Multiple security vulnerabilities affecting the Linux kernel in Red Hat Enterprise Linux 9 and related products have been addressed in a security update. The issues include use-after-free bugs, race conditions, and improper handling of certain kernel operations across subsystems such as KVM, NFS, kernfs, Bluetooth, and io_uring. These vulnerabilities have been assigned CVE identifiers ranging from CVE-2025-38351 to CVE-2025-40047. The update is rated as having moderate security impact and requires a system reboot to take effect.
A moderate severity vulnerability (CVE-2024-56690) affects the Linux kernel in Red Hat Enterprise Linux 9.6 Extended Update Support. The issue involves the crypto subsystem where the crypto layer is not called directly when padata_do_parallel() returns -EBUSY, potentially causing improper handling in cryptographic operations. Red Hat has released a security update to address this issue. Systems must be rebooted after applying the update for the fix to take effect.
The lasso packages provide the Lasso library that implements the Liberty Alliance Single Sign-On standards, including the SAML and SAML2 specifications. It allows handling of the whole life-cycle of SAML-based federations and provides bindings for multiple languages.
Security Fix(es):
* lasso: Type confusion in Entr'ouvert Lasso (CVE-2025-47151)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A Execution with Unnecessary Privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root.This issue affects lightdm-kde-greeter. before 6.0.4.
Multiple security vulnerabilities affecting Mozilla Firefox as packaged for Red Hat Enterprise Linux 9.6 Extended Update Support have been identified and addressed. These include mitigation bypasses in DOM components, use-after-free vulnerabilities in audio/video and WebRTC components, same-origin policy bypasses, race conditions in graphics, and spoofing issues. The update fixes these vulnerabilities to improve browser security and protect against potential exploitation.
Two security vulnerabilities were identified in python-kdcproxy, a Python module used in Red Hat Enterprise Linux 9.6 Extended Update Support. The first vulnerability (CVE-2025-59088) is an unauthenticated Server-Side Request Forgery (SSRF) via realm-controlled DNS SRV records. The second (CVE-2025-59089) is a remote denial-of-service (DoS) caused by unbounded TCP upstream buffering. Red Hat has issued an important security update addressing these issues for multiple architectures and variants of RHEL 9.6.
Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.
Security Fix(es):
* squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.
Security Fix(es):
* runc: container escape via 'masked path' abuse due to mount race conditions (CVE-2025-31133)
* runc: container escape with malicious config due to /dev/console mount and related races (CVE-2025-52565)
* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update for assimp fixes the following issues
- CVE-2025-11277: large mWidth and mHeight dimensions can lead to integer overflow and a heap-based buffer overflow
(bsc#1251019).
- CVE-2026-10197: NULL pointer dereference in ImportEmbeddedTextures when mimeType lacks '/' (bsc#1266996).
- CVE-2026-10199: NULL pointer dereference in glTF2::LazyDict::operator[] due to unchecked node access in
ImportAnimations (bsc#1266998).
- CVE-2026-10200: [glTF] Heap-buffer-overflow in CopyValue() when parsing invalid 4x4 matrix with insufficient data
(bsc#1266999).
- CVE-2026-10232: heap use-after-free in aiNode::~aiNode due to invalid node tree when processing malformed ASE files
(bsc#1267037).
Multiple use-after-free and value overflow vulnerabilities have been identified in the xorg-x11-server-Xwayland component affecting Red Hat Enterprise Linux 9 and related variants. These vulnerabilities have been assigned CVE identifiers CVE-2025-62229, CVE-2025-62230, and CVE-2025-62231. The issues involve improper memory handling in XPresentNotify structure creation, Xkb client resource removal, and XkbSetCompatMap() function. A security update has been released by Red Hat to address these vulnerabilities. The severity is rated as medium, and no known exploits are currently reported in the wild.
Multiple vulnerabilities affecting the pcs packages, which provide command-line configuration for Pacemaker and Corosync utilities, have been identified and addressed. These vulnerabilities relate to the rubygem-rack and rack components, involving unsafe default query parsing and unbounded memory buffering that can lead to denial of service (DoS) via memory exhaustion. The issues include a params_limit bypass through semicolon-separated parameters and unbounded multipart form parsing. Red Hat has released security updates for Red Hat Enterprise Linux 9 and related high availability and resilient storage variants to mitigate these vulnerabilities.
A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x86_64/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manager Server LTS 4.3: from ? before 4.3.88-150400.3.113.5.
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.
NeuVector used a hard-coded cryptographic key embedded in the source
code. At compilation time, the key value was replaced with the secret
key value and used to encrypt sensitive configurations when NeuVector
stores the data.
A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.
The entry process of the enforcer container is the monitor
process. When the enforcer container stops, the monitor process checks
whether the consul subprocess has exited. To perform this check, the
monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.
The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT
are used directly to compose shell commands via popen without
validation or sanitization. This behavior could allow a malicious user
to inject malicious commands through these variables within the enforcer
container.
CVE-2025-54470 is a high-severity vulnerability in SUSE NeuVector versions 5.3.0 and 5.4.0 that occurs when the 'Report anonymous cluster data' option is enabled. NeuVector fails to enforce TLS certificate validation when sending anonymous telemetry data, exposing the communication to man-in-the-middle attacks. Additionally, the telemetry server's response is loaded into memory without size limitation, allowing potential denial of service attacks.
Multiple security vulnerabilities have been identified in Redis related to its Lua scripting capabilities. These include integer overflow leading to potential remote code execution (CVE-2025-46817), privilege escalation via execution of Lua scripts as a different user by authenticated users (CVE-2025-46818), denial of service through specially crafted Lua scripts (CVE-2025-46819), and a use-after-free vulnerability in Lua that may lead to remote code execution (CVE-2025-49844). A security update addressing these issues is available for Redis 7.2.11 on Red Hat Enterprise Linux 9.6 and related distributions. The update is rated as important by Red Hat Product Security. Users should apply the update to mitigate these vulnerabilities.
A vulnerability has been identified in Rancher Manager, where sensitive
information, including secret data, cluster import URLs, and
registration tokens, is exposed to any entity with access to Rancher
audit logs.
A vulnerability has been identified within Rancher
Manager, where after removing a custom GlobalRole that gives
administrative access or the corresponding binding, the user still
retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs