The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects.
Security Fix(es):
* attr: Symlink Traversal Privilege Escalation via getfattr and setfattr (CVE-2026-54371)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A use-after-free vulnerability in the rtpsbcdepay plugin of the gstreamer1-plugins-good package for Red Hat Enterprise Linux 10 allows remote code execution. This security flaw is addressed by an update provided by Red Hat. The vulnerability is rated as having high severity by Red Hat Product Security. The issue affects multiple architectures and variants of Red Hat Enterprise Linux 10. Users are advised to apply the official security update to remediate the vulnerability.
Multiple security vulnerabilities in the Linux kernel were addressed in a Red Hat security advisory. The fixes cover a range of kernel subsystems including memory management, networking, input devices, and netfilter components. These vulnerabilities include use-after-free, out-of-bounds read, race conditions, and improper handling of network packets. The advisory also includes various bug fixes and enhancements. A patch is available to remediate these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)
* kernel: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (CVE-2026-63913)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: netfilter: ipset: fix race between dump and ip_set_list resize (CVE-2026-64189)
* kernel: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CVE-2026-64320)
* kernel: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CVE-2026-64277)
* kernel: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CVE-2026-64276)
Bug Fix(es) and Enhancement(s):
* ss core dumped when there is an SCTP session [rhel-8.10.z] (JIRA:RHEL-212400)
* SELinux TCP/MPTCP connect check bypass via TCP Fast Open [rhel-8.10.z] (JIRA:RHEL-222800)
* [RHEL-RT] usb_hub_wq items may run on isolated+nohz_full cores (JIRA:RHEL-178088)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-79654 is an authorization bypass vulnerability in Red Hat Satellite 6.16 for RHEL 8 affecting the Katello Content View History API. Authenticated users with permission to view Content Views in one organization may access lifecycle history information of Content Views belonging to other organizations by supplying the identifier of those views. This leads to unauthorized disclosure of publication and promotion events, associated users, and timestamps. The vulnerability has a CVSS score of 4.3, indicating medium severity. Red Hat has published an advisory for this issue and related vulnerabilities in Satellite 6.19, which includes security fixes. No explicit patch version for 6.16 is stated in the input data. The vendor advisory should be consulted for current remediation guidance.
A stack buffer overflow vulnerability exists in the GNU C Library (glibc) versions 2.1 through 2.44 due to unchecked stack growth in the tdelete function. This overflow can occur when tdelete is called on a very large tree with at least a million nodes, potentially causing application crashes. No common applications have been identified as affected. Red Hat has released security updates for their hardened images to address this issue.
CVE-2015-3246 is a race condition vulnerability in Red Hat libuser that allows authenticated local users to corrupt the /etc/passwd file, potentially causing denial of service or privilege escalation. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2015-5287 is a privilege escalation vulnerability in Red Hat's Automatic Bug Reporting Tool (ABRT). It allows local users with certain permissions to gain elevated privileges via a symlink attack on a file with a predictable name. The affected product versions may be end-of-life or end-of-service, and users are advised to discontinue use or upgrade to supported versions.
CVE-2026-80185 is a type confusion vulnerability in the BlueZ Bluetooth stack on Red Hat Enterprise Linux 10. It occurs in the sdp-xml.c component via the RegisterProfile(ServiceRecord) function, where a crafted nested ServiceRecord can corrupt the SDP XML parser stack. This causes scalar union data to be misinterpreted as a sequence pointer, allowing a local user to crash the bluetoothd daemon, resulting in a denial of service. The vulnerability has a medium severity with a CVSS score of 5.7 and does not impact confidentiality or integrity, only availability.
CVE-2026-80186 is a stack-based buffer overflow vulnerability in BlueZ, the Linux Bluetooth protocol stack used by Red Hat Enterprise Linux 10. A remote attacker within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet during Bluetooth discovery, causing a buffer overflow. This can crash the bluetoothd service, resulting in a denial of service (DoS), and may also allow arbitrary code execution.
Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, including OpenSSL packages. The update provides bug fixes and enhancements for affected OpenSSL components on aarch64 and x86_64 architectures. Specific vulnerability details and exploitation methods are not disclosed in the advisory. The update includes several RPM packages such as openssl, openssl-config-fips, openssl-devel, and others at version 3.5.8-0.1.hum1. The advisory references multiple CVEs including CVE-2026-14457 and others. No known exploits in the wild have been reported. The update is intended to improve security and stability of the affected packages.
CVE-2026-77680 is an algorithmic complexity vulnerability in libsoup's HTTP Range header processing that persists after a previous fix (CVE-2025-32907). The flaw causes CPU exhaustion when a client sends many identical satisfiable ranges in a single Range header, leading to O(N²) processing time. This can block the server's event loop for significant durations. No memory corruption or information disclosure occurs. The issue affects libsoup versions containing the CVE-2025-32907 fix but not the later merge request !550, which fixes the problem by improving the range coalescing algorithm and limiting the number of ranges accepted. No authentication is required to trigger this issue.
nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.
Security Fix(es):
* nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434)
* nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper sanitization, which are then passed to a local shell. Successful exploitation could lead to arbitrary code execution.
CVE-2026-79717 is a server-side request forgery (SSRF) vulnerability in galaxy_ng, the Ansible Galaxy server plugin for Pulp, part of Red Hat Ansible Automation Platform 2. An authenticated user with namespace management permissions can set a namespace avatar URL to arbitrary addresses, including internal and cloud metadata endpoints. A background worker fetches these URLs without destination checks, enabling internal network probing and IP enumeration. The HTTP client lacks an overall timeout, allowing slow or unresponsive targets to cause denial of service by pinning workers. The vulnerability is rated medium severity with a CVSS score of 6.4. No complete fix is available, but risk can be reduced by restricting permissions and applying network egress filtering.
CVE-2026-79655 is a vulnerability in the sos clean utility within the sos package on Red Hat Enterprise Linux 10. It allows a local attacker to create or overwrite arbitrary files by exploiting a path traversal issue during tar archive extraction. The flaw arises because symlink and hardlink targets are not properly validated, enabling file writes with the privileges of the sos clean process, which often runs as root.
Red Hat OpenShift Container Platform 4.22.11 includes important security fixes addressing multiple vulnerabilities in the bind9 DNS server and the Linux kernel's openvswitch module. These issues involve potential memory usage beyond configured limits, cache poisoning, unexpected process exits, DNSSEC validation bypass, and rejection of oversized nested action attributes. Users of OpenShift Container Platform 4.22 are advised to upgrade to version 4.22.11 to mitigate these vulnerabilities.
CVE-2026-79652 is a vulnerability in the JWT Bearer authorization grant implementation of the keycloak-services component in Red Hat build of Keycloak 26.6. The flaw allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass user consent requirements and obtain unauthorized access tokens for user accounts at consent-gated clients. Exploitation requires a specific non-default client configuration and possession of valid credentials and assertions.