Red Hat has released a security and bug fix update for Red Hat Advanced Cluster Security for Kubernetes (RHACS) version 4.11.5. This update addresses multiple security vulnerabilities identified by CVE-2026-84304 and CVE-2026-84445. Users of earlier RHACS versions are advised to upgrade to 4.11.5 to benefit from these security patches and bug fixes. The update also fixes an issue related to view-based report creation permissions. The advisory references release notes for detailed information on fixes and enhancements.
Multiple security vulnerabilities identified by CWE-1341 and CWE-120 were fixed in the glibc-2.44-1.1 package for openSUSE Tumbleweed and related Red Hat packages. These updates address flaws in the GNU C Library (glibc) to improve security. No known exploits have been reported in the wild. The severity of these issues is assessed as medium. Updated packages are available from SUSE and Red Hat, including language packs and hardened images RPMs.
Red Hat Enterprise Linux AI Inference Server Model Optimization Tools 3.3.6 update addresses multiple security vulnerabilities including improper input validation and memory handling errors. The update provides enhanced container images to mitigate these issues. The vulnerabilities are classified as important and affect several CVEs. No active exploits are known in the wild at this time. A patch is available to remediate these vulnerabilities.
GitPython versions prior to 3.27.0 and certain other version ranges contain a vulnerability where the clone_from() and clone() methods do not block the --separate-git-dir option by default. This allows an attacker controlling input to specify an arbitrary path for the Git metadata directory outside the intended clone destination, potentially leading to arbitrary directory and file creation limited by filesystem permissions. The vulnerability is due to an omission in the denylist of unsafe_git_clone_options. A patch is available for affected versions.
CVE-2026-84292 is a vulnerability in the node-ajv package where the fast-uri component serializes the port part of a URI without validating it. This issue is part of a set of vulnerabilities addressed in a Red Hat Hardened Images RPM security update affecting multiple Red Hat products. The vulnerability has a CVSS score of 7.5 (medium severity) and impacts integrity without affecting confidentiality or availability. A patch is available from Red Hat as part of their security advisory RHSA-2026:63782.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock() (CVE-2025-40149)
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: thermal: core: Fix thermal zone device registration error path (CVE-2026-43332)
* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
* kernel: gfs2: Fix slab-use-after-free in qd_put (CVE-2026-45861)
* kernel: Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CVE-2026-46275)
* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
* kernel: netfilter: nf_log: validate MAC header was set before dumping it (CVE-2026-52942)
* kernel: gfs2: add some missing log locking (CVE-2026-53049)
* kernel: netfilter: nf_conntrack_sip: don't use simple_strtoul (CVE-2026-52986)
* kernel: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CVE-2026-53357)
* kernel: net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-63829)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (CVE-2026-63993)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (CVE-2026-63992)
* kernel: tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (CVE-2026-63994)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CVE-2026-64557)
* kernel: vxlan: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-68432)
* kernel: net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (CVE-2026-72052)
* kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
* kernel: KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CVE-2026-72289)
* kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CVE-2026-72255)
* kernel: KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CVE-2026-74516)
* kernel: netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CVE-2026-74569)
* kernel: ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CVE-2026-74669)
* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
* kernel: nvme-tcp: fix host memory disclosure on R2T for a read command (CVE-2026-89481)
* kernel: nvme: add missing SRCU grace period in error path (CVE-2026-89972)
* kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CVE-2026-90227)
* kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CVE-2026-97417)
* kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CVE-2026-93288)
Bug Fix(es) and Enhancement(s):
* [RHEL-9.8] kernel BUG at lib/list_debug.c:23! observed with liburing buf-ring-upgrade.t [rhel-9.8.z] (JIRA:RHEL-254192)
* hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info [rhel-9.8.z] (JIRA:RHEL-262029)
* RHEL9.4 - kernel: CPU hotplug unsupported by CPUMF [rhel-9.8.z] (JIRA:RHEL-270892)
* Accel-DSA: dmaengine: idxd: kernel oops on unbind [rhel-9.8.z] (JIRA:RHEL-274410)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including the opentelemetry-collector-k8s package version 0.161.0-0.1.hum1. This update addresses multiple vulnerabilities including CVE-2026-63209. The advisory does not provide detailed information on the nature of the vulnerabilities or specific fixes. No known exploits are reported in the wild. The update is available for aarch64 and x86_64 architectures.
A security update for PostgreSQL 12 addresses a vulnerability (CVE-2026-18408) that allows arbitrary code execution via untrusted data inclusion in the pg_dump utility. This vulnerability affects Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life versions. The issue is rated as important by Red Hat Product Security. A security fix is available and should be applied to affected systems to mitigate the risk.
Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. This update includes the latest bug fixes and enhancements.
Multiple security vulnerabilities have been identified and fixed in the 389 Directory Server (389-ds-base) used in Red Hat Enterprise Linux 9.2 and related distributions. The issues include a pre-authentication LDAP filter injection, a NULL pointer dereference in the BER parser, and a pre-authentication stack buffer overflow via unbounded replica ID parsing. These vulnerabilities have been addressed by Red Hat in updated packages.
The dracut packages contain an event-driven initial RAM file system (initramfs) generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition.
Security Fix(es):
* dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893)
* dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: Kernel SMB client: Double-free vulnerability allows remote denial of service or privilege escalation (CVE-2026-64385)
* kernel: smb: client: fix double-free in SMB2_flush() replay (CVE-2026-64383)
* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
Bug Fix(es) and Enhancement(s):
* gfs2: Remote delete issues [rhel-9.6.z] (JIRA:RHEL-172430)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This security update provides a functional equivalent of RHSA-2026:45114.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:45114.
Red Hat JBoss Web Server 7.0.2 includes multiple security fixes addressing vulnerabilities in the Apache Tomcat components it bundles. These vulnerabilities include local information disclosure, improper input validation, access control bypasses, denial of service, authentication bypass, and session management issues. The update replaces version 7.0.1 and addresses several CVEs related to these security flaws.
A low severity argument injection vulnerability (CWE-88) was identified in the CUPS package, affecting multiple versions. Red Hat has issued an advisory with updated RPM packages to address this issue. The vulnerability has a CVSS score of 2.5, indicating low impact, primarily affecting confidentiality with limited attack vector and requiring low privileges. No known exploits are reported in the wild.
Red Hat JBoss Web Server 7.0.2 includes a security update addressing multiple vulnerabilities, including acceptance of PKCS#12 files with PBMAC1 using short HMAC keys, which weakens cryptographic protections. This issue affects Red Hat JBoss Web Server 7.0.2 and related components. The advisory rates the update as important but does not provide a CVSS score or detailed technical impact for this specific vulnerability. No known exploits are reported in the wild. The update replaces version 7.0.1 and includes fixes for several Apache Tomcat vulnerabilities and OpenSSL issues.
A use-after-free vulnerability in the Linux kernel's vsock/vmci subsystem was fixed by Red Hat. The flaw occurs during a peer reset connection in the handshake phase, causing improper socket cleanup and leading to a use-after-free condition detected by KASAN. This vulnerability has high severity and affects multiple Linux kernel versions prior to specific 5.15.x updates. Official kernel updates have been released to address this issue. Users should apply these updates and reboot to mitigate the vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for a high severity use-after-free vulnerability (CVE-2026-19445) affecting python3.15 packages in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. The advisory does not provide detailed technical information or explicit patch versions but references updated python3.15 packages. The vulnerability is related to CWE-416. No known exploits are reported in the wild, and no explicit fix version is stated in the advisory.