CVE-2026-92822: Uncontrolled Recursion in Red Hat Red Hat Enterprise Linux 10

The vulnerability in libmodulemd occurs during the parsing of module metadata where the xmd field is recursively converted into nested GVariant values using YAML mapping and sequence helpers. Due to the lack of recursion-depth or node-count limits, an attacker supplying crafted modulemd YAML with deeply nested xmd content can trigger stack exhaustion or excessive resource consumption, causing a denial of service. This affects Red Hat Enterprise Linux 10. No known exploits are reported in the wild. The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating local attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact.

An attacker with local access can cause a denial of service by supplying crafted module metadata that triggers uncontrolled recursion in libmodulemd, leading to stack exhaustion or excessive resource consumption. There is no impact on confidentiality or integrity, only availability is affected.

The vendor advisory from Red Hat is available but does not explicitly state patch or remediation status in the provided data. Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92822 for current remediation guidance. Until a fix is applied, avoid processing untrusted module metadata inputs that could contain deeply nested xmd content.