CVE-2026-97026 is a vulnerability in Red Hat Enterprise Linux 10 where Flatpak creates temporary child repository directories with insecure world-writable permissions (0777). This can allow other local users on multi-user systems to read or modify these temporary directories during application or runtime installation. Although tampered content will fail signature or digest verification, this may cause installation failures leading to denial of service. The vulnerability has a low severity rating with a CVSS score of 3.9.
CVE-2026-97025 is a vulnerability in Red Hat Enterprise Linux 10 where Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory. This misconfiguration allows other local users on a multi-user system to read the token and impersonate the authenticated user against the OCI repository. Only OCI-based sources are affected; libostree-based sources such as Flathub are not impacted.
Multiple security vulnerabilities and bugs have been identified and fixed in the Linux kernel packages distributed by Red Hat. These include issues in KVM virtualization, ext4 filesystem, ARM64 architecture, perf subsystem, crypto drivers, and others. The vulnerabilities range from use-after-free, bitmap inconsistencies, privilege escalation risks, to denial of service conditions. Red Hat has released patches addressing these issues in specific kernel versions.
Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.
Security Fix(es):
* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
CVE-2026-97023 is a path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment on Red Hat Enterprise Linux 10. A malicious Flatpak app can exploit this flaw to delete files outside the deployment directory, potentially causing system-wide file deletion when installed or upgraded. The deletion occurs with root privileges in system-wide installations. The vulnerability has a CVSS score of 7.1, indicating high severity.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-284.134.1.el9_2.
Security Fix(es):
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-4.18.0-477.130.1.el8_8.
Security Fix(es):
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-87114 is a high-severity vulnerability in the kube-compare tool used by Red Hat OpenShift Container Platform 4.20. The flaw causes the tool to execute the entrypoint of an untrusted container image when processing a 'container://' reference path, rather than only extracting data from a stopped container. This behavior can lead to arbitrary code execution on the operator's workstation. If the Docker daemon is running with elevated privileges, an attacker could gain root-level access via the daemon. Red Hat has issued a security advisory and released updates in OpenShift Container Platform 4.20.41 to address this issue.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the buildah package to version 1.45.1-1.hum1 for aarch64 and x86_64 architectures. The update addresses security issues identified by CVE-2026-56851 and CVE-2026-63209. This advisory provides a bug fix and enhancement update for the affected RPMs.
CVE-2026-101333 is a medium severity vulnerability in the Micrometer user-event metrics listener of Red Hat Build of Keycloak. When configured to include the idp tag, an unauthenticated attacker can send requests with arbitrary provider aliases to the identity broker login endpoint, causing the creation of unlimited metric time series. This can lead to excessive memory consumption and degrade server and monitoring tool performance.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities in the grafana13.2 package, including CVE-2026-63209. The update includes version 13.2.1-0.8.hum1 for aarch64 and x86_64 architectures. No explicit patch or fix details are provided in the advisory. The vulnerabilities are considered high severity.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple glibc packages. The advisory addresses vulnerabilities identified by CWE-367 and CWE-120. The update includes numerous language pack RPMs and core glibc components for aarch64 and x86_64 architectures. No specific exploitation details or active exploits in the wild have been reported. The advisory provides updated RPM versions to mitigate the vulnerabilities.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: fbcon: Set fb_display[i]->mode to NULL when the mode is released (CVE-2025-40323)
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (CVE-2026-46230)
* kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CVE-2026-46204)
* kernel: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (CVE-2026-46199)
* kernel: arm64: tlb: Flush walk cache when unsharing PMD tables (CVE-2026-63875)
* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
* kernel: Linux kernel: libceph stack out-of-bounds write via crafted OSDMap (CVE-2026-68159)
* kernel: libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CVE-2026-68156)
* kernel: Linux kernel (libceph): Denial of Service due to malformed monitor maps (CVE-2026-68155)
* kernel: drm/amdgpu: Fix context pstate override handling (CVE-2026-68273)
* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security update for Red Hat Hardened Images RPMs addressing two high severity vulnerabilities (CVE-2026-61709 and CVE-2026-86472) in the grafana13.1 package. The update provides new RPM versions for aarch64 and x86_64 architectures. A patch is available and should be applied to affected systems to mitigate these vulnerabilities.
A high severity security vulnerability identified as CVE-2026-9496 affects the grafana12.4 package within Red Hat Hardened Images RPMs. Red Hat has released updated RPM packages for aarch64 and x86_64 architectures to address this issue. No detailed technical information or CVSS score is provided in the advisory. The update is available and should be applied to remediate the vulnerability.
CVE-2026-101292 is an unsafe reflection vulnerability in Apache ActiveMQ Artemis before version 2.34.0, affecting Red Hat JBoss Enterprise Application Platform 7.4.25. The vulnerability arises from the method FederationStreamConnectMessage.getFederationPolicy() invoking Class.forName() on unvalidated input from an authenticated federation peer, allowing arbitrary class loading. This can lead to denial of service conditions such as system-property poisoning, out-of-memory errors, or broker state manipulation.
CVE-2026-86330 is an OS command injection vulnerability in the set_hostname_internal function of NooBaa's cluster_internal_api component within Red Hat OpenShift Data Foundation 4. The flaw arises because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can exploit this to execute arbitrary commands on the host system with the privileges of the NooBaa process. The vulnerability has a high severity rating with a CVSS score of 7.2.