Security update for patch

The GNU patch utility contains two vulnerabilities: CVE-2026-56288 allows an attacker to cause a NULL pointer dereference by providing a specially crafted patch file, resulting in a crash and denial of service. This occurs due to improper handling of end-of-file markers corrupting internal data structures. CVE-2026-56289 involves improper validation of hunk line offsets, which can also lead to denial of service. These vulnerabilities affect specific versions of the patch RPMs distributed by Red Hat Hardened Images and SUSE. Red Hat has released updated RPM packages (patch-2.8-4.3.hum1) for affected architectures including aarch64 and x86_64. The vendor advisory confirms the availability of fixes and provides instructions for applying the update.

Successful exploitation of these vulnerabilities results in denial of service by crashing the patch utility process. There is no indication of confidentiality or integrity impact. The denial of service can disrupt patching operations or other automated processes relying on the patch utility.

A security update is available from Red Hat and SUSE that fixes these vulnerabilities. Users should apply the updated patch RPMs (e.g., patch-2.8-4.3.hum1) as provided by their vendor. No additional mitigations are indicated or required beyond applying the official fix.