A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection, new metadata entries can be written beyond available free space or over existing records. This issue can corrupt stored encrypted payload data or existing metadata, potentially rendering the affected data inaccessible.
CVE-2026-93017 is a privilege management vulnerability in Red Hat OpenShift Container Platform 4.14. The insights-operator-gather ClusterRole grants its service account unrestricted read access to all secrets across all namespaces. An attacker with the ability to spawn a pod using this service account can access any secret in the cluster.
Multiple security vulnerabilities have been identified and fixed in the 389 Directory Server (389-ds-base) used in Red Hat Enterprise Linux 9.2 and related distributions. The issues include a pre-authentication LDAP filter injection, a NULL pointer dereference in the BER parser, and a pre-authentication stack buffer overflow via unbounded replica ID parsing. These vulnerabilities have been addressed by Red Hat in updated packages.
The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
Security Fix(es):
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
Bug Fix(es) and Enhancement(s):
* gfs2: Remote delete issues [rhel-9.6.z] (JIRA:RHEL-172430)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuous integration (CI) system to process a crafted build manifest. By specifying local file Uniform Resource Identifiers (URIs) within source download definitions, the builder bypasses directory confinement checks. As a result, sensitive host files accessible to the build process can be read and incorporated into the build artifacts.
This security update provides a functional equivalent of RHSA-2026:45114.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:45114.
CVE-2026-107445 is a medium severity vulnerability in Red Hat Hardened Images affecting the Katello component. It involves improper authorization enforcement in the Flatpak Remote Repositories API, allowing an authenticated user with permission to view flatpak remotes in one organization to access repository information of another organization. This flaw also affects the mirror action, potentially enabling repository creation with another organization's remote URL and stored credentials.
CVE-2026-107444 is an authorization bypass vulnerability in Red Hat Hardened Images related to the Katello Docker Tags repositories API. An authenticated user with permission to view products in one organization can retrieve repository metadata of Docker tags from another organization by supplying the tag identifier. This leads to unauthorized disclosure of repository configuration information across organization boundaries. The vulnerability has a CVSS score of 4.3 (medium severity).
CVE-2026-107176 is a vulnerability in Red Hat OpenShift Container Platform 4's cluster-samples-operator. The RBAC role coreos-pull-secret-reader in the openshift-config namespace grants broad permissions on all Secret resources without limiting access to specific resource names. This over-permission allows an attacker who compromises the samples-operator pod or its service account token to read all secrets in the namespace, including sensitive credentials.
CVE-2026-107161 is a heap-based buffer overflow vulnerability in the Cyrus SASL DIGEST-MD5 plugin on Red Hat Enterprise Linux 10. The flaw occurs because the add_to_challenge() function miscalculates buffer size when quoting special characters, leading to an out-of-bounds write. This can be triggered by a malicious or on-path DIGEST-MD5 or HTTP Digest server sending a crafted challenge, potentially causing client application crashes.
A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size
CVE-2026-106066 is a heap-based buffer overflow vulnerability in the GIMP raw data export plug-in on Red Hat Enterprise Linux 10. The issue arises when exporting very large images, where an integer overflow in memory allocation causes insufficient memory to be allocated, leading to out-of-bounds reads or writes during export. This can result in integrity and availability impacts.
A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.
CVE-2026-107169 is a vulnerability in the m17n-lib component of Red Hat Enterprise Linux 10. It involves a null pointer dereference triggered by specially crafted or truncated UTF-8 input during text processing. This flaw causes the affected application to crash unexpectedly, resulting in a denial of service (DoS). The vulnerability has a medium severity rating with a CVSS score of 6.2. No affected versions or patch information are explicitly provided in the available data.
A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.