CVE-2026-85197: Use After Free in Red Hat Red Hat Enterprise Linux 10

CVE-2026-85197 is a heap use-after-free vulnerability in the HTTP/2 client implementation of libsoup3, a GNOME HTTP client library. The flaw occurs when a GNOME application uploads a file using HTTP/2 and the server sends a GOAWAY frame during asynchronous reading of the file body. This use-after-free can lead to memory corruption, which may result in information disclosure or arbitrary code execution. The vulnerability affects only libsoup3, as libsoup2 does not implement HTTP/2 client functionality. Red Hat Enterprise Linux 10 includes this vulnerable component. Red Hat's advisory states that no suitable mitigation currently exists that meets their criteria for deployment and stability.

Exploitation of this vulnerability can lead to memory corruption in the HTTP/2 client, potentially allowing an attacker to disclose sensitive information or execute arbitrary code. The CVSS v3.1 score is 7.6 (high severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, and high impact on availability with low impact on confidentiality and integrity.

According to the Red Hat advisory, no mitigation is currently available or meets the criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's official advisories for updates regarding patches or mitigations. Until a fix is released, cautious use of GNOME applications that upload files over HTTP/2 to untrusted servers is advised.