A flaw was found in gdk-pixbuf. This vulnerability allows a remote attacker to cause a heap out-of-bounds read by providing a specially crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS icon data, fails to validate the source buffer's boundaries during decompression. This can lead to a denial of service, where the application crashes, or to information disclosure, potentially revealing sensitive data from adjacent memory.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.2 package to version 13.2.1-0.2.hum1. This update addresses security vulnerabilities identified by CVE-2026-84394 and CVE-2026-84292. The advisory provides updated RPM packages for aarch64 and x86_64 architectures. No explicit patch status is stated beyond the availability of updated packages.
Red Hat has released a security update for Red Hat Hardened Images RPMs, specifically addressing multiple vulnerabilities in python3.13 packages. The update includes fixes for CVE-2026-15310, CVE-2026-15806, CVE-2026-19672, and CVE-2026-17084. The affected packages cover various python3.13 components for aarch64 and x86_64 architectures. The update is available and should be applied to mitigate the identified security issues.
A command injection vulnerability (CVE-2026-19843) exists in the 389-ds-base component of Red Hat Directory Server 12.6 EUS and 12.8 for RHEL 9. The issue arises from improper input handling of an unescaped LDAP Distinguished Name (DN) in the Cockpit 389 Console LDAP editor, allowing arbitrary command injection. Red Hat has released security updates to address this vulnerability.
Red Hat OpenShift Container Platform 4.20.37 includes multiple security fixes addressing vulnerabilities in components such as libreswan, sg3_utils, and libarchive. These vulnerabilities include denial of service via malformed packets and assertion failures, arbitrary command execution via udev property injection, and a double-free vulnerability in decompression logic. The update mitigates these issues by providing patched container images and RPM packages. Users of OpenShift Container Platform 4.20 and 4.21 are advised to upgrade to the fixed versions to address these security concerns.
A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace and uses it to mint client certificates with a Subject Common Name (CN) supplied by the author of a namespaced Hawtio custom resource. Because the operator ships a ClusterRole that aggregates Hawtio CR permissions into the edit and admin roles, any user with edit access in any namespace can obtain a Service-CA-signed certificate with an arbitrary subject. This certificate can be used to impersonate any in-cluster service identity to peers that trust the Service CA for client authentication, including Jolokia agents and other Service-CA-trusting components.
A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. While the operator uses a controller-runtime label-selector cache as a memory optimization, the ServiceAccount token authorizes read access to every Secret in the cluster. The operator also bypasses the cache via direct API calls. Compromise of the operator pod would yield read access to every Secret in the cluster, including bootstrap tokens, cloud credentials, and other operators' secrets.
CVE-2026-74860 is a vulnerability in libxml2 with Python bindings enabled on Red Hat Enterprise Linux 10. It involves a double-free error triggered by a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This flaw can cause a denial of service (DoS) due to a crash in Python applications using libxml2 SAX bindings. A security update addressing this issue is available from Red Hat.
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes.
Breaking changes:
* High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169.
Deprecations:
* Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509.
Technology Preview features:
* None
Enhancements:
* High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168.
* Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485.
Bug fixes:
* TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453.
* Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435.
* Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646.
Known issues:
* None
CVE-2026-74859 is a path traversal vulnerability in the GNOME Shell theme installer component of gnome-tweaks on Red Hat Enterprise Linux 8. The flaw allows crafted theme archives to write files outside the intended ~/.themes directory by exploiting improper validation of archive member paths. Exploitation requires a user to deliberately install a malicious theme, limiting the attack surface. The vulnerability has a CVSS score of 6.8 and is rated moderate in severity by Red Hat.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)
* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)
* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)
* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)
* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)
* kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)
* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)
* kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)
* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)
* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)
* kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
* kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (CVE-2026-64265)
* kernel: nvmet-auth: validate reply message payload bounds against transfer length (CVE-2026-64319)
* kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CVE-2026-64287)
* kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
* kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
Bug Fix(es) and Enhancement(s):
* Customer needs "netfilter: nfnetlink_queue: optimize verdict lookup with hash table" patch [RHEL 10.2] (JIRA:RHEL-132852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A high severity security advisory from Red Hat addresses vulnerabilities in Red Hat Hardened Images RPMs, specifically affecting the jaeger package version 2.20.0-0.6.hum1 for aarch64 and x86_64 architectures. The advisory relates to CVE-2026-67213 and includes fixes that should be applied to mitigate the vulnerabilities. The update is available and covers components of the Red Hat Ansible Automation Platform.
Red Hat OpenShift Data Foundation 4.22.3 includes a security update addressing multiple issues including CVE-2026-16221 and other vulnerabilities. The update fixes bugs related to database dump capturing, upgrade processes, application validation, resource status reporting, and operator failures. The advisory indicates a high severity level and confirms that a patch is available for affected versions.
CVE-2026-76561 is a high-severity vulnerability in Dogtag PKI, part of FreeIPA's certificate authority component in Red Hat Enterprise Linux 10. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID, allowing an authenticated user with CA Administrator privileges to execute arbitrary commands via the ExternalProcessConstraint mechanism. This results in code execution as the pkiuser account. A security update is available to address this issue.
A high severity vulnerability (CVE-2026-69248) exists in the python3.14-cryptography package for Red Hat Enterprise Linux 9. The issue allows the verifier to accept wildcard DNS names that can escape from permittedSubtrees. Red Hat has released patches to address this vulnerability in updated packages.
A critical security vulnerability (CVE-2026-18922) affects the 389 Directory Server (389-ds-base) used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The flaw involves SASL PLAIN authentication allowing privilege escalation to the Directory Manager via a stale identity in the Cyrus SASL auxiliary property. This vulnerability is part of a security update that also addresses other issues in 389-ds-base. Red Hat has released a security advisory and updated packages to fix these vulnerabilities.
Multiple critical security vulnerabilities have been identified and fixed in the 389 Directory Server (389-ds-base) package for Red Hat Enterprise Linux 9.4. These include a heap buffer overflow, a pre-authentication NULL pointer dereference, privilege escalation via SASL PLAIN authentication, and bypass of bind-rule checks by anonymous LDAP clients. The update addresses these issues and includes additional bug fixes and enhancements.