CVE-2026-18453 is a high severity vulnerability in 389 Directory Server used by Red Hat Directory Server 11.5 E4S for RHEL 8. It involves a missing NULL pointer check in the paged results handling of the op_shared_search function. An unauthenticated remote attacker can exploit this flaw by sending a crafted sequence of LDAP search requests using the USE_ONE_BACKEND control, causing the server to crash and resulting in a denial of service condition. Red Hat has issued a security advisory with a patch to fix this issue.
CVE-2026-18355 is a heap buffer overflow vulnerability in the SASL I/O layer of 389 Directory Server (389-ds-base) used in Red Hat Directory Server 11.5 E4S for RHEL 8. The flaw arises from an integer underflow caused by insufficient validation of a wrapped-record length, leading to a large memory read into a small heap buffer. A remote authenticated attacker who successfully performs a SASL bind with integrity protection can exploit this to cause denial of service or potentially remote code execution. Red Hat has issued a security advisory with a patch addressing this vulnerability.
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate and read the environment variables of the affected server process and to cause denial of service via memory exhaustion.
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI evaluation (tracked separately), to create an arbitrary attacker-controlled Kerberos principal and have it added to the administrators group. This allows a remote, unauthenticated attacker to obtain genuine FreeIPA administrator-group membership and perform administrative operations against the directory and, on SID-enabled deployments, other IdM services.
CVE-2026-86404 is a high severity vulnerability in Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 involving insecure deserialization. The Artemis messaging component permits deserialization of all classes by default due to empty allow-list and block-list configurations. This allows potentially unsafe objects to be deserialized, leading to high impact on confidentiality, integrity, and availability. A security update is available in Red Hat JBoss Enterprise Application Platform 7.4.25 that addresses this and other vulnerabilities.
A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard user can retrieve the cluster NVIDIA NGC API key Secret (apiKeySecret) and the NIM image pull secret (nimPullSecret). Create and delete of the same NIM credential are admin-gated; the read path is not. This is missing authorization (CWE-862) and insufficiently protected credentials (CWE-522). It is distinct from CVE-2026-5483 (service-account token leak in the Kubernetes client response wrapper on the same route) and CVE-2026-16456 (odh-model-controller cross-namespace confused deputy).
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to multiple libxml2 packages. The advisory addresses several CVEs related to these packages and provides a bug fix and enhancement update for libxml2 version 2.15.4-0.1.hum1 on aarch64 and x86_64 architectures. No specific exploit details or CVSS scores are provided. Users are directed to apply the update as detailed on Red Hat's official site.
A security vulnerability (CVE-2026-80844) affecting the Linux kernel packages in Red Hat Enterprise Linux for ARM 64 10 has been identified. The issue involves improper validation of the routing header segments_left in the xfrm ah6 kernel component. Red Hat has issued a security advisory and released an update to address this vulnerability. The update requires a system reboot to take effect. The vulnerability is rated as high severity by Red Hat Product Security. No CVSS score is provided in the advisory. The affected kernel versions are specific builds of Red Hat Enterprise Linux for ARM 64 10.
CVE-2026-76925 is a medium severity vulnerability in Flatpak on Red Hat Enterprise Linux 10 involving a Time-of-check to time-of-use (TOCTOU) race condition. The flaw exists in the org.freedesktop.Flatpak.SystemHelper component where a privileged chmod operation occurs before OSTree repository validation in the Deploy() function. This timing window allows an attacker to redirect symlinks to arbitrary files, potentially enabling unauthorized file manipulation or information disclosure.
A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual machine's power-on or state/migration restore), a malformed state blob can supply an oversized skip-block length that is not validated against the remaining size of the input buffer. This can drive an internal size counter negative, which bypasses a subsequent bounds check due to an unsafe signed-to-unsigned conversion, causing the parser to read memory outside the bounds of the heap buffer holding the state data. Successful exploitation can crash the process hosting libtpms (such as swtpm), resulting in a denial of service of the emulated TPM device and the virtual machine that depends on it. No data corruption or information disclosure was confirmed.
A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data than the current flow-control window later allows. A malicious HTTP/2 server can shrink SETTINGS_INITIAL_WINDOW_SIZE while that buffered read is still in progress. The client then copies the full buffer into a smaller DATA callback without a runtime bounds check, which can abort the process or fail the HTTP/2 session.
CVE-2026-81666 is an integer overflow vulnerability in Corosync's handling of membership commit token messages on 32-bit Red Hat Enterprise Linux 10 systems. This flaw allows bypassing length-validation checks, leading to out-of-bounds memory access and crashing the Corosync daemon, causing denial of service on the affected cluster node. The issue does not affect 64-bit systems due to correct 64-bit arithmetic handling.
CVE-2026-81665 is a heap-based buffer overflow vulnerability in the Corosync Totem Process Group message reassembly component on Red Hat Enterprise Linux 10. It occurs when processing fragmented multicast messages due to missing runtime bounds checks in release builds. An attacker with network-adjacent access to send crafted multicast protocol messages could trigger this overflow, potentially crashing the Corosync daemon and causing denial of service to the cluster. Further exploitation may be possible if the attacker can control heap corruption. Red Hat has issued a security update to address this vulnerability.
A security vulnerability identified as CVE-2026-74582 affects the Linux kernel packages in Red Hat Enterprise Linux 8.8 and related update services. The issue involves inconsistent handling of the hard_header_len parameter in non-ring send paths within the kernel's packet subsystem. Red Hat has issued a security advisory and released updated kernel packages to address this vulnerability. The update requires a system reboot to take effect. No CVSS score is provided, but the severity is rated as high by Red Hat. There are no known exploits in the wild at this time.
A flaw was found in libsoup. A malicious HTTP/2 server or a Man-in-the-Middle (MITM) attacker can exploit a heap use-after-free vulnerability in the HTTP/2 client implementation. This occurs when a GNOME application uploads a file using HTTP/2, and the server sends a GOAWAY frame while the file body is being read asynchronously. This can lead to memory corruption, potentially resulting in information disclosure or arbitrary code execution.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CVE-2026-53073)
* kernel: exfat: fix potential use-after-free in exfat_find_dir_entry() (CVE-2026-63808)
* kernel: KEYS: fix overflow in keyctl_pkey_params_get_2() (CVE-2026-63824)
* kernel: smb: client: fix query directory replay double-free (CVE-2026-64387)
* kernel: iomap: fix out-of-bounds bitmap_set() with zero-length range (CVE-2026-68145)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.