This security update provides a functional equivalent of RHSA-2026:33577.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:33577.
Red Hat® Enterprise Linux® AI is a foundation model platform to seamlessly develop, test, and run Granite family large language models (LLMs) for enterprise applications.
This update provides the latest Red Hat Enterprise Linux AI 3.4.1 container images.
For a full list of changes in this release, see the Red Hat Enterprise Linux AI Release Notes linked in the References section.
A denial of service vulnerability (CVE-2026-8723) exists in the qs library used by Red Hat Hardened Images RPMs. The vulnerability occurs when qs.stringify processes arrays containing null or undefined elements with specific configurations, causing a TypeError that crashes the application or returns a 500 error. Red Hat has released updated RPM packages including python3.14-3.14.6-1.1.hum1 to address this issue. No other mitigations besides applying the update are recommended.
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
* postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
* postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Redis is an in-memory data structure store. In all versions of redis-server with Lua scripting, an authenticated attacker can exploit the master-replica synchronization mechanism to trigger a use-after-free on replicas where replica-read-only is disabled or can be disabled, which may lead to remote code execution. A workaround is to prevent users from executing Lua scripts or avoid using replicas where replica-read-only is disabled. This is patched in version 8.6.3.
A security update for the Linux kernel in Red Hat Enterprise Linux 9 addresses multiple vulnerabilities including a crash caused by an unvalidated VCC pointer in the ATM network code (CVE-2026-31411) and a cryptographic IV copying issue (CVE-2026-53016). The update also includes bug fixes and enhancements. The kernel is a critical component of the operating system, and these fixes prevent potential crashes and improve cryptographic operations.
The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.
Security Fix(es):
* libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS (CVE-2024-12133)
* gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification (CVE-2025-14831)
* gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833)
* gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845)
* gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846)
* gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009)
* gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010)
* gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011)
* gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs (CVE-2026-42012)
* gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013)
* gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260)
* gnutls: Fix use-after-free in gnutls_pkcs11_token_set_pin (CVE-2026-42014)
* gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling (CVE-2026-42015)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-42501 is a vulnerability in the Go command (cmd/go) used in Red Hat Hardened Images RPMs. It allows a malicious module proxy to bypass checksum validation, potentially leading to execution of untrusted Go toolchains if a user interacts with a compromised proxy. Red Hat has released updated golang-fips1.25 RPMs to address this issue. Users are advised to revalidate module dependencies by regenerating the go.sum file to mitigate risk.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488)
* kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038)
* kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329)
* kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090)
* kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)
* kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)
Bug Fix(es) and Enhancement(s):
* [RHEL-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:RHEL-169057)
* iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.8.z] (JIRA:RHEL-172993)
* nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [rhel-9.8.z] (JIRA:RHEL-178273)
* sched/fair: Skip sched_balance_running cmpxchg when balance is not due [rhel-9.8.z] (JIRA:RHEL-182776)
* [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [rhel-9.8.z] (JIRA:RHEL-183183)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This advisory addresses two security vulnerabilities in the Perl 5.32 packages used in Red Hat Enterprise Linux 8. The first vulnerability (CVE-2026-42496) involves a path traversal issue in perl-archive-tar that allows arbitrary file access via crafted symlinks. The second vulnerability (CVE-2026-48962) affects perl-IO-Compress and allows arbitrary code execution through an attacker-controlled output glob. Red Hat has released an important security update to fix these issues in the affected Perl packages.