CVE-2026-86849 is a medium severity vulnerability in Red Hat Fast Datapath for RHEL 10 involving an out-of-bounds write in the DPDK lib/vhost vhost-crypto component. The flaw arises from an integer overflow in chain length checks and missing length checks on the RSA path, which can cause a host buffer overflow in the vhost-crypto backend. This vulnerability affects availability but does not impact confidentiality or integrity. No specific affected versions or patch information is provided in the available data.
CVE-2026-86856 is a vulnerability in the DPDK nfp vDPA driver used in Red Hat Fast Datapath for RHEL 10. It involves an out-of-bounds write where stack and heap buffers sized for a single queue pair can be overflowed if more virtqueues are configured. This can lead to a host crash or memory corruption. The vulnerability has a CVSS score of 6.5, indicating medium severity. No affected versions or patch information are explicitly provided in the available data.
CVE-2026-86847 is a vulnerability in Red Hat Fast Datapath for RHEL 10 affecting the DPDK lib/vhost vhost-crypto component. The flaw involves the write-back chain cleanup process following an uninitialized next pointer when mapping a guest descriptor fails, which can cause the host vhost-crypto process to hang or crash. This results in a denial of service condition without impacting confidentiality or integrity.
CVE-2026-86846 is an out-of-bounds write vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. A guest can supply an avail-ring descriptor index without bounds checking, leading to a write outside the intended memory area in the host vhost-crypto backend. This flaw has a CVSS score of 6.5, indicating medium severity, and impacts availability without affecting confidentiality or integrity.
CVE-2026-86845 is a use-after-free or type confusion vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. The flaw arises because session cleanup can leave a stale cached session pointer, and the data path does not verify the session type before attaching it. This vulnerability has a CVSS score of 6.5, indicating medium severity, and can cause denial of service due to application crashes. No known exploits are reported in the wild. No explicit patch or remediation details are provided in the available data.
CVE-2026-86566 is an integer underflow vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It occurs when a guest with runt RX descriptors causes an underflow in the copy length during vhost enqueue operations. This flaw can lead to a denial of service in shared vhost backends such as OVS-DPDK. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-86848 is a high-severity race condition vulnerability in the DPDK lib/vhost vhost-crypto component of Red Hat Fast Datapath for RHEL 10. The flaw involves a time-of-check to time-of-use (TOCTOU) issue where an indirect-descriptor snapshot double-fetches a guest descriptor's next index. This allows a malicious guest to cause an out-of-bounds access in the host backend, potentially leading to complete compromise of confidentiality, integrity, and availability.
CVE-2026-86567 is a use-after-free vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. The issue arises because the VDUSE handler does not invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap conditions. This flaw has a high severity with a CVSS score of 8.8, indicating potential for significant impact on confidentiality, integrity, and availability. No affected versions or patch information are explicitly provided in the available data. No known exploits in the wild have been reported at this time.
CVE-2026-100236 is a high severity vulnerability in the DPDK GSO library used by Red Hat Fast Datapath for RHEL 10. The flaw involves an out-of-bounds read or write triggered when software GSO copies packet headers without verifying that the header fits within the source or destination buffers. This can occur if a header is longer than the configured GSO segment size, causing an underflow in payload-size calculation. The vulnerability can be exploited remotely or by a guest-supplied packet.
CVE-2026-86565 is a high severity vulnerability in Red Hat Fast Datapath for RHEL 10 involving an out-of-bounds write in the host vhost process. The flaw arises when a guest desynchronizes the virtqueue size from the inflight descriptor table size in DPDK lib/vhost. This can lead to critical impacts including confidentiality, integrity, and availability loss on the host system.
CVE-2026-86563 is a high-severity vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It involves a double-offset bug in the vhost log mapping calculation that can cause incorrect memory access. This flaw could impact confidentiality, integrity, and availability of the affected system.
CVE-2026-86562 is a race condition vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It involves a time-of-check to time-of-use (TOCTOU) double-fetch of control-queue descriptors, which can lead to a heap buffer overflow with attacker-controlled data in the VDUSE control-queue handler. The vulnerability has a high severity score of 7.8 and impacts confidentiality, integrity, and availability. No affected versions or patch information are explicitly stated in the provided data.
CVE-2026-86561 is a vulnerability in the DPDK lib/vhost component of Red Hat Fast Datapath for RHEL 10. It involves improper validation of memory size before mmap during vhost memory-region setup, which can cause a host crash or memory corruption. The vulnerability has a CVSS score of 6.5 and is classified as medium severity. No affected versions or patch information are explicitly provided in the available data. The vendor advisory is available but does not specify remediation details in the provided input.
CVE-2026-93683 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the DPDK vhost library used by Red Hat Fast Datapath for RHEL 10. The flaw involves multiple reads of the virtio indirect descriptor table length from guest memory before validation, allowing a guest to manipulate the length between reads. This can cause the host vhost process to access memory beyond the validated mapping, potentially crashing or disrupting the process. The issue is a residual problem related to a previous fix (CVE-2018-1059) in the indirect descriptor copy path.
Red Hat OpenShift Logging 6.5.3 addresses multiple security issues including a high severity denial of service vulnerability (CVE-2026-18140) caused by uncontrolled recursion with deeply nested JSON in the goose package. This logging solution manages logs cluster-wide for OpenShift. The update improves stability and security by fixing this and other bugs.
A security update addresses an out-of-bounds read and write vulnerability in the libpcap library, which is used for low-level network monitoring. This vulnerability (CVE-2026-0799) allows arbitrary memory access. The issue affects multiple Red Hat Enterprise Linux 10 and related CodeReady Linux Builder products across various architectures. Red Hat has released an important security advisory with updated libpcap packages to fix this vulnerability.
CVE-2026-109968 is a vulnerability in Red Hat Enterprise Linux 10 where the clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created with permissions that make it world-readable under the default process umask. This allows a local attacker to read the log file and obtain the LUKS passphrase, potentially compromising disk encryption.
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
CVE-2026-104795 is a high-severity vulnerability in Red Hat OpenShift Container Platform 4.21 where the insights-runtime-extractor DaemonSet runs with unnecessary privileges. It executes workload-controlled binaries with retained root privileges, allowing an attacker who can schedule a pod to escalate privileges to full root on the node. This occurs because the process changes only the effective UID, leaving real and saved UIDs at 0, and executes the workload's own binary with root privileges in the host namespace. A fix is available in OpenShift Container Platform 4.21.39.
CVE-2026-100229 is an out-of-bounds write vulnerability in the GStreamer H.266 codec parser library (libgstcodecparsers) on Red Hat Enterprise Linux 10. The flaw occurs in the DCI parsing function, where a reserved field value is improperly accepted, leading to memory corruption. Exploitation requires a specially crafted H.266 bitstream provided to a third-party application using this library API. No standard GStreamer pipeline element currently triggers the vulnerable code path. The vulnerability has a medium severity with a CVSS score of 6.5.