVE… external
https://libreswan.org/security/CVE-2026-77207/lib… external
https://libreswan.org/security/CVE-2026-77207/lib… external
https://access.redhat.com/security/cve/CVE-2026-77214 self
https://bugzilla.redhat.com/show_bug.cgi?id=2547476 external
https://www.cve.org/CVERecord?id=CVE-2026-77214 external
https://nvd.nist.gov/vuln/detail/CVE-2026-77214 external
https://github.com/libexpat/libexpat/commit/13c5f… external
https://github.com/libexpat/libexpat/pull/1393 external
https://www.vulncheck.com/advisories/libexpat-hea… external
https://access.redhat.com/security/cve/CVE-2026-80824 self
https://bugzilla.redhat.com/show_bug.cgi?id=2528642 external
https://www.cve.org/CVERecord?id=CVE-2026-80824 external
https://nvd.nist.gov/vuln/detail/CVE-2026-80824 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-89777 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535066 external
https://www.cve.org/CVERecord?id=CVE-2026-89777 external
https://nvd.nist.gov/vuln/detail/CVE-2026-89777 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-90003 self
https://bugzilla.redhat.com/show_bug.cgi?id=2535170 external
https://www.cve.org/CVERecord?id=CVE-2026-90003 external
https://nvd.nist.gov/vuln/detail/CVE-2026-90003 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://kernelcve.org/list/?q=CVE-2026-90003 external
https://access.redhat.com/security/cve/CVE-2026-94453 self
https://bugzilla.redhat.com/show_bug.cgi?id=2550254 external
https://www.cve.org/CVERecord?id=CVE-2026-94453 external
https://nvd.nist.gov/vuln/detail/CVE-2026-94453 external
https://libreswan.org/security/CVE-2026-94453/CVE… external
https://libreswan.org/security/CVE-2026-94453/lib… external
https://libreswan.org/security/CVE-2026-94453/lib… external
https://access.redhat.com/security/cve/CVE-2026-98222 self
https://bugzilla.redhat.com/show_bug.cgi?id=2546385 external
https://www.cve.org/CVERecord?id=CVE-2026-98222 external
https://nvd.nist.gov/vuln/detail/CVE-2026-98222 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-98320 self
https://bugzilla.redhat.com/show_bug.cgi?id=2546494 external
https://www.cve.org/CVERecord?id=CVE-2026-98320 external
https://nvd.nist.gov/vuln/detail/CVE-2026-98320 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-98432 self
https://bugzilla.redhat.com/show_bug.cgi?id=2553390 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-98432 external
https://nvd.nist.gov/vuln/detail/CVE-2026-98432 external
https://git.kernel.org/pub/scm/linux/security/vul… external
Acknowledgments
Valentino Paulon
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 5.0.1 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 5.0.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 5.0.1. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHBA-2026:94536\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nSecurity Fix(es):\n\n* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)\n* qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)\n* openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)\n* cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)\n* kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n* kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)\n* kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure (CVE-2026-89777)\n* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n* kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)\n* kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936)\n* openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)\n* openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)\n* openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)\n* libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path (CVE-2026-71226)\n* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n* kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)\n* kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94537",
        "url": "https://access.redhat.com/errata/RHSA-2026:94537"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#critical",
        "url": "https://access.redhat.com/security/updates/classification/#critical"
      },
      {
        "category": "external",
        "summary": "2438762",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
      },
      {
        "category": "external",
        "summary": "2462114",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462114"
      },
      {
        "category": "external",
        "summary": "2499603",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499603"
      },
      {
        "category": "external",
        "summary": "2513253",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513253"
      },
      {
        "category": "external",
        "summary": "2514115",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514115"
      },
      {
        "category": "external",
        "summary": "2515348",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
      },
      {
        "category": "external",
        "summary": "2517559",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
      },
      {
        "category": "external",
        "summary": "2517560",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
      },
      {
        "category": "external",
        "summary": "2517561",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
      },
      {
        "category": "external",
        "summary": "2528642",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528642"
      },
      {
        "category": "external",
        "summary": "2535066",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535066"
      },
      {
        "category": "external",
        "summary": "2535170",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535170"
      },
      {
        "category": "external",
        "summary": "2546385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546385"
      },
      {
        "category": "external",
        "summary": "2546494",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546494"
      },
      {
        "category": "external",
        "summary": "2547476",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547476"
      },
      {
        "category": "external",
        "summary": "2550254",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
      },
      {
        "category": "external",
        "summary": "2550256",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
      },
      {
        "category": "external",
        "summary": "2550258",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
      },
      {
        "category": "external",
        "summary": "2553390",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94537.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 5.0.1 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-11-10T13:13:22+00:00",
      "generator": {
        "date": "2026-11-10T13:13:22+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:94537",
      "initial_release_date": "2026-11-09T14:40:48+00:00",
      "revision_history": [
        {
          "date": "2026-11-09T14:40:48+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-09T14:40:48+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-10T13:13:22+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 5.0",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 5.0",
                  "product_id": "10Base-RHOSE-5.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:5.0::el10"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 5.0",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 5.0",
                  "product_id": "9Base-RHOSE-5.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:5.0::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-aarch64-5.0.10.2.202611022203-0",
                "product": {
                  "name": "rhcos-aarch64-5.0.10.2.202611022203-0",
                  "product_id": "rhcos-aarch64-5.0.10.2.202611022203-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.10.2.202611022203?arch=aarch64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhcos-aarch64-5.0.9.8.202611022248-0",
                "product": {
                  "name": "rhcos-aarch64-5.0.9.8.202611022248-0",
                  "product_id": "rhcos-aarch64-5.0.9.8.202611022248-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.9.8.202611022248?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-5.0.9.8.202611022248-0",
                "product": {
                  "name": "rhcos-ppc64le-5.0.9.8.202611022248-0",
                  "product_id": "rhcos-ppc64le-5.0.9.8.202611022248-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.9.8.202611022248?arch=ppc64le"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhcos-ppc64le-5.0.10.2.202611022203-0",
                "product": {
                  "name": "rhcos-ppc64le-5.0.10.2.202611022203-0",
                  "product_id": "rhcos-ppc64le-5.0.10.2.202611022203-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.10.2.202611022203?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-s390x-5.0.10.2.202611022203-0",
                "product": {
                  "name": "rhcos-s390x-5.0.10.2.202611022203-0",
                  "product_id": "rhcos-s390x-5.0.10.2.202611022203-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.10.2.202611022203?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhcos-s390x-5.0.9.8.202611022248-0",
                "product": {
                  "name": "rhcos-s390x-5.0.9.8.202611022248-0",
                  "product_id": "rhcos-s390x-5.0.9.8.202611022248-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.9.8.202611022248?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-5.0.10.2.202611022203-0",
                "product": {
                  "name": "rhcos-x86_64-5.0.10.2.202611022203-0",
                  "product_id": "rhcos-x86_64-5.0.10.2.202611022203-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.10.2.202611022203?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhcos-x86_64-5.0.9.8.202611022248-0",
                "product": {
                  "name": "rhcos-x86_64-5.0.9.8.202611022248-0",
                  "product_id": "rhcos-x86_64-5.0.9.8.202611022248-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@5.0.9.8.202611022248?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0"
        },
        "product_reference": "rhcos-aarch64-5.0.10.2.202611022203-0",
        "relates_to_product_reference": "10Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0"
        },
        "product_reference": "rhcos-ppc64le-5.0.10.2.202611022203-0",
        "relates_to_product_reference": "10Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0"
        },
        "product_reference": "rhcos-s390x-5.0.10.2.202611022203-0",
        "relates_to_product_reference": "10Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0"
        },
        "product_reference": "rhcos-x86_64-5.0.10.2.202611022203-0",
        "relates_to_product_reference": "10Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-aarch64-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0"
        },
        "product_reference": "rhcos-aarch64-5.0.9.8.202611022248-0",
        "relates_to_product_reference": "9Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-ppc64le-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0"
        },
        "product_reference": "rhcos-ppc64le-5.0.9.8.202611022248-0",
        "relates_to_product_reference": "9Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-s390x-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0"
        },
        "product_reference": "rhcos-s390x-5.0.9.8.202611022248-0",
        "relates_to_product_reference": "9Base-RHOSE-5.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0",
          "product_id": "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        },
        "product_reference": "rhcos-x86_64-5.0.9.8.202611022248-0",
        "relates_to_product_reference": "9Base-RHOSE-5.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-31936",
      "cwe": {
        "id": "CWE-823",
        "name": "Use of Out-of-range Pointer Offset"
      },
      "discovery_date": "2026-08-11T16:52:54.610522+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2514115"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within System Management Mode (SMM). Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This vulnerability could lead to high impact on confidentiality and integrity of the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important privilege escalation flaw affects Intel Xeon 6 Processors when Intel TDX is enabled, allowing a privileged local attacker to escalate privileges within the System Management Mode (SMM). Exploitation requires a high complexity attack and specific internal knowledge, impacting the confidentiality and integrity of the system.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-31936"
        },
        {
          "category": "external",
          "summary": "RHBZ#2514115",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514115"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-31936",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-31936"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31936",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31936"
        },
        {
          "category": "external",
          "summary": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html",
          "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html"
        }
      ],
      "release_date": "2026-08-11T16:28:06.168000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "This vulnerability only affects systems using Intel Trust Domain Extensions (TDX) on Intel Xeon 6 processors. Systems not using Intel TDX are not vulnerable to this issue. Disabling Intel TDX, where feasible, removes the exposure to this vulnerability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Valentino Paulon"
          ]
        }
      ],
      "cve": "CVE-2026-12080",
      "cwe": {
        "id": "CWE-61",
        "name": "UNIX Symbolic Link (Symlink) Following"
      },
      "discovery_date": "2026-07-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499603"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12080"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499603",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499603"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12080",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12080"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12080",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12080"
        },
        {
          "category": "external",
          "summary": "https://gitlab.com/qemu-project/qemu/-/work_items/3929",
          "url": "https://gitlab.com/qemu-project/qemu/-/work_items/3929"
        }
      ],
      "release_date": "2026-07-09T10:57:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "If the `guest-ssh-add-authorized-keys` command is not required, it can be disabled by adding it to the qemu-guest-agent block list (qemu-ga --block-rpcs). This prevents the vulnerable code path from being reached while preserving all other guest-agent functionality.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys"
    },
    {
      "cve": "CVE-2026-14456",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T14:21:24.109249+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515348"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515348",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-14456",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
          "url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
          "url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"
        },
        {
          "category": "external",
          "summary": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
          "url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260813.txt",
          "url": "https://openssl-library.org/news/secadv/20260813.txt"
        }
      ],
      "release_date": "2026-08-13T13:55:52.370000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]\n\nA. Confirm QUIC Exposure - Check if any service is listening on UDP 443:\n~~~\n$ ss -ulnp | grep \u0027:443\u0027\n# or\n$ sudo lsof -iUDP:443 -n -P\n~~~\n\nNote: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).\n\nB. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)\n~~~\n$ sudo firewall-cmd --permanent --remove-service=quic 2\u003e/dev/null\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"10.0.0.0/8\" port port=\"443\" protocol=\"udp\" accept\u0027\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"443\" protocol=\"udp\" drop\u0027\n$ sudo firewall-cmd --reload\n~~~\n\nC. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):\n~~~\n$ nc -u -v YOUR_HOST 443\n~~~\n\nOption 2: Disable QUIC Server\n\nIf QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.\n\nRecommended Mitigation Priority\nPriority : Action\n1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range\n2.Block or rate-limit UDP 443 at firewall/edge (immediate)\n3.Disable QUIC/HTTP3 on the service if not needed\n4.Upgrade OpenSSL to fixed release when available\n5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
    },
    {
      "cve": "CVE-2026-18798",
      "cwe": {
        "id": "CWE-415",
        "name": "Double Free"
      },
      "discovery_date": "2026-08-17T19:14:03.992000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517559"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: QUIC server may trigger double free when processing INITIAL packet",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue can cause memory corruption due to the double free of the QRX object. However, there is currently no evidence it allows remote code execution, limiting the impact of this vulnerability to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-18798"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517559",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-18798",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-18798"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260825.txt",
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        }
      ],
      "release_date": "2026-08-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: QUIC server may trigger double free when processing INITIAL packet"
    },
    {
      "cve": "CVE-2026-26007",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "discovery_date": "2026-02-10T22:01:01.036116+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2438762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor \u003e 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it\u0027s easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw, while difficult to exploit, would lead to a loss of integrity in the encrypted communication channel. Given that the cryptography package is a library, it is likely to be used in situations that do not require user interaction.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "RHBZ#2438762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-26007",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c",
          "url": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"
        },
        {
          "category": "external",
          "summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2",
          "url": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2"
        }
      ],
      "release_date": "2026-02-10T21:42:56.471000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
    },
    {
      "cve": "CVE-2026-63072",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-17T19:24:54.673000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517560"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: heap buffer overflow in CMS key unwrapping",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to supply a crafted CMS message to be decrypted in an application by CMS_decrypt(). The out-of-bounds write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the memory allocation, causing memory corruption, but the impact is limited to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517560",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63072",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260825.txt",
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        }
      ],
      "release_date": "2026-08-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: heap buffer overflow in CMS key unwrapping"
    },
    {
      "cve": "CVE-2026-63076",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-08-17T19:30:30.087000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2517561"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "RHBZ#2517561",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-63076",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076"
        },
        {
          "category": "external",
          "summary": "https://openssl-library.org/news/secadv/20260825.txt",
          "url": "https://openssl-library.org/news/secadv/20260825.txt"
        }
      ],
      "release_date": "2026-08-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg"
    },
    {
      "cve": "CVE-2026-68376",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-08-10T12:26:50.837229+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2513253"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the `auth_hmacs` field within the `sctp_cookie` structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (`auth_chunks`) and can subsequently cause an out-of-bounds read when processing HMAC identifiers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Important because an attacker can trigger kernel memory corruption during association setup, leading to system crashes or kernel memory disclosure. In Red Hat Enterprise Linux, the sctp kernel module is not loaded by default unless an application explicitly opens an SCTP socket. Exploitation is constrained by the prerequisite that an endpoint must be configured with multiple HMAC authentication algorithms, which is uncommon in default network deployments.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-68376"
        },
        {
          "category": "external",
          "summary": "RHBZ#2513253",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513253"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-68376",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-68376"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68376",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68376"
        },
        {
          "category": "external",
          "summary": "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T",
          "url": "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T"
        }
      ],
      "release_date": "2026-08-10T12:03:54.666000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "To prevent the SCTP kernel module from loading, blacklist it by creating a file `/etc/modprobe.d/disable-sctp.conf` with the content `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (RHEL 8/9/10) or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (RHEL 7), then reboot the system. This action may affect applications dependent on SCTP.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie"
    },
    {
      "acknowledgments": [
        {
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-71226",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-04-26T18:17:10+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2462114"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Memory Corruption via Uncanceled AIO Requests on Error: libkcapi\u0027s one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in libkcapi affects applications utilizing the one-shot Asynchronous I/O (AIO) interfaces with the `KCAPI_INIT_AIO` flag. Exploitation requires an error to occur after submitting I/O Control Blocks (IOCBs), followed by the application freeing or reusing output buffers before all kernel completions are processed. This vulnerability does not affect default configurations as it relies on an opt-in AIO setup.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71226"
        },
        {
          "category": "external",
          "summary": "RHBZ#2462114",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462114"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71226",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71226"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226"
        }
      ],
      "release_date": "2026-08-05T12:22:09.014000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path"
    },
    {
      "cve": "CVE-2026-77206",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-13T07:34:21.126000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference flaw was found in Libreswan\u0027s IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this vulnerability as having a Moderate impact. Exploitation requires Libreswan to be running as an IKEv2 endpoint, a configuration that requires explicit installation and service configuration on a standard Red Hat Enterprise Linux system. A remote, unauthenticated attacker can send a crafted IKEv2 authentication packet to crash the pluto daemon, potentially disrupting VPN connectivity. Repeated exploitation can cause continued denial of service. Remote code execution is not possible.\n\nThe vulnerability can be triggered even when EAP is not configured.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550256",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77206",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt",
          "url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch",
          "url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch",
          "url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code"
    },
    {
      "cve": "CVE-2026-77207",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "discovery_date": "2026-10-13T07:34:23.608000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550258"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference flaw was found in Libreswan\u0027s PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires Libreswan to be deployed, configured, and running as an IKEv2 endpoint, which is not the default configuration of a general-purpose Red Hat Enterprise Linux installation. A remote, unauthenticated attacker can send a crafted IKEv2 packet to crash the Libreswan daemon, potentially disrupting VPN connectivity. Although, systemd supervision typically restarts the crashed process automatically, reducing the persistence of service interruptions, repeated exploitation can cause continued denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550258",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77207",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt",
          "url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch",
          "url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch",
          "url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS"
    },
    {
      "cve": "CVE-2026-77214",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-10-07T14:42:40.407146+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2547476"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as an Important severity because the Expat XML parser is ubiquitous across Red Hat Enterprise Linux environments, frequently handling untrusted inputs in network-facing services and runtime environments. When applications process incoming XML data through repeated chunked parsing calls, an unauthenticated attacker can induce an out-of-bounds heap read without requiring prior privileges. This memory disclosure enables the retrieval of process memory layouts and pointers, effectively weakening ASLR and lowering the barrier for subsequent exploit chains.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-77214"
        },
        {
          "category": "external",
          "summary": "RHBZ#2547476",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547476"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-77214",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-77214"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0",
          "url": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0"
        },
        {
          "category": "external",
          "summary": "https://github.com/libexpat/libexpat/pull/1393",
          "url": "https://github.com/libexpat/libexpat/pull/1393"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer",
          "url": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"
        }
      ],
      "release_date": "2026-10-07T14:35:42.794000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer"
    },
    {
      "cve": "CVE-2026-80824",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2528642"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is prematurely freed before all pending operations are completed. Successful exploitation of this memory corruption flaw could lead to a system crash or potentially privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important severity use-after-free flaw was found in the Linux kernel usbfs (USB user-space) subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux and other Red Hat products that ship the Red Hat kernel. In usbdev_release(), the reference to the struct usb_device is dropped before the list of completed asynchronous URBs is drained, and the drain path (free_async() calling dec_usb_memory_use_count()) then reads back through the already-freed device, for example via bus_to_hcd(ps-\u003edev-\u003ebus). An unprivileged local attacker with read/write access to a /dev/bus/usb device node could mmap() the file descriptor, submit an asynchronous URB whose buffer lies inside that mapping, wait for the device to be unplugged so that the usbfs reference becomes the last reference and the device is freed, and then unmap and close the file descriptor, deterministically triggering the use-after-free. Successful exploitation of this memory corruption flaw could lead to a kernel crash (denial of service) or potentially privilege escalation. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): although triggering the use-after-free itself is deterministic and not a race, reliably converting it into privilege escalation requires high attack complexity. A fix is being pursued for the affected Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-80824"
        },
        {
          "category": "external",
          "summary": "RHBZ#2528642",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528642"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-80824",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-80824"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80824",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80824"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox"
        }
      ],
      "release_date": "2026-09-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()"
    },
    {
      "cve": "CVE-2026-89777",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535066"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use-after-free and double-free flaw in the Linux kernel\u0027s vfio/pci subsystem has been rated Important by Red Hat. When initialization of the per-device MSI permission table fails (for example, when an underlying allocation fails with -ENOMEM), the error path in vfio_msi_cap_len() frees vdev-\u003emsi_perm but leaves the dangling pointer stored in the per-device vfio_pci_core_device structure, which persists across open/close cycles. A local attacker with access to a VFIO PCI device could trigger this failed initialization path and then, on a subsequent open or close of the device, cause the freed object to be reused for MSI config-space accesses (dereferencing and calling the freed perm-\u003ereadfn/perm-\u003ewritefn function pointers) or to be freed a second time in vfio_config_free(). This can lead to a kernel panic and system crash (denial of service) or potentially to execution of arbitrary code with elevated privileges. Red Hat rates this flaw as Important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the higher CVE.org score of 8.8 reflects a lower attack-complexity assessment, whereas Red Hat considers exploitation to depend on reliably steering a memory-allocation failure during device initialization. Within Red Hat\u0027s affected product scope, Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt ELS streams) are not affected because the vulnerable code is not present, while the vulnerable code is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and Red Hat OpenShift versions that ship an affected kernel, and fixes are being pursued through the responsible engineering teams.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-89777"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535066",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535066"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-89777",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-89777"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89777",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89777"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox"
        }
      ],
      "release_date": "2026-09-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure"
    },
    {
      "cve": "CVE-2026-90003",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-09-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2535170"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s futex component. A race condition during the FUTEX_CMP_REQUEUE_PI operation can lead to a use-after-free vulnerability in the rcuwait mechanism. This issue could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: futex: Prevent rcuwait use-after-free during requeue PI",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A use-after-free in the futex requeue PI path can occur on PREEMPT_RT because futex_requeue_pi_complete can call rcuwait_wake_up on q.requeue_wait after the waiter has left the syscall and the stack allocated futex_q is no longer valid. A local process can trigger the vulnerable path through FUTEX_CMP_REQUEUE_PI by racing an early wakeup from timeout or signal with a PI requeue operation. For the CVSS the PR:L is used because an unprivileged local process can reach the futex syscall path and can create waiter and requeue activity, while no network access is involved. The base impact is at least local denial of service via KASAN report or kernel crash. For the paranoid score, the UAF on a kernel stack object makes limited or full confidentiality and integrity impact defensible and the issue should be reviewed manually.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-90003"
        },
        {
          "category": "external",
          "summary": "RHBZ#2535170",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535170"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-90003",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-90003"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90003",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90003"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90003.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90003.mbox"
        },
        {
          "category": "external",
          "summary": "https://kernelcve.org/list/?q=CVE-2026-90003",
          "url": "https://kernelcve.org/list/?q=CVE-2026-90003"
        }
      ],
      "release_date": "2026-09-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: futex: Prevent rcuwait use-after-free during requeue PI"
    },
    {
      "cve": "CVE-2026-94453",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-10-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2550254"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free flaw was found in Libreswan\u0027s IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this vulnerability as having an Important security impact. A remote, unauthenticated attacker may exploit a use-after-free in Libreswan\u0027s IKE-over-TCP handling before peer authentication to cause the IKE daemon to crash and restart. Repeated exploitation can result in denial of service.\n\nThe vulnerability affects only configurations that explicitly enable IKE-over-TCP using `listen-tcp=yes`; this option is not enabled by default. Consequently, exposure is limited to systems configured to accept IKE-over-TCP connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "RHBZ#2550254",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-94453",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt",
          "url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch",
          "url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch"
        },
        {
          "category": "external",
          "summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch",
          "url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch"
        }
      ],
      "release_date": "2026-10-05T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. \n\nIf IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP"
    },
    {
      "cve": "CVE-2026-98222",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "discovery_date": "2026-10-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2546385"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel memory. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: KEYS: encrypted: fix integer overflow of datablob_len",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security rates this flaw as IMPORTANT for the affected Red Hat products. A flaw was found in the Linux kernel\u0027s encrypted keys subsystem: encrypted_key_alloc() stores datablob_len in a u16 that is computed from multiple string and payload lengths, and when the computed length exceeds U16_MAX the stored value is truncated, resulting in an undersized buffer allocation. A slab-out-of-bounds write then occurs when __ekey_init() copies the key data into the undersized buffer. A local user able to create keys, for example via the add_key() syscall, can supply crafted key data to trigger this out-of-bounds write to kernel memory, which can cause a system crash and denial of service, or potentially allow privilege escalation. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. Red Hat Enterprise Linux 7 ELS, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, and fixes are being pursued for these products. Red Hat has assigned this flaw a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attack vector with high attack complexity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-98222"
        },
        {
          "category": "external",
          "summary": "RHBZ#2546385",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546385"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-98222",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-98222"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98222",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98222"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox"
        }
      ],
      "release_date": "2026-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: KEYS: encrypted: fix integer overflow of datablob_len"
    },
    {
      "cve": "CVE-2026-98320",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-10-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2546494"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: netfilter: flowtable: hold reference on ct until flow is released",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important severity use-after-free flaw was found in the Linux kernel\u0027s netfilter flowtable, affecting the kernel, kernel-rt, and kpatch packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS components. The flowtable datapath released its connection tracking reference prematurely: nf_ct_put() frees the ct extension area immediately, and the RCU typesafe semantics could allow the datapath to refer to the wrong or already-freed conntrack entry while a flow entry was still being released after the RCU grace period. An attacker able to trigger this timing window during network flow processing could cause a use-after-free condition that primarily results in a denial of service via a system crash or unexpected system instability. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity of reliably triggering the timing issue, whereas the upstream CVEORG score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams (kernel and kernel-rt) are not affected because the vulnerable code is not present in those kernels. Fixes for the affected product streams are being pursued.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-98320"
        },
        {
          "category": "external",
          "summary": "RHBZ#2546494",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546494"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-98320",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-98320"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98320",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98320"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98320.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98320.mbox"
        }
      ],
      "release_date": "2026-10-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "kernel: netfilter: flowtable: hold reference on ct until flow is released"
    },
    {
      "cve": "CVE-2026-98432",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-10-15T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2553390"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated as Critical severity for Red Hat Enterprise Linux because it allows an unauthenticated remote attacker to cause kernel memory corruption or an immediate system crash over standard IPv4 TCP network traffic without requiring local privileges or user interaction. In default enterprise configurations across Red Hat environments, TCP services accept incoming connections without specialized tuning, making the concurrent connection handling paths inherently exposed to remote networks. Although reliably executing arbitrary code through this timing-sensitive use-after-free scenario requires precise heap control, the lack of network prerequisites and the potential for severe system instability elevate the impact above Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
          "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
          "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
          "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2553390",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-016",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-016"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-98432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox"
        }
      ],
      "release_date": "2026-10-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-09T14:40:48+00:00",
          "details": "For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a\n\n      (For s390x architecture)\n      The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef\n\n      (For ppc64le architecture)\n      The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52\n\n      (For aarch64 architecture)\n      The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621\n\nAll OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94537"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "10Base-RHOSE-5.0:rhcos-aarch64-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-ppc64le-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-s390x-5.0.10.2.202611022203-0",
            "10Base-RHOSE-5.0:rhcos-x86_64-5.0.10.2.202611022203-0",
            "9Base-RHOSE-5.0:rhcos-aarch64-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-ppc64le-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-s390x-5.0.9.8.202611022248-0",
            "9Base-RHOSE-5.0:rhcos-x86_64-5.0.9.8.202611022248-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ],
      "title": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.