A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS).
CVE-2026-111802 is a vulnerability in Nautilus on Red Hat Enterprise Linux 10 where the application improperly handles symbolic links when prompting users to empty the trash after unmounting removable drives or disk images. An attacker can exploit this by tricking a user into mounting a crafted storage volume and confirming the trash emptying prompt, causing arbitrary deletion of files accessible to that user. Exploitation requires local user interaction within a graphical desktop session and does not lead to privilege escalation or code execution.
A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data.
A flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly.
CVE-2026-62439 is an integer overflow vulnerability in the GIMP file-pvr plug-in used in Red Hat Enterprise Linux 10. The flaw occurs when calculating memory buffer sizes for image dimensions in PowerVR (.pvr) files, leading to a heap-based buffer overflow. Exploitation requires a user to open or preview a specially crafted .pvr file, potentially causing arbitrary code execution or application crash (Denial of Service).
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the pgbouncer package to version 1.26.1-1.hum1. This update addresses multiple vulnerabilities identified by CVE-2026-107348, CVE-2026-107349, and CVE-2026-107350. The advisory indicates this is a bug fix and enhancement update with a high severity rating. No specific affected versions were detailed beyond the updated package version. The update is available for multiple architectures including aarch64, s390x, and x86_64.
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.
A vulnerability in Red Hat Quay allows an attacker to craft a specially designed PDF with long indirect object headers not terminated by whitespace, causing long runtimes when the PDF is processed. This issue has been addressed by updating the pypdf library to version 6.18.0. Workarounds include applying specific code changes if upgrading is not immediately possible.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-111581 is a low-severity vulnerability in Red Hat Enterprise Linux 10 affecting the libblockdev library. The issue arises because the bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass user-supplied label values directly as arguments to ntfslabel and fatlabel utilities without proper input validation or use of end-of-options separators. This allows labels starting with a dash ('-') to be interpreted as command-line flags, potentially causing unintended operations. The vulnerability can be exploited by unprivileged local users via the udisks2 Filesystem.SetLabel() D-Bus method without requiring administrator authentication.
A security vulnerability (CVE-2026-98260) affects the kernel-rt packages of the Real Time Linux Kernel used in Red Hat Enterprise Linux. The issue involves improper cleanup of POSIX timers after the de_thread() function call. Red Hat has released an important security update addressing this flaw. The update requires a system reboot to take effect. The vulnerability is rated as high severity by the source data, and Red Hat recommends prompt application of the update to improve system security.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: MGMT: validate LTK enc_size on load (CVE-2026-43020)
* kernel: Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CVE-2026-31772)
* kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
* kernel: Linux kernel: xfrm single-frag length not properly limited ()
* kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: ixgbevf: fix use-after-free in VEPA multicast source pruning (CVE-2026-64113)
* kernel: ALSA: virtio: Validate control metadata from the device (CVE-2026-64490)
* kernel: AMD-SN-7061: Safe RET Interrupt Vulnerability (CVE-2026-68480)
* kernel: mm/khugepaged: write all dirty file folios when collapsing (CVE-2026-68086)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: exec: Cleanup POSIX timers right after de_thread() (CVE-2026-98260)
Bug Fix(es) and Enhancement(s):
* kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-10.0.z] (JIRA:RHEL-186344)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-111555 is a vulnerability in the luksmeta component of Red Hat Enterprise Linux 10. It involves improper boundary validation of metadata slots, allowing an attacker with the ability to supply or modify a disk header to redirect wipe or load operations outside the intended metadata area. This can lead to overwriting or zeroing out encrypted payload data, causing persistent data loss and corrupted storage. Exploitation generally requires privileged access to raw block devices or tricking an administrator into processing a malicious disk image.
CVE-2026-105958 is a high-severity vulnerability in spice-server on Red Hat Enterprise Linux 6. It involves multiple migration data handlers that improperly use client-supplied offsets without validating bounds. This flaw allows a malicious authenticated SPICE client during VM live migration to perform out-of-bounds read and write operations on the message buffer, potentially leading to arbitrary heap memory disclosure or heap corruption.
CVE-2026-105959 is a high severity vulnerability in the spice-server component of Red Hat Enterprise Linux 6. It involves an integer overflow or wraparound issue where a size_t allocation size is truncated to int during a malloc callback. This flaw allows a malicious authenticated SPICE client to trigger a large heap buffer overflow during VM live migration by sending a crafted max_encoders value in migration data.
CVE-2026-104715 is a privilege escalation vulnerability in Red Hat Enterprise Linux 10 affecting the cifs-utils package. It arises from improper sanitization of user-controlled input in credentials files used by privileged services to mount CIFS shares. This flaw allows a local unprivileged user to inject unauthorized mount options, bypass permission checks, and execute files with root privileges.
CVE-2026-84823 is a path traversal vulnerability in WildFly on Red Hat Enterprise Linux 8. A user with the Monitor role, which has the lowest standard RBAC privileges, can exploit this flaw via the take-snapshot operation by manipulating the name parameter. This allows writing a copy of the server configuration to an arbitrary location and subsequently reading sensitive configuration data, including credentials, bypassing RBAC restrictions. The vulnerability has a CVSS score of 7.1, indicating high severity.