A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).
CVE-2026-107935 is a critical path traversal vulnerability in gvproxy, part of the gvisor-tap-vsock package used by Red Hat Build of Podman Desktop. The vulnerability exists in the unauthenticated /services/forwarder/expose endpoint, which fails to validate the caller-supplied socket path. This flaw allows an attacker to delete arbitrary files on the host system. The issue affects versions from 0.4.0 up to but not including 0.9.0. The vulnerability has a CVSS 3.1 score of 9.3, indicating high impact on integrity and availability without requiring privileges or user interaction.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Linux kernel: xfrm single-frag length not properly limited ()
* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
* kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-107655 is a vulnerability in the CUPS printing system used in Red Hat Hardened Images. It involves a null pointer dereference triggered by processing embedded job ticket comments with specific IPP attributes. An unauthenticated attacker able to submit print jobs can cause the print daemon to crash, resulting in a temporary denial of service for printing services. A security update addressing this issue is available from Red Hat.
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel, including CVE-2026-72129 and CVE-2026-74705. These issues involve improper handling of inline data with a nonzero offset in the nvmet-rdma subsystem and a potential use-after-free vulnerability in UDP tunnel segmentation. The vulnerabilities could allow local attackers to bypass memory protections or escalate privileges. A patch is available to remediate these issues.
CVE-2026-107889 is a medium severity cross-site scripting (XSS) vulnerability in the login theme rendering component of Red Hat Build of Keycloak. The issue allows a realm administrator to bypass the input sanitization filter and store malicious scripts in display fields. These scripts can execute in the browsers of users visiting the login page, potentially exposing data or interfering with user sessions.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including updates to golang1.27 packages. The update addresses bugs and enhancements related to CVE-2026-94444 and CVE-2026-94447. No specific details about the vulnerabilities or their impact are provided in the advisory. The update is available for multiple architectures including aarch64 and x86_64.
Red Hat has released a security and bug fix update for Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.11.5. This update addresses multiple security vulnerabilities identified by CVE-2026-84304 and CVE-2026-84445. Users of earlier RHACS versions are advised to upgrade to 4.11.5 to benefit from these security patches and bug fixes. The update also fixes an issue related to view-based report creation permissions. The advisory references release notes for detailed information on fixes and enhancements.
CVE-2026-107651 is a heap-based buffer overflow vulnerability in the Eye of GNOME (eog) PNG metadata reader on Red Hat Enterprise Linux 6. It arises from improper state handling when parsing split metadata chunks in PNG files. A remote attacker could exploit this by tricking a user into opening a maliciously crafted PNG file, potentially causing a denial of service through application crash or arbitrary code execution. The vulnerability has a medium severity with a CVSS score of 5.5. No specific affected versions or patch information is provided in the available data.
A flaw was found in ansible-core. When installing a collection with
`ansible-galaxy collection install`, the archive extractor validates member
paths using lexical path normalisation (os.path.abspath) instead of resolving
symbolic links (os.path.realpath), and it performs no containment check on
symlink-typed directory members before creating them. A crafted collection
tarball can chain symlink directory entries so that a subsequent file member is
written outside the intended destination directory. This allows an attacker who
can get a victim to install a malicious collection to overwrite arbitrary files
with the privileges of the user running ansible-galaxy, leading to code
execution on the control node. This is a bypass of the fix for CVE-2020-10691.
Multiple security vulnerabilities identified by CWE-1341 and CWE-120 were fixed in the glibc-2.44-1.1 package for openSUSE Tumbleweed and related Red Hat packages. These updates address flaws in the GNU C Library (glibc) to improve security. No known exploits have been reported in the wild. The severity of these issues is assessed as medium. Updated packages are available from SUSE and Red Hat, including language packs and hardened images RPMs.
Red Hat Enterprise Linux AI Inference Server Model Optimization Tools 3.3.6 update addresses multiple security vulnerabilities including improper input validation and memory handling errors. The update provides enhanced container images to mitigate these issues. The vulnerabilities are classified as important and affect several CVEs. No active exploits are known in the wild at this time. A patch is available to remediate these vulnerabilities.
GitPython versions prior to 3.27.0 and certain other version ranges contain a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default. This allows an attacker controlling input to specify an arbitrary path for the Git metadata directory outside the intended clone destination, potentially leading to arbitrary directory and file creation limited by filesystem permissions. The vulnerability is due to an omission in the denylist of unsafe_git_clone_options. A patch is available for affected versions.
CVE-2026-84292 is a vulnerability in the node-ajv package where the fast-uri component serializes the port part of a URI without validating it. This issue is part of a set of vulnerabilities addressed in a Red Hat Hardened Images RPM security update affecting multiple Red Hat products. The vulnerability has a CVSS score of 7.5 (medium severity) and impacts integrity without affecting confidentiality or availability. A patch is available from Red Hat as part of their security advisory RHSA-2026:63782.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
* kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
* kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
* kernel: gfs2: add some missing log locking (CVE-2026-53049)
* kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
* kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
* kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
* kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
* kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
* kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
* kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
* kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
* kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
* kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
* kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
Bug Fix(es) and Enhancement(s):
* [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z] (JIRA:RHEL-254192)
* hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z] (JIRA:RHEL-262029)
* RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892)
* Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including the opentelemetry-collector-k8s package version 0.161.0-0.1.hum1. This update addresses multiple vulnerabilities including CVE-2026-63209. The advisory does not provide detailed information on the nature of the vulnerabilities or specific fixes. No known exploits are reported in the wild. The update is available for aarch64 and x86_64 architectures.
A security update for PostgreSQL 12 addresses a vulnerability (CVE-2026-18408) that allows arbitrary code execution via untrusted data inclusion in the pg_dump utility. This vulnerability affects Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life versions. The issue is rated as important by Red Hat Product Security. A security fix is available and should be applied to affected systems to mitigate the risk.
Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.
A flaw was found in the OIDC Dynamic Client Registration (DCR) component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the setting to be silently disabled. As a result, offline tokens may remain valid even after a user session is terminated via backchannel logout.
A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm administrator with only the read-only view-clients role can access the active primary secret of any confidential client, which should normally be restricted. This exposed secret can be used to impersonate the client and gain unauthorized access to its associated service account permissions.