RHSA-2026:95346
Vulnerability from csaf_redhat - Published: 2026-11-06 18:10 - Updated: 2026-11-06 22:24Summary
Red Hat Security Advisory: OpenShift Container Platform 4.22.22 bug fix and security update
Severity
Critical
Notes
Topic: Red Hat OpenShift Container Platform release 4.22.22 is now available with updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container Platform 4.22.
Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.22. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:95345
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
Security Fix(es):
* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
* qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)
* openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
* cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)
* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
* kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
* kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
* openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782)
* kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
* kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)
* kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
* kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
* kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
* kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
* kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936)
* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
* openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
* unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)
* kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
* openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
* openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
* libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226)
* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)
* kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)
* kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within System Management Mode (SMM). Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This vulnerability could lead to high impact on confidentiality and integrity of the system.
5.7 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw in Unbound's SO_REUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in the Linux kernel's SCTP stream scheduler. When transient outgoing streams are denied and torn down, the kernel fails to reclaim scheduler-specific metadata before an algorithm switch (e.g., WFQ to PRIO). The orphaned state - including internal accounting fields - becomes reachable through the new scheduler's accessors, allowing an unprivileged local attacker to read arbitrary kernel memory and corrupt kernel objects via SCTP_STREAM_SCHEDULER_VALUE socket options. This can be leveraged for local privilege escalation to full root capabilities. A failed exploitation attempt may also crash the kernel, resulting in a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A vulnerability exists in the SMB2_close() replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code. Exploitation requires the victim system to connect to a malicious or compromised SMB server.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the `auth_hmacs` field within the `sctp_cookie` structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (`auth_chunks`) and can subsequently cause an out-of-bounds read when processing HMAC identifiers.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
7.3 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A null pointer dereference flaw was found in Libreswan's IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A null pointer dereference flaw was found in Libreswan's PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is prematurely freed before all pending operations are completed. Successful exploitation of this memory corruption flaw could lead to a system crash or potentially privilege escalation.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.
7.4 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's futex component. A race condition during the FUTEX_CMP_REQUEUE_PI operation can lead to a use-after-free vulnerability in the rcuwait mechanism. This issue could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other system instability.
4.7 (Medium)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in the Linux kernel's iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol (CHAP). This can lead to an out-of-bounds read, potentially resulting in information disclosure from adjacent memory or a denial of service.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A use-after-free flaw was found in Libreswan's IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel memory. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow privilege escalation.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.
7.0 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Moderate
A flaw was found in the Linux kernel's IPsec (XFRM) networking subsystem. A race condition occurs when creating policy bundles while a network device is concurrently removed, leading to a use-after-free condition where the kernel accesses already-freed device memory. A local attacker can exploit this flaw to potentially escalate privileges or cause a Denial of Service (DoS) by crashing the system.
7.8 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.
9.8 (Critical)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Critical
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host can exploit this flaw to inspect or alter sensitive hypervisor stack data, resulting in a bypass of hypervisor isolation and potential privilege escalation.
8.2 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Linux kernel's NVMe over Fabrics (NVMe-oF) target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service (DoS) through a system crash or potential memory corruption. This issue occurs due to an incorrect buffer size calculation during authentication challenge processing, which allows an undersized buffer to bypass validation checks and results in an out-of-bounds write.
7.5 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Impact
Important
A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.
8.1 (High)
Affected products
Fixed
4 products, the same list as for
CVE-2025-31936
Threats
Exploit Status
CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Impact
Important
References
225 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.22.22 is now available with updates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container Platform 4.22.\n\nRed Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container Platform 4.22.22. See the following advisory for the RPM packages for this release:\n\nhttps://access.redhat.com/errata/RHBA-2026:95345\n\nSpace precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nSecurity Fix(es):\n\n* kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)\n* curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)\n* qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)\n* openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)\n* bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)\n* cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)\n* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)\n* kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)\n* expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)\n* kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)\n* openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782)\n* kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure (CVE-2026-89777)\n* kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)\n* bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)\n* libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)\n* bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)\n* bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)\n* kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)\n* kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)\n* kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)\n* kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)\n* brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)\n* kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936)\n* libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)\n* openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)\n* unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)\n* kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)\n* openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)\n* openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)\n* libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path (CVE-2026-71226)\n* libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)\n* libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)\n* kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)\n* kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:95346",
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "2438762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
},
{
"category": "external",
"summary": "2462114",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462114"
},
{
"category": "external",
"summary": "2492108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492108"
},
{
"category": "external",
"summary": "2496759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759"
},
{
"category": "external",
"summary": "2496764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764"
},
{
"category": "external",
"summary": "2499603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499603"
},
{
"category": "external",
"summary": "2506133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506133"
},
{
"category": "external",
"summary": "2511932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
},
{
"category": "external",
"summary": "2513253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513253"
},
{
"category": "external",
"summary": "2514115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514115"
},
{
"category": "external",
"summary": "2515348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
},
{
"category": "external",
"summary": "2517559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
},
{
"category": "external",
"summary": "2517560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
},
{
"category": "external",
"summary": "2517561",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
},
{
"category": "external",
"summary": "2528642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528642"
},
{
"category": "external",
"summary": "2535066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535066"
},
{
"category": "external",
"summary": "2535170",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535170"
},
{
"category": "external",
"summary": "2535227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535227"
},
{
"category": "external",
"summary": "2537080",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537080"
},
{
"category": "external",
"summary": "2546385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546385"
},
{
"category": "external",
"summary": "2546487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546487"
},
{
"category": "external",
"summary": "2546494",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546494"
},
{
"category": "external",
"summary": "2547476",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547476"
},
{
"category": "external",
"summary": "2550254",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
},
{
"category": "external",
"summary": "2550256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
},
{
"category": "external",
"summary": "2550258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
},
{
"category": "external",
"summary": "2553390",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
},
{
"category": "external",
"summary": "2554835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554835"
},
{
"category": "external",
"summary": "2555068",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555068"
},
{
"category": "external",
"summary": "2556406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556406"
},
{
"category": "external",
"summary": "2556407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"
},
{
"category": "external",
"summary": "2556413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556413"
},
{
"category": "external",
"summary": "2556415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556415"
},
{
"category": "external",
"summary": "2558973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
},
{
"category": "external",
"summary": "OCPBUGS-129524",
"url": "https://issues.redhat.com/browse/OCPBUGS-129524"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_95346.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.22.22 bug fix and security update",
"tracking": {
"current_release_date": "2026-11-06T22:24:26+00:00",
"generator": {
"date": "2026-11-06T22:24:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.5"
}
},
"id": "RHSA-2026:95346",
"initial_release_date": "2026-11-06T18:10:52+00:00",
"revision_history": [
{
"date": "2026-11-06T18:10:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-06T18:10:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-06T22:24:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.22",
"product": {
"name": "Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.22::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-4.22.9.8.202611032353-0",
"product": {
"name": "rhcos-aarch64-4.22.9.8.202611032353-0",
"product_id": "rhcos-aarch64-4.22.9.8.202611032353-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202611032353?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-4.22.9.8.202611032353-0",
"product": {
"name": "rhcos-ppc64le-4.22.9.8.202611032353-0",
"product_id": "rhcos-ppc64le-4.22.9.8.202611032353-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202611032353?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-4.22.9.8.202611032353-0",
"product": {
"name": "rhcos-s390x-4.22.9.8.202611032353-0",
"product_id": "rhcos-s390x-4.22.9.8.202611032353-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202611032353?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-4.22.9.8.202611032353-0",
"product": {
"name": "rhcos-x86_64-4.22.9.8.202611032353-0",
"product_id": "rhcos-x86_64-4.22.9.8.202611032353-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.22.9.8.202611032353?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0"
},
"product_reference": "rhcos-aarch64-4.22.9.8.202611032353-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0"
},
"product_reference": "rhcos-ppc64le-4.22.9.8.202611032353-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0"
},
"product_reference": "rhcos-s390x-4.22.9.8.202611032353-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22",
"product_id": "9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
},
"product_reference": "rhcos-x86_64-4.22.9.8.202611032353-0",
"relates_to_product_reference": "9Base-RHOSE-4.22"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-31936",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-08-11T16:52:54.610522+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514115"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within System Management Mode (SMM). Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This vulnerability could lead to high impact on confidentiality and integrity of the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important privilege escalation flaw affects Intel Xeon 6 Processors when Intel TDX is enabled, allowing a privileged local attacker to escalate privileges within the System Management Mode (SMM). Exploitation requires a high complexity attack and specific internal knowledge, impacting the confidentiality and integrity of the system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-31936"
},
{
"category": "external",
"summary": "RHBZ#2514115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514115"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-31936",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31936"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-31936",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31936"
},
{
"category": "external",
"summary": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html",
"url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01379.html"
}
],
"release_date": "2026-08-11T16:28:06.168000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "This vulnerability only affects systems using Intel Trust Domain Extensions (TDX) on Intel Xeon 6 processors. Systems not using Intel TDX are not vulnerable to this issue. Disabling Intel TDX, where feasible, removes the exposure to this vulnerability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM"
},
{
"cve": "CVE-2026-8458",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2026-07-03T07:01:30.042181+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496764"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libcurl. A logical error in the connection pooling mechanism may cause libcurl to reuse an authenticated connection for an unintended service. This could allow an application to wrongfully reuse an existing connection to the same server that was authenticated for a different service, potentially leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: libcurl: Unauthorized connection reuse due to a logical error",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in libcurl where a logical error in connection pooling can lead to unauthorized connection reuse. When an application uses Negotiate authentication with different service names on the same hostname and port, libcurl might incorrectly reuse an existing authenticated connection for an unintended service. This could result in information disclosure or unauthorized access to resources, bypassing intended service isolation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8458"
},
{
"category": "external",
"summary": "RHBZ#2496764",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496764"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8458",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.html",
"url": "https://curl.se/docs/CVE-2026-8458.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8458.json",
"url": "https://curl.se/docs/CVE-2026-8458.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3721183",
"url": "https://hackerone.com/reports/3721183"
}
],
"release_date": "2026-07-03T06:14:42.258000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "curl: libcurl: Unauthorized connection reuse due to a logical error"
},
{
"cve": "CVE-2026-8932",
"cwe": {
"id": "CWE-1025",
"name": "Comparison Using Wrong Factors"
},
"discovery_date": "2026-07-03T07:01:15.122562+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity. This issue primarily affects applications that dynamically alter mTLS client certificate configurations and reuse connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-8932"
},
{
"category": "external",
"summary": "RHBZ#2496759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-8932",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-8932"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8932"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.html",
"url": "https://curl.se/docs/CVE-2026-8932.html"
},
{
"category": "external",
"summary": "https://curl.se/docs/CVE-2026-8932.json",
"url": "https://curl.se/docs/CVE-2026-8932.json"
},
{
"category": "external",
"summary": "https://hackerone.com/reports/3733910",
"url": "https://hackerone.com/reports/3733910"
}
],
"release_date": "2026-07-03T06:16:30.485000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse"
},
{
"acknowledgments": [
{
"names": [
"Valentino Paulon"
]
}
],
"cve": "CVE-2026-12080",
"cwe": {
"id": "CWE-61",
"name": "UNIX Symbolic Link (Symlink) Following"
},
"discovery_date": "2026-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499603"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12080"
},
{
"category": "external",
"summary": "RHBZ#2499603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499603"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12080",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12080"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12080",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12080"
},
{
"category": "external",
"summary": "https://gitlab.com/qemu-project/qemu/-/work_items/3929",
"url": "https://gitlab.com/qemu-project/qemu/-/work_items/3929"
}
],
"release_date": "2026-07-09T10:57:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "If the `guest-ssh-add-authorized-keys` command is not required, it can be disabled by adding it to the qemu-guest-agent block list (qemu-ga --block-rpcs). This prevents the vulnerable code path from being reached while preserving all other guest-agent functionality.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys"
},
{
"cve": "CVE-2026-14456",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-08-13T14:21:24.109249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2515348"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A remote attacker could exploit this by sending a large number of QUIC Initial packets to an OpenSSL QUIC server. This can cause the server to allocate and queue new incoming channels without limit, leading to unbounded memory growth. The excessive memory consumption can result in a Denial of Service (DoS) condition, making the QUIC listener unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Enterprise Linux 9.8+, 10.2+, Red Hat Hardened Images, RHIVOS 2, and OpenShift 4.22 ship OpenSSL 3.5.x which includes the QUIC server implementation affected by this flaw. Earlier RHEL versions ship OpenSSL 3.2.x or below, which do not include the QUIC server feature and are not affected. The FIPS module is not affected as the QUIC implementation is outside the OpenSSL FIPS module boundary. Applications must explicitly enable the QUIC server listener to be vulnerable; simply having OpenSSL 3.5 installed does not expose the flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14456"
},
{
"category": "external",
"summary": "RHBZ#2515348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515348"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14456"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9",
"url": "https://github.com/openssl/openssl/commit/08e7756c3900bcfd77a720e7b74e27d6e4ed01a9"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b",
"url": "https://github.com/openssl/openssl/commit/4084152e040329ca0194c4c1750b9b46d00a5b6b"
},
{
"category": "external",
"summary": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139",
"url": "https://github.com/openssl/openssl/commit/f2f1465f2d2e5c61dfeac4d20fd093797d821139"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260813.txt",
"url": "https://openssl-library.org/news/secadv/20260813.txt"
}
],
"release_date": "2026-08-13T13:55:52.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.]\n\nA. Confirm QUIC Exposure - Check if any service is listening on UDP 443:\n~~~\n$ ss -ulnp | grep \u0027:443\u0027\n# or\n$ sudo lsof -iUDP:443 -n -P\n~~~\n\nNote: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected).\n\nB. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:)\n~~~\n$ sudo firewall-cmd --permanent --remove-service=quic 2\u003e/dev/null\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"10.0.0.0/8\" port port=\"443\" protocol=\"udp\" accept\u0027\n$ sudo firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" port port=\"443\" protocol=\"udp\" drop\u0027\n$ sudo firewall-cmd --reload\n~~~\n\nC. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled):\n~~~\n$ nc -u -v YOUR_HOST 443\n~~~\n\nOption 2: Disable QUIC Server\n\nIf QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead.\n\nRecommended Mitigation Priority\nPriority : Action\n1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range\n2.Block or rate-limit UDP 443 at firewall/edge (immediate)\n3.Disable QUIC/HTTP3 on the service if not needed\n4.Upgrade OpenSSL to fixed release when available\n5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server"
},
{
"cve": "CVE-2026-18798",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-08-17T19:14:03.992000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A malformed INITIAL packet with an invalid DCID (destination connection ID) can cause the QUIC server to double free the QRX object. This issue leads to memory corruption, causing the termination of the QUIC server process and resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: QUIC server may trigger double free when processing INITIAL packet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue can cause memory corruption due to the double free of the QRX object. However, there is currently no evidence it allows remote code execution, limiting the impact of this vulnerability to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18798"
},
{
"category": "external",
"summary": "RHBZ#2517559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18798",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18798"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18798"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: QUIC server may trigger double free when processing INITIAL packet"
},
{
"cve": "CVE-2026-19630",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-10-20T19:42:24.891000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556406"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending specially crafted Domain Name System (DNS) protocol messages containing an excessive number of specific structures. Because BIND does not impose a limit on processing these structures, handling the malicious request consumes disproportionate amounts of CPU time and memory, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity flaw because an unauthenticated remote attacker can exhaust server CPU and memory resources without requiring privileges, resulting in a denial of service. In Red Hat Enterprise Linux and OpenShift environments, the risk primarily affects BIND instances functioning as recursive resolvers exposed to untrusted traffic. Deployments serving strictly authoritative roles or those isolated from untrusted client queries experience significantly lower exposure to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19630"
},
{
"category": "external",
"summary": "RHBZ#2556406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556406"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19630",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19630"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19630"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-19630",
"url": "https://kb.isc.org/docs/cve-2026-19630"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: BIND: Denial of Service via unbounded processing of crafted DNS messages"
},
{
"cve": "CVE-2026-26007",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"discovery_date": "2026-02-10T22:01:01.036116+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2438762"
}
],
"notes": [
{
"category": "description",
"text": "A validation flaw has been discovered in the python cryptography package. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor \u003e 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it\u0027s easy to forge signatures on the small subgroup. Only SECT curves are impacted by this.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw, while difficult to exploit, would lead to a loss of integrity in the encrypted communication channel. Given that the cryptography package is a library, it is likely to be used in situations that do not require user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-26007"
},
{
"category": "external",
"summary": "RHBZ#2438762",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2438762"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-26007",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26007"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c",
"url": "https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c"
},
{
"category": "external",
"summary": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2",
"url": "https://github.com/pyca/cryptography/security/advisories/GHSA-r6ph-v2qm-q3c2"
}
],
"release_date": "2026-02-10T21:42:56.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves"
},
{
"cve": "CVE-2026-50252",
"cwe": {
"id": "CWE-349",
"name": "Acceptance of Extraneous Untrusted Data With Trusted Data"
},
"discovery_date": "2026-07-22T14:01:16.042166+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2506133"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Unbound\u0027s SO_REUSEPORT implementation reduces UDP source port entropy by allowing attackers to map ports to specific worker threads. This enables DNS cache poisoning, potentially leading to traffic redirection or unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "unbound: Unbound: DNS cache poisoning via UDP source port predictability",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Moderate: This flaw allows for DNS cache poisoning due to predictable UDP source ports when Unbound\u0027s `so-reuseport` option is enabled by default. An attacker on an adjacent network can exploit this to compromise the integrity of DNS resolutions, leading to potential redirection of traffic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-50252"
},
{
"category": "external",
"summary": "RHBZ#2506133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506133"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-50252",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-50252"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-50252",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50252"
},
{
"category": "external",
"summary": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt",
"url": "https://www.nlnetlabs.nl/downloads/unbound/CVE-2026-50252.txt"
}
],
"release_date": "2026-07-22T13:08:54.981000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Disable the so-reuseport option by explicitly setting so-reuseport: no in your unbound.conf file. This prevents the deterministic mapping of worker threads to outbound UDP source ports, effectively stopping the cache poisoning vector. Additionally, restrict who can query the resolver using the access-control directive to reduce the overall attack surface, and restart the Unbound service to apply the changes.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "unbound: Unbound: DNS cache poisoning via UDP source port predictability"
},
{
"cve": "CVE-2026-52929",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-06-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492108"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s SCTP stream scheduler. When transient outgoing streams are denied and torn down, the kernel fails to reclaim scheduler-specific metadata before an algorithm switch (e.g., WFQ to PRIO). The orphaned state - including internal accounting fields - becomes reachable through the new scheduler\u0027s accessors, allowing an unprivileged local attacker to read arbitrary kernel memory and corrupt kernel objects via SCTP_STREAM_SCHEDULER_VALUE socket options. This can be leveraged for local privilege escalation to full root capabilities. A failed exploitation attempt may also crash the kernel, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: stream: fully roll back denied add-stream state",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-52929"
},
{
"category": "external",
"summary": "RHBZ#2492108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492108"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-52929",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52929"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52929",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52929"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52929-63ee@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026062432-CVE-2026-52929-63ee@gregkh/T"
}
],
"release_date": "2026-06-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content:\n\n```\ninstall sctp /bin/true\nblacklist sctp\n```\n\nAfter creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: sctp: stream: fully roll back denied add-stream state"
},
{
"cve": "CVE-2026-63072",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-17T19:24:54.673000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517560"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMS (Cryptographic Message Syntax) message can cause an 8-byte out-of-bounds heap write when it is decrypted with CMS_decrypt(). This issue occurs because the CMS decryption process incorrectly sizes the key-unwrap output buffer when using the AES-WRAP-PAD unwrap primitive. This can lead to memory corruption, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: heap buffer overflow in CMS key unwrapping",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to supply a crafted CMS message to be decrypted in an application by CMS_decrypt(). The out-of-bounds write is a fixed-size (8-byte), fixed-value (zero) heap overflow immediately past the memory allocation, causing memory corruption, but the impact is limited to a denial of service. For these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63072"
},
{
"category": "external",
"summary": "RHBZ#2517560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63072"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: heap buffer overflow in CMS key unwrapping"
},
{
"cve": "CVE-2026-63076",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-08-17T19:30:30.087000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2517561"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. A crafted CMP (Certificate Management Protocol) message can cause an invalid pointer dereference due to a missing type check in the password-based protection verification. A remote, unauthenticated attacker can crash applications acting as a CMP server or client, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs to supply a crafted CMP message to an application acting as a CMP server or client. Server applications need to be configured to accept PBM-protected messages, and client applications need to communicate with a malicious or intercepted CMP server. The missing type check causes an invalid pointer dereference, resulting in a denial of service. There is no memory disclosure, no controlled memory write and no path to code execution. For these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-63076"
},
{
"category": "external",
"summary": "RHBZ#2517561",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517561"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-63076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63076"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/secadv/20260825.txt",
"url": "https://openssl-library.org/news/secadv/20260825.txt"
}
],
"release_date": "2026-08-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg"
},
{
"cve": "CVE-2026-64597",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-08-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2511932"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Server Message Block (SMB) client. A vulnerability exists in the SMB2_close() replay mechanism where a response buffer can be freed twice. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code. Exploitation requires the victim system to connect to a malicious or compromised SMB server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: smb: client: fix double-free in SMB2_close() replay",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important severity because kernel-space memory corruption can result in a system crash or potential arbitrary code execution, though it requires communicating with a compromised or malicious endpoint. Under standard Red Hat Enterprise Linux deployments, the SMB client is not active by default and requires explicit mounting of a remote file share. Consequently, systems that do not interact with untrusted SMB servers operate with significantly reduced risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-64597"
},
{
"category": "external",
"summary": "RHBZ#2511932",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2511932"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-64597",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-64597"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-64597",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64597"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026080652-CVE-2026-64597-760b@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026080652-CVE-2026-64597-760b@gregkh/T"
}
],
"release_date": "2026-08-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "If SMB/CIFS client functionality is not required, the \u0027cifs\u0027 kernel module can be blocklisted to prevent it from loading. Systems that do not mount SMB/CIFS shares are not affected. For systems that require SMB client access, ensure connections are only made to trusted SMB servers.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: smb: client: fix double-free in SMB2_close() replay"
},
{
"cve": "CVE-2026-68376",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-10T12:26:50.837229+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2513253"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s Stream Control Transmission Protocol (SCTP) implementation. An incorrect array size calculation for the `auth_hmacs` field within the `sctp_cookie` structure could lead to a buffer overflow. During the initialization of an SCTP association, if four HMAC identifiers are configured, the system attempts to copy data beyond the allocated buffer. This results in the corruption of an adjacent memory field (`auth_chunks`) and can subsequently cause an out-of-bounds read when processing HMAC identifiers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an attacker can trigger kernel memory corruption during association setup, leading to system crashes or kernel memory disclosure. In Red Hat Enterprise Linux, the sctp kernel module is not loaded by default unless an application explicitly opens an SCTP socket. Exploitation is constrained by the prerequisite that an endpoint must be configured with multiple HMAC authentication algorithms, which is uncommon in default network deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-68376"
},
{
"category": "external",
"summary": "RHBZ#2513253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513253"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-68376",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-68376"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-68376",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68376"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2026081043-CVE-2026-68376-5dfa@gregkh/T"
}
],
"release_date": "2026-08-10T12:03:54.666000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "To prevent the SCTP kernel module from loading, blacklist it by creating a file `/etc/modprobe.d/disable-sctp.conf` with the content `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (RHEL 8/9/10) or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (RHEL 7), then reboot the system. This action may affect applications dependent on SCTP.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: sctp: fix auth_hmacs array size in struct sctp_cookie"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-71226",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-04-26T18:17:10+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2462114"
}
],
"notes": [
{
"category": "description",
"text": "Memory Corruption via Uncanceled AIO Requests on Error: libkcapi\u0027s one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in libkcapi affects applications utilizing the one-shot Asynchronous I/O (AIO) interfaces with the `KCAPI_INIT_AIO` flag. Exploitation requires an error to occur after submitting I/O Control Blocks (IOCBs), followed by the application freeing or reusing output buffers before all kernel completions are processed. This vulnerability does not affect default configurations as it relies on an opt-in AIO setup.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-71226"
},
{
"category": "external",
"summary": "RHBZ#2462114",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2462114"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-71226",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-71226"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71226"
}
],
"release_date": "2026-08-05T12:22:09.014000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi\u0027s one-shot AIO path"
},
{
"cve": "CVE-2026-77206",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-13T07:34:21.126000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550256"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in Libreswan\u0027s IKEv2 state-machine handling. A remote, unauthenticated attacker can trigger the flaw by sending a malicious IKEv2 IKE_AUTH packet, causing the pluto daemon to crash and restart. Repeated exploitation may result in a denial of service. The vulnerability can be triggered even when EAP is not configured.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as having a Moderate impact. Exploitation requires Libreswan to be running as an IKEv2 endpoint, a configuration that requires explicit installation and service configuration on a standard Red Hat Enterprise Linux system. A remote, unauthenticated attacker can send a crafted IKEv2 authentication packet to crash the pluto daemon, potentially disrupting VPN connectivity. Repeated exploitation can cause continued denial of service. Remote code execution is not possible.\n\nThe vulnerability can be triggered even when EAP is not configured.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77206"
},
{
"category": "external",
"summary": "RHBZ#2550256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77206",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77206"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77206"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt",
"url": "https://libreswan.org/security/CVE-2026-77206/CVE-2026-77206.txt"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch",
"url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.3-CVE-2026-77206.patch"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch",
"url": "https://libreswan.org/security/CVE-2026-77206/libreswan-5.4-CVE-2026-77206.patch"
}
],
"release_date": "2026-10-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code"
},
{
"cve": "CVE-2026-77207",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-10-13T07:34:23.608000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550258"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference flaw was found in Libreswan\u0027s PKCS#7 certificate payload handling. When processing a crafted IKEv2 IKE_AUTH packet containing a PKCS#7 bundle with a certificate revocation list but no certificates, Libreswan may dereference a null pointer, causing the pluto daemon to crash and restart. A remote, unauthenticated attacker could repeatedly trigger this flaw to cause a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact for Red Hat because exploitation requires Libreswan to be deployed, configured, and running as an IKEv2 endpoint, which is not the default configuration of a general-purpose Red Hat Enterprise Linux installation. A remote, unauthenticated attacker can send a crafted IKEv2 packet to crash the Libreswan daemon, potentially disrupting VPN connectivity. Although, systemd supervision typically restarts the crashed process automatically, reducing the persistence of service interruptions, repeated exploitation can cause continued denial of service.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77207"
},
{
"category": "external",
"summary": "RHBZ#2550258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77207",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77207"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77207"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt",
"url": "https://libreswan.org/security/CVE-2026-77207/CVE-2026-77207.txt"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch",
"url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.3-CVE-2026-77207.patch"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch",
"url": "https://libreswan.org/security/CVE-2026-77207/libreswan-5.4-CVE-2026-77207.patch"
}
],
"release_date": "2026-10-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS"
},
{
"cve": "CVE-2026-77214",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-10-07T14:42:40.407146+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2547476"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in expat. A remote attacker can exploit this vulnerability through repeated parse buffer operations with unvalidated buffer lengths, causing a heap buffer over-read. This issue primarily leads to information disclosure by leaking adjacent heap memory contents, which could assist in bypassing security mitigations such as Address Space Layout Randomization (ASLR), or result in a Denial of Service (DoS) by crashing the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because the Expat XML parser is ubiquitous across Red Hat Enterprise Linux environments, frequently handling untrusted inputs in network-facing services and runtime environments. When applications process incoming XML data through repeated chunked parsing calls, an unauthenticated attacker can induce an out-of-bounds heap read without requiring prior privileges. This memory disclosure enables the retrieval of process memory layouts and pointers, effectively weakening ASLR and lowering the barrier for subsequent exploit chains.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-77214"
},
{
"category": "external",
"summary": "RHBZ#2547476",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547476"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-77214",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-77214"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77214"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0",
"url": "https://github.com/libexpat/libexpat/commit/13c5f63a7f1c52c2feee3b16a1134d4fb68e9ea0"
},
{
"category": "external",
"summary": "https://github.com/libexpat/libexpat/pull/1393",
"url": "https://github.com/libexpat/libexpat/pull/1393"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer",
"url": "https://www.vulncheck.com/advisories/libexpat-heap-buffer-over-read-in-xmlparse-c-via-xml-parsebuffer"
}
],
"release_date": "2026-10-07T14:35:42.794000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer"
},
{
"cve": "CVE-2026-80824",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528642"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s USB subsystem (usbfs). An unprivileged local attacker with read/write access to a /dev/bus/usb node could exploit a use-after-free vulnerability. This occurs because the usb_device structure is prematurely freed before all pending operations are completed. Successful exploitation of this memory corruption flaw could lead to a system crash or potentially privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important severity use-after-free flaw was found in the Linux kernel usbfs (USB user-space) subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux and other Red Hat products that ship the Red Hat kernel. In usbdev_release(), the reference to the struct usb_device is dropped before the list of completed asynchronous URBs is drained, and the drain path (free_async() calling dec_usb_memory_use_count()) then reads back through the already-freed device, for example via bus_to_hcd(ps-\u003edev-\u003ebus). An unprivileged local attacker with read/write access to a /dev/bus/usb device node could mmap() the file descriptor, submit an asynchronous URB whose buffer lies inside that mapping, wait for the device to be unplugged so that the usbfs reference becomes the last reference and the device is freed, and then unmap and close the file descriptor, deterministically triggering the use-after-free. Successful exploitation of this memory corruption flaw could lead to a kernel crash (denial of service) or potentially privilege escalation. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): although triggering the use-after-free itself is deterministic and not a race, reliably converting it into privilege escalation requires high attack complexity. A fix is being pursued for the affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-80824"
},
{
"category": "external",
"summary": "RHBZ#2528642",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528642"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-80824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-80824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-80824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80824"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80824.mbox"
}
],
"release_date": "2026-09-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()"
},
{
"cve": "CVE-2026-84782",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-18T19:58:21.939000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2537080"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSL. The Datagram Transport Layer Security (DTLS) retransmission mechanism fails to properly handle handshake message writes that are suspended before completion. A remote attacker could exploit this vulnerability during handshake message retransmission, causing OpenSSL to read past the message buffer or overwrite internal state required to resume writing. This issue can result in information disclosure through out-of-bounds memory reads or cause a Denial of Service (DoS) by crashing the process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an unauthenticated network adversary can trigger process crashes or memory exposure without requiring local system privileges. Red Hat Enterprise Linux utilizes OpenSSL as the fundamental cryptographic provider across the operating system; however, overall exposure is limited because the flaw strictly affects software using Datagram Transport Layer Security (DTLS) over UDP under non-blocking I/O configurations. Standard TLS connections over TCP, which represent the typical deployment model for the majority of Red Hat workloads and system services, are unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84782"
},
{
"category": "external",
"summary": "RHBZ#2537080",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537080"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84782",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84782"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84782"
},
{
"category": "external",
"summary": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782",
"url": "https://openssl-library.org/news/vulnerabilities/#CVE-2026-84782"
}
],
"release_date": "2026-09-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission"
},
{
"cve": "CVE-2026-89777",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535066"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s vfio/pci component. During device initialization, a memory pointer is not properly cleared after being freed, leading to a use-after-free and double-free vulnerability. A local attacker could exploit this flaw to cause a system crash, resulting in a denial of service, or potentially execute arbitrary code with elevated privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A use-after-free and double-free flaw in the Linux kernel\u0027s vfio/pci subsystem has been rated Important by Red Hat. When initialization of the per-device MSI permission table fails (for example, when an underlying allocation fails with -ENOMEM), the error path in vfio_msi_cap_len() frees vdev-\u003emsi_perm but leaves the dangling pointer stored in the per-device vfio_pci_core_device structure, which persists across open/close cycles. A local attacker with access to a VFIO PCI device could trigger this failed initialization path and then, on a subsequent open or close of the device, cause the freed object to be reused for MSI config-space accesses (dereferencing and calling the freed perm-\u003ereadfn/perm-\u003ewritefn function pointers) or to be freed a second time in vfio_config_free(). This can lead to a kernel panic and system crash (denial of service) or potentially to execution of arbitrary code with elevated privileges. Red Hat rates this flaw as Important with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H); the higher CVE.org score of 8.8 reflects a lower attack-complexity assessment, whereas Red Hat considers exploitation to depend on reliably steering a memory-allocation failure during device initialization. Within Red Hat\u0027s affected product scope, Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt ELS streams) are not affected because the vulnerable code is not present, while the vulnerable code is present in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt), Red Hat In-Vehicle OS, and Red Hat OpenShift versions that ship an affected kernel, and fixes are being pursued through the responsible engineering teams.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-89777"
},
{
"category": "external",
"summary": "RHBZ#2535066",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535066"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-89777",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-89777"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-89777",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89777"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89777.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: vfio/pci: clear vdev-\u003emsi_perm after freeing it on init failure"
},
{
"cve": "CVE-2026-90003",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535170"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s futex component. A race condition during the FUTEX_CMP_REQUEUE_PI operation can lead to a use-after-free vulnerability in the rcuwait mechanism. This issue could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: futex: Prevent rcuwait use-after-free during requeue PI",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A use-after-free in the futex requeue PI path can occur on PREEMPT_RT because futex_requeue_pi_complete can call rcuwait_wake_up on q.requeue_wait after the waiter has left the syscall and the stack allocated futex_q is no longer valid. A local process can trigger the vulnerable path through FUTEX_CMP_REQUEUE_PI by racing an early wakeup from timeout or signal with a PI requeue operation. For the CVSS the PR:L is used because an unprivileged local process can reach the futex syscall path and can create waiter and requeue activity, while no network access is involved. The base impact is at least local denial of service via KASAN report or kernel crash. For the paranoid score, the UAF on a kernel stack object makes limited or full confidentiality and integrity impact defensible and the issue should be reviewed manually.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90003"
},
{
"category": "external",
"summary": "RHBZ#2535170",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535170"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90003",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90003"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90003",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90003"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90003.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90003.mbox"
},
{
"category": "external",
"summary": "https://kernelcve.org/list/?q=CVE-2026-90003",
"url": "https://kernelcve.org/list/?q=CVE-2026-90003"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: futex: Prevent rcuwait use-after-free during requeue PI"
},
{
"cve": "CVE-2026-90011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-09-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2535227"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s iSCSI target component. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted login payload to an iSCSI portal configured for Challenge-Handshake Authentication Protocol (CHAP). This can lead to an out-of-bounds read, potentially resulting in information disclosure from adjacent memory or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as having an Important impact because an unauthenticated network initiator can trigger an out-of-bounds memory access prior to session establishment, potentially crashing the host kernel or leaking adjacent slab data. The vulnerability only affects deployments explicitly serving storage through the Linux kernel LIO iSCSI target where CHAP authentication is enabled. Standard Red Hat Enterprise Linux installations do not run the target service by default, and client hosts acting strictly as iSCSI initiators are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-90011"
},
{
"category": "external",
"summary": "RHBZ#2535227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535227"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-90011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-90011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-90011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90011"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90011.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-90011.mbox"
}
],
"release_date": "2026-09-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload"
},
{
"cve": "CVE-2026-94300",
"cwe": {
"id": "CWE-366",
"name": "Race Condition within a Thread"
},
"discovery_date": "2026-10-20T19:46:35.830000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. This vulnerability may allow a remote attacker to achieve arbitrary code execution on the target server. An attacker who captures a valid User Datagram Protocol (UDP) message signed with Generic Security Service Transaction Signature (GSS-TSIG) can replay it while the negotiated key is active. When combined with crafted queries directed to an attacker-controlled DNS zone, this triggers memory corruption in the named service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as Important rather than Critical because, while remote unauthenticated code execution is possible, exploitation depends on capturing active cryptographic keys within their validity window and orchestrating complex concurrent requests. In standard Red Hat Enterprise Linux deployments, the BIND daemon does not enable GSS-TSIG by default, restricting risk primarily to servers integrated with Kerberos-based identity infrastructure like FreeIPA or Active Directory. Deployments that do not negotiate GSS-TSIG keys or that strictly limit dynamic DNS access to trusted networks remain unexposed to this attack vector.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94300"
},
{
"category": "external",
"summary": "RHBZ#2556407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94300",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94300"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94300"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-94300",
"url": "https://kb.isc.org/docs/cve-2026-94300"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls.\n\nTo disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service:\n\nsystemctl restart named\n\nIf operating named inside a chroot environment, execute:\n\nsystemctl restart named-chroot\n\nAlternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access.\n\nCaveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment.\nWarning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay"
},
{
"cve": "CVE-2026-94453",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"discovery_date": "2026-10-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2550254"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in Libreswan\u0027s IKE-over-TCP handling. When a TCP connection closes and additional packet processing occurs for the same connection tuple, the IKE daemon may access a previously freed interface endpoint object. A remote, unauthenticated attacker may exploit this flaw to cause the pluto daemon to crash and restart, resulting in denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having an Important security impact. A remote, unauthenticated attacker may exploit a use-after-free in Libreswan\u0027s IKE-over-TCP handling before peer authentication to cause the IKE daemon to crash and restart. Repeated exploitation can result in denial of service.\n\nThe vulnerability affects only configurations that explicitly enable IKE-over-TCP using `listen-tcp=yes`; this option is not enabled by default. Consequently, exposure is limited to systems configured to accept IKE-over-TCP connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-94453"
},
{
"category": "external",
"summary": "RHBZ#2550254",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550254"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-94453",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-94453"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94453"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt",
"url": "https://libreswan.org/security/CVE-2026-94453/CVE-2026-94453.txt"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch",
"url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.3-CVE-2026-94453.patch"
},
{
"category": "external",
"summary": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch",
"url": "https://libreswan.org/security/CVE-2026-94453/libreswan-5.4-CVE-2026-94453.patch"
}
],
"release_date": "2026-10-05T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. \n\nIf IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP"
},
{
"cve": "CVE-2026-96888",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-19T18:50:52.794000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556413"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a Denial of Service (DoS) by sending requests that trigger an assertion failure, abruptly terminating the resolver daemon. This vulnerability occurs when the resolver is configured with both a redirect zone and strict query name minimization while processing redirected queries.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of Service via assertion failure during redirect processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an unauthenticated remote attacker can trigger a denial of service by causing the named daemon to crash without prior privileges. Exploitation is restricted to recursive resolvers where administrators have explicitly configured redirect zones alongside strict query name minimization. Standard Red Hat Enterprise Linux installations do not employ these non-default settings out of the box, significantly limiting exposure on typical systems.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-96888"
},
{
"category": "external",
"summary": "RHBZ#2556413",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556413"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-96888",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-96888"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96888"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-96888",
"url": "https://kb.isc.org/docs/cve-2026-96888"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of Service via assertion failure during redirect processing"
},
{
"cve": "CVE-2026-97313",
"cwe": {
"id": "CWE-617",
"name": "Reachable Assertion"
},
"discovery_date": "2026-10-20T19:57:36.315000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2556415"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BIND. A remote attacker can cause a denial of service (DoS) by sending a sequence of recursive and non-recursive queries to an affected server. When BIND is configured to handle recursive queries alongside multiple Response Policy Zones (RPZ) with differing recursion settings, processing these queries triggers an assertion failure. This failure causes the service to crash and terminate abruptly.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bind: bind: Denial of service via assertion failure in RPZ query processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can crash the BIND name service, causing a denial of service for all dependent infrastructure. Exploitation requires a specific, non-default deployment where recursive queries are permitted alongside multiple response policy zones configured with conflicting recursive-only options. Default Red Hat Enterprise Linux configurations do not define response policy zones and are therefore not exposed unless administrators have explicitly implemented this combination of policies.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-97313"
},
{
"category": "external",
"summary": "RHBZ#2556415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2556415"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-97313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-97313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97313"
},
{
"category": "external",
"summary": "https://kb.isc.org/docs/cve-2026-97313",
"url": "https://kb.isc.org/docs/cve-2026-97313"
}
],
"release_date": "2026-10-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Ensure all Response Policy Zones (RPZ) configured in `/etc/named.conf` use identical `recursive-only` settings. For example, ensure all RPZ definitions consistently specify `recursive-only yes;` or `recursive-only no;`, eliminating conflicting policies.\n\nAlternatively, limit recursive query privileges strictly to authorized clients by configuring the `allow-recursion` option with an access control list (ACL).\n\nAfter modifying the configuration, validate the syntax and reload the service:\n\n```\nnamed-checkconf\nsystemctl reload named\n```\n\nCaveats:\nAligning the `recursive-only` setting across RPZ zones may alter policy enforcement behavior for non-recursive queries. Restricting recursion prevents unauthorized networks from performing recursive lookups.\n\nWarning:\nReloading or restarting the `named` service may cause a momentary pause in active DNS query processing.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "bind: bind: Denial of service via assertion failure in RPZ query processing"
},
{
"cve": "CVE-2026-98222",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2546385"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s encrypted keys subsystem. An integer overflow occurs during memory size calculations for key data, resulting in an undersized buffer allocation. A local user can exploit this issue by supplying crafted key data to trigger an out-of-bounds write to kernel memory. This flaw can lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: KEYS: encrypted: fix integer overflow of datablob_len",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this flaw as IMPORTANT for the affected Red Hat products. A flaw was found in the Linux kernel\u0027s encrypted keys subsystem: encrypted_key_alloc() stores datablob_len in a u16 that is computed from multiple string and payload lengths, and when the computed length exceeds U16_MAX the stored value is truncated, resulting in an undersized buffer allocation. A slab-out-of-bounds write then occurs when __ekey_init() copies the key data into the undersized buffer. A local user able to create keys, for example via the add_key() syscall, can supply crafted key data to trigger this out-of-bounds write to kernel memory, which can cause a system crash and denial of service, or potentially allow privilege escalation. Red Hat Enterprise Linux 6 Extended Lifecycle Support is not affected because the vulnerable code is not present in that stream. Red Hat Enterprise Linux 7 ELS, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 (kernel and kernel-ivos-qualcomm) are affected, and fixes are being pursued for these products. Red Hat has assigned this flaw a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attack vector with high attack complexity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98222"
},
{
"category": "external",
"summary": "RHBZ#2546385",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546385"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98222",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98222"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98222",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98222"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98222.mbox"
}
],
"release_date": "2026-10-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: KEYS: encrypted: fix integer overflow of datablob_len"
},
{
"cve": "CVE-2026-98320",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-10-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2546494"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: netfilter: flowtable: hold reference on ct until flow is released",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An Important severity use-after-free flaw was found in the Linux kernel\u0027s netfilter flowtable, affecting the kernel, kernel-rt, and kpatch packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS components. The flowtable datapath released its connection tracking reference prematurely: nf_ct_put() frees the ct extension area immediately, and the RCU typesafe semantics could allow the datapath to refer to the wrong or already-freed conntrack entry while a flow entry was still being released after the RCU grace period. An attacker able to trigger this timing window during network flow processing could cause a use-after-free condition that primarily results in a denial of service via a system crash or unexpected system instability. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity of reliably triggering the timing issue, whereas the upstream CVEORG score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams (kernel and kernel-rt) are not affected because the vulnerable code is not present in those kernels. Fixes for the affected product streams are being pursued.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98320"
},
{
"category": "external",
"summary": "RHBZ#2546494",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546494"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98320"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98320",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98320"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98320.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98320.mbox"
}
],
"release_date": "2026-10-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: netfilter: flowtable: hold reference on ct until flow is released"
},
{
"cve": "CVE-2026-98364",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-10-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2546487"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s IPsec (XFRM) networking subsystem. A race condition occurs when creating policy bundles while a network device is concurrently removed, leading to a use-after-free condition where the kernel accesses already-freed device memory. A local attacker can exploit this flaw to potentially escalate privileges or cause a Denial of Service (DoS) by crashing the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: xfrm: hold net_device reference under RCU in bundle creation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because local attackers could trigger kernel memory corruption to escalate privileges or compromise system availability through an immediate crash. Although exploiting the race condition requires specific timing during network interface teardown, the IPsec framework is built directly into standard Red Hat Enterprise Linux kernels. Multi-tenant systems and shared container hosts are particularly susceptible where unprivileged users can create network namespaces or manipulate interface lifecycles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98364"
},
{
"category": "external",
"summary": "RHBZ#2546487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546487"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98364",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98364"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98364",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98364"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98364.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98364.mbox"
}
],
"release_date": "2026-10-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: xfrm: hold net_device reference under RCU in bundle creation"
},
{
"cve": "CVE-2026-98432",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-10-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2553390"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol (TCP) connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could exploit this vulnerability by sending specially timed network requests, triggering a use-after-free condition. This could results in system crash leading to a Denial of Service (DoS), memory corruption, or remote code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Critical severity for Red Hat Enterprise Linux because it allows an unauthenticated remote attacker to cause kernel memory corruption or an immediate system crash over standard IPv4 TCP network traffic without requiring local privileges or user interaction. In default enterprise configurations across Red Hat environments, TCP services accept incoming connections without specialized tuning, making the concurrent connection handling paths inherently exposed to remote networks. Although reliably executing arbitrary code through this timing-sensitive use-after-free scenario requires precise heap control, the lack of network prerequisites and the potential for severe system instability elevate the impact above Important.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98432"
},
{
"category": "external",
"summary": "RHBZ#2553390",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553390"
},
{
"category": "external",
"summary": "RHSB-2026-016",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-016"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98432"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98432.mbox"
}
],
"release_date": "2026-10-15T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period"
},
{
"cve": "CVE-2026-98466",
"cwe": {
"id": "CWE-653",
"name": "Improper Isolation or Compartmentalization"
},
"discovery_date": "2026-10-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2554835"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host can exploit this flaw to inspect or alter sensitive hypervisor stack data, resulting in a bypass of hypervisor isolation and potential privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because a local attacker with elevated administrative access on the host can compromise hypervisor confidentiality and integrity, breaking the guest isolation boundary. Exploitation requires running protected KVM on ARM64 platforms, an environment specifically configured to restrict host access to guest memory. Systems operating under default configurations without protected virtualization, as well as those running on other architectures, are not exposed to this security flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98466"
},
{
"category": "external",
"summary": "RHBZ#2554835",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554835"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98466",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98466"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98466",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98466"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98466.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98466.mbox"
}
],
"release_date": "2026-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "--- CME Mitigation Guidance (2026-10-20) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to revoke host stage-2 page-table mappings for per-CPU hypervisor stack memory during protected nVHE initialization: upgrade to Linux kernel 6.18.55, 7.2.9, 7.3 (or the fixed Kernel/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds), which walk each per-CPU hypervisor stack virtual address range using the ownership-transition walker to transfer pages out of host stage-2, closing all 2 injection vectors (host stage-2 hypervisor stack memory read, host stage-2 hypervisor stack memory modification). Until patched, this is only a concern on ARM64 Linux systems running protected KVM (pKVM / protected nVHE) mode \u2014 Non-ARM64 architectures and deployments without protected KVM mode enabled are unaffected \u2014 so Strictly limit root access and prevent privileged userspace processes from reading physical memory or interacting with debugging interfaces on the host. As a compensating measure, Enforce SELinux in enforcing mode to prevent privileged processes from accessing raw physical memory interfaces or debugging utilities capable of reading hypervisor stack pages and Enable Kernel Lockdown Mode to restrict privileged host userspace from reading or writing raw physical memory via /dev/mem and patching running kernel memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying hypervisor stack memory isolation defect \u2014 apply the upstream patch to fully remediate.\n\nHighest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2"
},
{
"cve": "CVE-2026-98725",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-18T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2555068"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel\u0027s NVMe over Fabrics (NVMe-oF) target authentication component. A remote attacker connecting to the NVMe target service can exploit this vulnerability by sending a crafted authentication request, causing a Denial of Service (DoS) through a system crash or potential memory corruption. This issue occurs due to an incorrect buffer size calculation during authentication challenge processing, which allows an undersized buffer to bypass validation checks and results in an out-of-bounds write.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an unauthenticated remote attacker on the network can trigger a kernel panic or corrupt kernel memory, resulting in a system-wide denial of service. In typical Red Hat Enterprise Linux deployments, NVMe over Fabrics target mode is not enabled by default and requires explicit administrator configuration to export storage and process authentication. Only systems specifically configured to operate as NVMe-oF targets with in-band authentication are exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-98725"
},
{
"category": "external",
"summary": "RHBZ#2555068",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555068"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-98725",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-98725"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-98725",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98725"
},
{
"category": "external",
"summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98725.mbox",
"url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98725.mbox"
}
],
"release_date": "2026-10-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()"
},
{
"cve": "CVE-2026-111497",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-10-22T13:42:58.596140+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2558973"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Google Brotli decoder. An out-of-bounds write in the block-type switch handling in c/dec/decode.c can be triggered by a crafted Brotli-compressed stream. When an application decompresses untrusted Brotli data, this can lead to memory disclosure, denial of service, or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "brotli: Out-of-Bounds Write in Google Brotli Decoder",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue is rated Important. Exploitation requires that the target decompress attacker-controlled Brotli data (for example HTTP content negotiated with Content-Encoding: br, or APIs such as Node.js zlib / fetch() that decode Brotli). The vulnerable path is reached with a malformed stream rather than typical well-formed encoder output. Red Hat Enterprise Linux compiler and runtime hardenings - including Address Space Layout Randomization (ASLR), Non-eXecutable (NX) memory, FORTIFY_SOURCE, and SELinux - increase the difficulty of turning this memory corruption into reliable code execution, though they do not eliminate crashes or all impact. Combined with the Attack Requirements noted by the CNA (CVSS v4 AT:P), Red Hat scores Attack Complexity as High and rates the flaw Important rather than Critical.\n\n---\n\nThe Node.js packages in Red Hat Enterprise Linux use either system version of brotli or bundled version. Some Node.js versions are marked \"Not affected\" because they utilize system brotli. For these versions, the Node.js package itself does not require updating. However, customers must still update the system brotli/libbrotli package to address the vulnerability for these Node.js installations.\n\nFollowing is the overview of Node.js versions use system or bundled version.\n\n- Node.js 22 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:22 module, uses system brotli.\n- Node.js 24 in Red Hat Enterprise Linux 8 and 9, provided via nodejs:24 modules, use bundled brotli.\n- Node.js 22 and 24 in Red Hat Enterprise Linux 10, provided via nodejs22 and nodejs24 use system brotli.\n\n---\n\nThe .NET packages in Red Hat Enterprise Linux may either use system version of brotli or bundled version. Following is the overview of .NET versions use system or bundled version.\n\n- .NET 8.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet8.0 packages, use bundled brotli.\n- .NET 9.0, 10.0, and 11.0 in Red Hat Enterprise Linux 8, 9, and 10, provided via dotnet9.0, dotnet10.0, and dotnet11.0 packages, use system brotli.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-111497"
},
{
"category": "external",
"summary": "RHBZ#2558973",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558973"
},
{
"category": "external",
"summary": "RHSB-2026-015",
"url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-015"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-111497",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111497"
},
{
"category": "external",
"summary": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high",
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---high"
},
{
"category": "external",
"summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
}
],
"release_date": "2026-10-22T13:35:41.975000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-06T18:10:52+00:00",
"details": "For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5\n\n (For s390x architecture)\n The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef\n\n (For ppc64le architecture)\n The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f\n\n (For aarch64 architecture)\n The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced\n\nAll OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:95346"
},
{
"category": "workaround",
"details": "See the security bulletin for a detailed mitigation procedure.",
"product_ids": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.22:rhcos-aarch64-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-ppc64le-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-s390x-4.22.9.8.202611032353-0",
"9Base-RHOSE-4.22:rhcos-x86_64-4.22.9.8.202611032353-0"
]
}
],
"threats": [
{
"category": "exploit_status",
"date": "2026-10-27T00:00:00+00:00",
"details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
},
{
"category": "impact",
"details": "Important"
}
],
"title": "brotli: Out-of-Bounds Write in Google Brotli Decoder"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.