A security update for Chromium addresses multiple vulnerabilities including buffer overflows, use-after-free errors, out-of-bounds writes, missing or incorrect authorization, race conditions, information leaks, improper input validation, and UI misrepresentations across various components such as ANGLE, GPU, ServiceWorker, DevTools, V8, and others. These issues are fixed in Chromium version 154.0.8037.57. The update resolves a wide range of security flaws that could impact the browser's stability and security.
A security update for radare2 version 6.2.2 addresses multiple vulnerabilities including denial of service, command injection, out-of-bounds reads, heap overflows, and integer overflows. The update fixes issues such as validation errors in file parsers, infinite loops, and use-after-free conditions. These vulnerabilities collectively pose critical risks to the integrity and availability of the software. No specific affected versions are provided in the data. The update includes various fixes improving analysis, core functionality, and plugin behavior.
This update for expat fixes the following issues:
- CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263).
- CVE-2026-45186: In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a
denial of service via moderately sized crafted XML input (bsc#1264713).
- CVE-2026-50219: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,
XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation (bsc#1267631).
- CVE-2026-56131: libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within
handlers in cases of a policy violation (bsc#1268572).
- CVE-2026-56132: mishandled memory reallocation during array scaffolding in doProlog can cause heap-based buffer
overflows (bsc#1268573).
- CVE-2026-56403: integer overflow in the storeAtts function can cause memory corruption and potential arbitrary code
execution (bsc#1275096).
- CVE-2026-56404: integer overflow in the addBinding function can cause undersized memory allocations, memory
corruption, and application crashes (bsc#1275096).
- CVE-2026-56405: integer overflow in the getAttributeId function can cause heap memory corruption and arbitrary
code execution (bsc#1275096).
- CVE-2026-56406: missing bounds validation in XML_ParseBuffer can cause integer overflows, memory corruption, and
application crashes (bsc#1275096).
- CVE-2026-56407: integer overflow in doProlog related to entity text length can cause memory corruption and denial
of service (bsc#1275096).
- CVE-2026-56408: integer overflow in the copyString function can cause heap memory corruption and application crashes
(bsc#1275096).
- CVE-2026-56409: integer overflow in the xmlwf utility output filename handling can allow path buffer corruption and
arbitrary file write conditions (bsc#1275096).
- CVE-2026-56410: integer overflow in resolveSystemId within the xmlwf utility can cause memory corruption, information
disclosure, and potential code execution (bsc#1275096).
- CVE-2026-56411: integer overflow in endDoctypeDecl via NOTATION declarations in xmlwf can cause memory corruption and
denial of service (bsc#1275096).
- CVE-2026-56412: incomplete handler call depth tracking in doCdataSection can cause use-after-free
conditions and arbitrary code execution (bsc#1275096).
- CVE-2026-66046: libexpat: denial of service vulnerability caused by quadratic algorithmic complexity in the
storeAtts() function in xmlparse.c (bsc#1275732).
- CVE-2026-72522: libexpat: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same
as high surrogates during Unicode processing (bsc#1275594).
- CVE-2026-76641: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger
memory corruption (bsc#1275915).
- CVE-2026-76956: In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to
insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via
crafted X (bsc#1275860).
- CVE-2026-76957: libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. (bsc#1275859).
Changes for expat:
- Updated to version 2.8.4
Multiple security issues were addressed in the libpoppler-cpp3 package version 26.09.0-2.1 for openSUSE Tumbleweed. These vulnerabilities affect numerous specific versions of the package across Ubuntu and SUSE distributions. The issues have been fixed in the updated package release.
Multiple remote code execution vulnerabilities have been identified in the GStreamer streaming media framework, specifically within the gstreamer1-plugins-good package. These include heap-based buffer overflows in MRF and PNG file parsing, and a use-after-free in rtpsbcdepay. These vulnerabilities affect various versions of the package used in Red Hat Enterprise Linux and SUSE distributions. A security update addressing these issues is available.
This security update provides a functional equivalent of RHSA-2026:71387.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:71387.
A stack buffer overflow vulnerability (CWE-121) exists in the rrdtool component of Red Hat Enterprise Linux 10, specifically in the rrdcached handle_request_create() function. This flaw allows local privilege escalation via unbounded DS/RRA arguments. The issue has been addressed by a security update provided by Red Hat. The vulnerability affects multiple architectures and versions of Red Hat Enterprise Linux 10 and related products.
Multiple security vulnerabilities have been identified and fixed in the pcre2 library. These include out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure issues. The flaws affect various functions such as pcre2_dfa_match, pcre2_compile_32, and pcre2_serialize_encode. These vulnerabilities can lead to memory corruption and potential information leaks. The update addresses seven distinct CVEs related to these issues.
A denial of service vulnerability (CVE-2026-9499) exists in the Qt software toolkit due to an out-of-bounds read in text codec handling. This affects certain versions of Qt packages used in Red Hat Hardened Images. A security update addressing this vulnerability is available from Red Hat.
SUSE Linux Enterprise 12 SP5 kernel received a security update addressing multiple vulnerabilities across various kernel components including drm, timers, netfilter, Bluetooth, media, ACPI, powerpc, TPM, RAID, IPMI, BPF, networking, and others. These fixes resolve issues such as race conditions, NULL pointer dereferences, use-after-free, buffer overflows, and validation errors. The update mitigates a broad range of security risks affecting kernel stability and security.
This update for util-linux fixes the following issues:
- CVE-2026-13595: heap use-after-free in `libblkid` nested partition probing (bsc#1269583).
- CVE-2026-27456: TOCTOU in the mount program when setting up loop devices (bsc#1261606).
- CVE-2026-53612: local privilege escalation via TOCTOU in mount(8) hook_owner.c chmod/chown (bsc#1268886).
- CVE-2026-53613: local privilege escalation via TOCTOU in mount(8) - Target Path Redirection (bsc#1268886).
- CVE-2026-53614: local privilege escalation via LIBMOUNT_FORCE_MOUNT2 Environment Variable - nosuid/noexec
Bypass in SUID mount(8) (bsc#1268886).
- CVE-2026-76642: failed external mount helper triggers privileged `X-mount` post-hooks, which enables local privilege
escalation (bsc#1278349).
- CVE-2026-78408: `nsenter --join-cgroup` leaks root `cgroup` migration authority, which allows for migration or
termination of root processes (bsc#1278348).
- CVE-2026-78410: restricted `bind` mounts do not pin the source, which allows for `X-mount.owner`/`group`/`mode`
redirection (bsc#1278347).
Changes for util-linux:
- lib/fileutils: add ul_openat_resolve() openat2 wrapper (bsc#1275441)
- lib/fileutils: fix RESOLVE_NO_SYMLINKS fallback value
- lib/fileutils: fix unused parameter warnings without SYS_openat2
- libmount: add missing fileutils.h include to hook_idmap.c
- libmount: add mnt_open_tree() helper for safe tree opening
- libmount: pin source path with openat2() for restricted users
(bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: restrict source path canonicalization for non-root
users (bsc#1275441, bsc#1278347, CVE-2026-78410)
- libmount: skip post-mount hooks after failed mount helper
(bsc#1275441, bsc#1278349, CVE-2026-76642)
- libmount: use USE_LIBMOUNT_MOUNTFD_SUPPORT for idmap hook
- nsenter: close cgroup.procs fd after join to prevent authority
leak (bsc#1275441, bsc#1278348, CVE-2026-78408)
- nsenter, unshare: add O_CLOEXEC to all open() calls (bsc#1275441,
bsc#1278348, CVE-2026-78408)
- wall, write: sanitize hostname in banner header (bsc#1275441)
- Add missing function. (bsc#1275441)
- ipcutils: Prevent using uninitialized variable (bsc#1268886)
- BREAKING CHANGE:
Paths must always be canonicalized for unprivileged users to
ensure safe target resolution. X-mount.nocanonicalize is ignored
for them.
- INCOMAPTIBLE CHANGE (linux < 6.15):
X-mount.subdir: The safe detached subdirectory is no more
supported for unprivileged users for safety reasons.
- liblastlog2: Wait on busy SQLite connections (bsc#1268886).
- libmount: Fix subvolid buffer overflow in get_btrfs_fs_root
(bsc#1268886).
- libblkid: Fix use-after-free in nested partition probing
(bsc#1269583, bsc#1268886, CVE-2026-13595)
- libmount: fix SUID bypass via LIBMOUNT_FORCE_MOUNT2 and legacy
mount path (bsc#1268886, CVE-2026-53614, GHSA-67r7-8m5w-22wx).
- fileutils: add ul_open_no_symlinks() needed by other patches
(bsc#1268886).
- libmount: add fd_target to context for TOCTOU race condition
prevention (bsc#1268886, CVE-2026-53613, GHSA-8gj5-72r3-428g).
- libmount: ignore X-mount.nocanonicalize for restricted users
- libmount: use fd-based fchownat/chmod in hook_owner (bsc#1268886,
CVE-2026-53612, GHSA-g8wm-75wr-g2vh).
- libmount: restrict X-mount.subdir for non-root (bsc#1268886).
- libmount: use fd_target in hook_idmap for move_mount()
- libmount: add mount ID verification and man page TOCTOU note
- loopdev: use openat2(RESOLVE_NO_SYMLINKS) for backing file
(bsc#1268886#c2, bsc#1261606).
- Ignore pam-config error that prevents update failure if common*
pam configuration is not symlink to common-*-pc (bsc#1270219).
Multiple vulnerabilities in zstd-jni have been addressed in version v1.5.7.16. These include denial of service and information disclosure via out-of-bounds reads, as well as use-after-free issues that can cause memory corruption, silent data corruption, or JVM crashes.
A security vulnerability identified as CVE-2026-53587 exists in libgit2, a Git core methods library included with Rust. This vulnerability allows a denial of service via a heap out-of-bounds read triggered by a malicious Git server. The issue affects specific Rust package versions distributed by Red Hat and Ubuntu. A patch is available to address this vulnerability.
CVE-2026-85999 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) that causes uncontrolled resource consumption (quadratic time complexity) when parsing certain valid CSS selectors containing long runs of whitespace or comments. This happens due to an inefficient regular expression search that triggers excessive backtracking, leading to significant CPU usage and interpreter stalls. The issue affects soupsieve versions prior to 2.9. Exploitation requires user-controlled CSS selectors, so applications using only hard-coded selectors are not affected.
CVE-2026-86000 is a medium severity vulnerability in the Python library soupsieve (used by BeautifulSoup) involving uncontrolled resource consumption due to a regular expression backtracking issue. The flaw arises from overlapping quantified character classes in the regex pattern used to parse CSS selectors, causing quadratic time complexity when processing certain crafted selectors that fail to match. This can lead to significant CPU consumption and delays when user-controlled selectors are processed. The vulnerability affects soupsieve versions prior to 2.9. Exploitation requires passing a maliciously crafted CSS selector string to soupsieve or BeautifulSoup's select methods. No known exploits are reported in the wild, and no official patch information is provided in the input data.
The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images.
Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.