Multiple security vulnerabilities were identified and fixed in curl, including authentication bypass due to incorrect connection reuse with Negotiate authentication, token leakage during redirects, proxy connection reuse issues, and use-after-free in SMB connection reuse. These vulnerabilities affect various versions of curl across multiple Linux distributions, including Red Hat Enterprise Linux and SUSE. A security update is available to address these issues.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.13.71. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:65838
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html/release_notes
Security Fix(es):
None
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.13 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.13/html-single/updating_clusters/index#updating-cluster-within-minor.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.57. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:60018
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 8. The update includes fixes for several use-after-free issues, out-of-bounds accesses, and other kernel-level security flaws. These vulnerabilities affect core kernel components such as CPU hotplug handling, network bonding, NFS, RDMA, and IPv6. The advisory recommends updating the kernel packages and rebooting the system to apply the fixes.
CVE-2026-66786 is a critical code injection vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2.16, specifically in the Submariner component. The flaw arises because connection configuration is constructed from unvalidated free-form strings in the Custom Resource Definition (CRD). A malicious cluster can exploit this by injecting newlines and ipsec.conf directives in the CableName, enabling arbitrary configuration injection or command execution via leftupdown hooks. Successful exploitation leads to remote code execution as root on the gateway node.
CVE-2026-84838 is an OS command injection vulnerability in the rpmuncompress utility within Red Hat Hardened Images. A local attacker can exploit this flaw by providing a specially crafted archive filename containing shell metacharacters that are not properly escaped. Exploitation requires user interaction, such as invoking rpmuncompress on the malicious file. Successful exploitation can lead to arbitrary command execution with high impact on confidentiality, integrity, and availability of data accessible to the user. Red Hat has released an update addressing this vulnerability in rpm packages version 6.1.0-1.3.hum1.
CVE-2026-84837 is a command injection vulnerability in the rpm package used by Red Hat Hardened Images. An attacker can exploit this flaw by manipulating the path or filename of a tarball processed by rpmbuild, especially in automated or CI workflows that handle external artifact names. Successful exploitation allows arbitrary command execution with the privileges of the build user, potentially leading to information disclosure or disruption of the build environment. Red Hat has released security updates addressing this issue.
CVE-2026-78409 is a high-severity vulnerability in util-linux versions 2.42 through 2.42.2 affecting the X-mount.subdir option on Linux kernel 6.15 and later. It involves improper link resolution during a detached-tree mount operation, allowing a local unprivileged user with an fstab-authorized X-mount.subdir entry to attach a host path at the intended mountpoint by exploiting intermediate symlink traversal. This can lead to full confidentiality, integrity, and availability compromise. The issue is fixed in util-linux versions 2.41.6 and 2.42.3. Red Hat has released security updates for Red Hat Hardened Images including util-linux 2.42.2-3.4.hum1 which addresses this vulnerability. Until patched, it is recommended to disallow unprivileged /etc/fstab entries specifying X-mount.subdir.
A time-of-check to time-of-use (TOCTOU) race condition vulnerability exists in util-linux as used in Red Hat Hardened Images. The flaw involves restricted bind mounts that take the source path from fstab without pinning it before a privileged mount. This allows a local unprivileged user who can replace the authorized source or a writable ancestor directory to redirect a SUID mount(8) to bind another host directory. If the fstab entry sets ownership or mode options, root may inadvertently change permissions on the redirected inode. A security update addressing this issue is available from Red Hat.
CVE-2026-78408 is a vulnerability in util-linux's nsenter tool, specifically in the --join-cgroup option introduced in version 2.40. The issue arises because nsenter opens the target cgroup.procs file as root and leaves the file descriptor open across namespace and credential changes and execve calls. This allows a program running in an attacker-controlled target to inherit root's ability to move host processes between cgroups. Consequently, after a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. The vulnerability affects util-linux versions 2.40 through 2.42.2 and is fixed in versions 2.41.6 and 2.42.3. Red Hat Hardened Images include this component and have released updates to address the issue.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-570.17.1.el9_6.
Security Fix(es):
* kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check (CVE-2026-23111)
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-6.12.0-211.16.1.el10_2.
Security Fix(es):
* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)
* kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112)
* kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs (CVE-2026-46323)
* kernel: futex: Drop CLONE_THREAD requirement for private default hash alloc (CVE-2026-52973)
* kernel: net/sched: act_api: use RCU with deferred freeing for action lifecycle (CVE-2026-53264)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat Security Advisory addresses multiple important vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 9.6 Extended Update Support. The update fixes security issues including symbolic link size checks in Squashfs, race conditions in Bluetooth SCO connections, use-after-free vulnerabilities in Bluetooth and IPv6 components, and validation errors in cryptographic operations. The advisory also includes various bug fixes and enhancements. A system reboot is required to apply the update.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
* kernel: af_unix: Set gc_in_progress to true in unix_gc() (CVE-2026-53361)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)
* kernel: packet: use consistent hard_header_len in non-ring send paths ()
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
Bug Fix(es) and Enhancement(s):
* [kABI] protect struct alt_instr [rhel-10.0] (JIRA:RHEL-122758)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-53683 is an open redirect vulnerability in Red Hat Enterprise Linux 10. The reset_password.html page uses a 'url' query parameter to redirect users after password reset without validating or allowlisting the target URL. This allows attackers to redirect users to arbitrary external sites, potentially facilitating phishing or other social engineering attacks. The vulnerability has a medium severity with a CVSS score of 4.3. No known exploits are reported in the wild. No patch or remediation details are currently provided by the vendor.
A denial of service vulnerability (CVE-2026-80212) exists in the Ruby resolv gem used in Red Hat Hardened Images and related Ruby 4.0 packages. The vulnerability is caused by uncontrolled memory growth triggered by crafted DNS responses. Red Hat has issued updated RPM packages to address this issue. No known exploits are reported in the wild. The severity is assessed as high due to the potential impact of denial of service.