This update for cockpit fixes the following issues:
- CVE-2025-13465: prototype pollution in the _.unset and _.omit functions can lead to deletion of methods from global
prototypes (bsc#1257324).
A buffer overflow vulnerability exists in the ftype() routine of gawk, part of Red Hat Hardened Images RPMs. This flaw could allow an attacker to crash the program, causing a denial of service, and may potentially lead to arbitrary code execution, although this has not been definitively confirmed. Exploitation requires local user interaction with specially crafted files. Red Hat has issued an update including gawk version 5.4.0-3.1.hum1 to address this issue.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenStack Services on OpenShift 18.0 (openstack-keystone) contains multiple security vulnerabilities that allow unauthorized access and privilege escalation. These include improper validation in EC2 credential creation leading to unauthorized cross-project access, incorrect LDAP user status handling causing unauthorized access, and privilege escalation through EC2 credential creation. Red Hat has released an important security update addressing these issues.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.48. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:37189
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: XFS data corruption using reflink ()
Bug Fix(es) and Enhancement(s):
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A low severity security vulnerability (CVE-2025-68114) was identified in the Capstone disassembly framework used for binary analysis and reversing. The issue involves memory corruption caused by an unchecked vsnprintf return value. Red Hat has released an update for Red Hat Enterprise Linux 9 and related variants to address this vulnerability. The advisory rates the impact as low and provides updated packages to remediate the issue.
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 7.0.0 serves as a replacement for Red Hat JBoss Web Server 6.2.3. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security fix(es):
* tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)
* tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-catalina: Apache Tomcat: Denial of Service due to uncontrolled resource allocation (CVE-2026-41284)
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy (CVE-2026-43514)
* tomcat-catalina: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass (CVE-2026-55956)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653)
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: nbd: defer config unlock in nbd_genl_connect (CVE-2025-68366)
* kernel: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CVE-2025-68724)
* kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
* kernel: netfilter: nf_tables: release flowtable after rcu grace period on error (CVE-2026-23392)
* kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455)
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: net: sched: act_csum: validate nested VLAN headers (CVE-2026-31684)
* kernel: netfilter: ip6t_eui64: reject invalid MAC header for all packets (CVE-2026-31685)
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
* kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CVE-2026-43051)
* kernel: smb: client: validate the whole DACL before rewriting it in cifsacl (CVE-2026-31709)
* kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect() (CVE-2026-43023)
* kernel: wifi: brcmfmac: validate bsscfg indices in IF events (CVE-2026-43110)
* kernel: netfilter: xt_tcpmss: check remaining length before reading optlen (CVE-2026-43190)
* kernel: xfs: fix freemap adjustments when adding xattrs to leaf blocks (CVE-2026-43158)
* kernel: mm/page_alloc: clear page->private in free_pages_prepare() (CVE-2026-43303)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CVE-2025-71066)
* kernel: iommu: disable SVA when CONFIG_X86 is set (CVE-2025-71089)
* kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411)
* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CVE-2026-46113)
* kernel: Linux kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite (CVE-2026-53266)
* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the binaries for OpenEXR.
Security Fix(es):
* OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142)
* OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in the SQLite Session Extension allows denial of service via a NULL pointer dereference when processing malformed changesets. This affects applications using SQLite with the Session Extension enabled that handle untrusted changesets, potentially causing application crashes and service unavailability. Red Hat has issued an update for Red Hat Hardened Images RPMs including SQLite packages to address this flaw.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages for Red Hat Enterprise Linux 9. These include memory leaks, null pointer dereferences, and incorrect handling of kernel structures. The update addresses five CVEs related to networking, real-time mutex handling, bridge networking, cryptographic operations, and futex requeue operations. A reboot is required after applying the update. The vendor rates the update as important and provides detailed advisories for remediation.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: nvmet-tcp: fix race between ICReq handling and queue teardown (CVE-2026-46135)
* kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
* kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CVE-2026-46316)
* kernel: KVM: x86: Fix shadow paging use-after-free due to unexpected role (CVE-2026-53359)
Bug Fix(es) and Enhancement(s):
* Possible THP Stalls on Multi-NUMA Systems for HANA on RHEL [rhel-9.6.z] (JIRA:RHEL-164774)
* crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-9.6.z] (JIRA:RHEL-182539)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in Vim (Vi IMproved) affecting Red Hat Enterprise Linux 9. These include command injection when decompressing .tgz archives and arbitrary code execution via crafted directory names, Python omni-completion, and crafted step-definition patterns. Red Hat has issued an important security advisory with updates to address these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: md/bitmap: fix GPF in write_page caused by resize race (CVE-2026-43163)
* kernel: rtmutex: Use waiter::task instead of current in remove_waiter() (CVE-2026-43499)
* kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CVE-2026-53166)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.