Red Hat AI Inference 3.4.6 (rocm) is identified with multiple security vulnerabilities including CVE-2026-15679. The advisory lists numerous CVEs affecting the Red Hat AI Inference Server but does not provide details on specific vulnerabilities or fixes. No patches or remediation steps are currently available as per the vendor advisory.
Red Hat AI Inference Model Optimization Tools 3.4.6 (cuda) has been identified with multiple security vulnerabilities. The advisory lists several CVEs affecting this product, but no fixes or patches are currently provided. The vulnerabilities include issues related to path traversal, improper certificate validation, and code injection among others. The vendor has published an advisory but does not indicate any available remediation at this time.
Red Hat OpenShift Logging 6.5.3 addresses multiple security issues including a high severity denial of service vulnerability (CVE-2026-18140) caused by uncontrolled recursion with deeply nested JSON in the goose package. This logging solution manages logs cluster-wide for OpenShift. The update improves stability and security by fixing this and other bugs.
A security update addresses an out-of-bounds read and write vulnerability in the libpcap library, which is used for low-level network monitoring. This vulnerability (CVE-2026-0799) allows arbitrary memory access. The issue affects multiple Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products across various architectures. Red Hat has released an important security advisory with updated libpcap packages to fix this vulnerability.
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Red Hat has issued a security advisory addressing vulnerabilities in the ffmpeg component used within the Red Hat Enterprise Linux AI 3.5 platform. The advisory fixes CVE-2026-8461 and others related to out-of-bounds reads and writes. These vulnerabilities affect internal RPM packages supported only as part of the Red Hat AI application platform. Updated ffmpeg packages are provided to remediate these issues.
Two high-severity vulnerabilities were identified in libsoup, an HTTP client/server library for GNOME. The first is a heap use-after-free triggered by a GOAWAY frame in the HTTP/2 client (CVE-2026-85197). The second is a heap buffer overflow in SoupSession caused by a crafted SETTINGS frame with an INITIAL_WINDOW_SIZE parameter (CVE-2026-85534). Both issues can lead to memory corruption. These vulnerabilities affect multiple versions of libsoup across various Linux distributions including Red Hat and Ubuntu. Fixes are available through official updates.
A security update for the rhc-worker-playbook component in Red Hat Enterprise Linux addresses a local privilege escalation vulnerability in the ansible.posix authorized_key module. The issue involves symlink-following during a chown operation, which could allow unauthorized privilege escalation. The update is rated as Important by Red Hat and affects Red Hat Enterprise Linux 8.8 variants. No CVSS score is provided for this vulnerability.
A denial of service vulnerability (CVE-2026-84445) exists in the gRPC-Go library used by the rhc client tool and daemon in Red Hat Enterprise Linux 9. This flaw allows denial of service via malformed RPC requests. Red Hat has released updated rhc packages to address this issue across multiple architectures and variants of Red Hat Enterprise Linux 9. No known exploits are reported in the wild. The Helm CLI for Red Hat OpenShift v4.3.0 is unrelated to this vulnerability fix.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple OpenSSH packages. This update addresses several vulnerabilities identified by multiple CVEs. The advisory provides updated RPM versions for various architectures. No explicit patch versions or affected versions are detailed in the advisory. The severity is assessed as medium.
This Red Hat security advisory addresses a high-severity vulnerability identified as CVE-2026-16365 affecting Thunderbird. The advisory provides a functional equivalent update to a previous Red Hat advisory (RHSA-2026:73971). The vulnerability involves multiple weaknesses related to authorization and memory safety as indicated by associated CWEs. Affected versions include various Thunderbird and Firefox packages on Red Hat Enterprise Linux and SUSE Linux Enterprise distributions. No CVSS score is provided for this vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (CVE-2026-46309)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: drm/amd/display: set new_stream to NULL after release (CVE-2026-68236)
* kernel: drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CVE-2026-68278)
* kernel: drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CVE-2026-68245)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound (CVE-2026-80887)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
* kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension (CVE-2026-89811)
* kernel: media: cx231xx: reject geometry changes while the VBI queue is busy (CVE-2026-89894)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-687.10.1.el9_8.
Security Fix(es):
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
* kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176)
* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)
* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
* kernel: macsec: fix replay protection at XPN lower-PN wrap (CVE-2026-63925)
* kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: bpf: Support for hardening against JIT spraying (CVE-2026-64508)
* kernel: x86/bugs: Enable IBPB flush on BPF JIT allocation (CVE-2026-64507)
* kernel: openvswitch: fix GSO userspace truncation underflow (CVE-2026-68123)
* kernel: cifs: validate DFS referral string offsets (CVE-2026-72318)
* kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
* kernel: af_unix: Unlink scc_entry in unix_del_edge() (CVE-2026-80521)
* kernel: nvmet-auth: Synchronize timeout work during SQ teardown (CVE-2026-89970)
Bug Fix(es) and Enhancement(s):
* net/tls backports for 10.2 (JIRA:RHEL-275027)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update for glibc addresses multiple vulnerabilities including invalid free, stack overflow, buffer overflows, out-of-bounds writes, assertion failures, and a race condition that could allow local privilege escalation. The update fixes issues in components such as wordexp, resolv_conf, fopen ccs extension, strfmon, tdelete, and character decoding routines. The vulnerabilities affect local and network contexts and can lead to process crashes or privilege escalation. The update is provided by SUSE and Red Hat for various glibc packages across architectures.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: vhost: reset the vring metadata cache on vring reconfiguration (CVE-2026-74580)
* kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705)
Bug Fix(es) and Enhancement(s):
* kernel: vhost: reset the vring metadata cache on vring reconfiguration [rhel-7.9.z] (JIRA:RHEL-224557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.