CVE-2026-114236: Missing Release of Resource after Effective Lifetime in Red Hat Confidential Compute Attestation

The vulnerability involves the functions storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer in Red Hat Confidential Compute Attestation. When these functions process corrupt or malicious inputs, they may fail to release file descriptors properly, causing a resource leak. Repeated exploitation can exhaust the file descriptor limit of the process, potentially leading to denial of service conditions. The CVSS 3.1 score is 3.3, reflecting low severity with local attack vector, low complexity, no privileges required, user interaction needed, and impact limited to availability.

The impact is limited to availability degradation due to resource exhaustion from leaked file descriptors. There is no impact on confidentiality or integrity. An attacker could cause denial of service by triggering repeated calls with crafted inputs that cause file descriptor leaks.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-114236 for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed inputs with the affected functions to reduce risk of resource exhaustion.