CVE-2026-109833 is a stack-based buffer overflow vulnerability in the gnome-remote-desktop component of Red Hat Enterprise Linux 10. The flaw occurs in the VNC TLS read path where partial consumption of the internal peek buffer mishandles remaining bytes, causing an out-of-bounds write. This can be triggered remotely by an attacker who can access an enabled VNC TLS listener, potentially leading to denial of service. The vulnerability has a medium severity rating with a CVSS score of 5.9.
CVE-2026-109832 is a denial of service vulnerability in the gnome-remote-desktop component of Red Hat Enterprise Linux 10. It arises from an infinite loop in the VNC TLS I/O handlers where retryable GnuTLS results cause a busy loop without yielding to the event loop. A remote attacker able to connect to an enabled VNC TLS listener can trigger high CPU usage, causing the event-loop thread to spin without progress and resulting in denial of service.
CVE-2026-109854 is a low-severity vulnerability in the m17n-lib component of Red Hat Enterprise Linux 10. It involves the use of an uninitialized variable when processing ISO-2022 encoded text, which may lead to limited information disclosure if the decoded output is exposed by the application.
This Red Hat security advisory addresses a high-severity vulnerability identified as CVE-2026-16365 affecting Thunderbird. The advisory provides a functional equivalent update to a previous Red Hat advisory (RHSA-2026:73971). The vulnerability involves multiple weaknesses related to authorization and memory safety as indicated by associated CWEs. Affected versions include various Thunderbird and Firefox packages on Red Hat Enterprise Linux and SUSE Linux Enterprise distributions. No CVSS score is provided for this vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
* kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-687.10.1.el9_8.
Security Fix(es):
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
* kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
* kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
Bug Fix(es) and Enhancement(s):
* net/tls backports for 10.2 (JIRA:RHEL-275027)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-83535 is a vulnerability in Red Hat OpenStack Platform 18.0's openstack-network-exporter component. It occurs when user authentication is configured but TLS is omitted or misconfigured, causing the basic authentication to be silently bypassed. This allows an adjacent network attacker to access sensitive Open vSwitch and Open Virtual Network dataplane metrics without credentials, leading to information disclosure including bridge names, port counters, OVN controller state, and host topology.
CVE-2026-83536 is a medium severity vulnerability in Red Hat OpenStack Platform 18.0 affecting the openstack-network-exporter component. The HTTP server lacks essential timeout settings like ReadHeaderTimeout, allowing unauthenticated remote attackers to open multiple slow HTTP header connections. This can exhaust server resources such as file descriptors, causing a Denial of Service (DoS) that disrupts Prometheus metric scraping and alerting.
CVE-2026-85471 is a Server-Side Request Forgery (SSRF) vulnerability in the Quay component of the Red Hat mirror registry for Red Hat OpenShift. An authenticated repository administrator can bypass the hostname blacklist in webhook notifications, causing the application to send unauthorized requests to internal network resources. This may lead to disclosure of sensitive information from internal services such as cloud metadata or cluster services. The vulnerability has a CVSS score of 6.4, indicating medium severity.
CVE-2026-87744 is a critical vulnerability in the Red Hat build of Quarkus 3.27.6.redhat affecting the REST Data Panache component. It allows unauthenticated attackers to bypass security controls on generated endpoints when developers customize operations using @MethodProperties without re-declaring security roles. This causes the code generator to drop class-level security requirements, resulting in endpoints defaulting to permissive, unauthenticated access. This can lead to unauthorized information disclosure or data modification.
This security update for glibc addresses multiple vulnerabilities including invalid free, stack overflow, buffer overflows, out-of-bounds writes, assertion failures, and a race condition that could allow local privilege escalation. The update fixes issues in components such as wordexp, resolv_conf, fopen ccs extension, strfmon, tdelete, and character decoding routines. The vulnerabilities affect local and network contexts and can lead to process crashes or privilege escalation. The update is provided by SUSE and Red Hat for various glibc packages across architectures.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
Bug Fix(es) and Enhancement(s):
* kernel: vhost: reset the vring metadata cache on vring reconfiguration [rhel-7.9.z] (JIRA:RHEL-224557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.
CVE-2026-94451 is a vulnerability in Red Hat build of Quarkus 3.27.6.redhat affecting the REST Data Panache module. It involves improper input validation of the sort parameter in certain REST endpoints, which could allow attackers to gain unauthorized information or cause denial of service by forcing complex database operations. A security update addressing this issue is available in the Red Hat build of Quarkus 3.27.6 release.
A vulnerability in Flatpak before version 1.18.1 allows a malicious sandboxed application to gain arbitrary read and write access to host files. This occurs due to missing symlink protection in app data directories created within the sandbox, which can be exploited to redirect directory mounts to arbitrary host locations. This flaw can potentially lead to arbitrary code execution on the host system.
CVE-2026-109195 is an authorization bypass vulnerability in Red Hat Quay 3. An authenticated attacker can access repository auto-prune configurations from other namespaces due to improper enforcement of namespace scoping when retrieving policy details by repository name and policy identifier. Exploitation requires the attacker to manage a repository with the same name as the target and know the target policy's unique identifier. The vulnerability leads to unauthorized information disclosure but does not affect integrity or availability.
CVE-2026-109194 is an authorization bypass vulnerability in Red Hat Quay 3's build trigger management API. The API does not verify if a requested build trigger belongs to the specified repository, allowing an authenticated user with administrative access to any repository to access or modify build triggers and write tokens of other repositories if they know the trigger's UUID.