The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)
* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
Bug Fix(es) and Enhancement(s):
* xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A buffer overflow vulnerability (CVE-2025-68347) was identified and fixed in the Linux kernel ALSA firewire-motu driver affecting the hwdep_read() function for DSP events. The flaw allowed writing more bytes to a user buffer than requested if the buffer was smaller than the event header size. Red Hat released a security update for Red Hat Enterprise Linux 8.6 and related variants to address this issue. The update clamps the copy size to the user-requested length, preventing the overflow. The fix is part of a broader kernel security update addressing multiple vulnerabilities. A system reboot is required after applying the update for the fix to take effect.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions (CVE-2026-55655)
* openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)
* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)
* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)
* openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A heap buffer overflow vulnerability (CVE-2026-39919) exists in Ghostscript's JPEG 2000 output adapter. This issue affects various Red Hat Enterprise Linux 8 distributions and related packages. The vulnerability is rated as medium severity. Red Hat has released a security update to address this flaw in Ghostscript version 9.27-18.el8_10. The update mitigates the risk by fixing the heap buffer overflow. No known exploits are reported in the wild at this time.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* cpython: Python HTMLParser quadratic complexity (CVE-2025-6069)
* python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
* python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)
* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple vulnerabilities were identified in libevent versions prior to 2.1.13 and 2.2.2-a affecting various Ubuntu LTS releases from 14.04 through 26.04. These include use-after-free issues leading to denial of service or arbitrary code execution, HTTP request smuggling, out-of-bounds reads, resource exhaustion, and inconsistent HTTP message interpretation that could bypass security restrictions. Fixes have been released and are available through standard system updates or Ubuntu Pro for extended support versions.
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databind has case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
- Update to 2.18.8
* No changes since 2.17.3
Changes for jackson-core:
- Update to 2.18.8
* Changes of 2.18.8
+ #1611: Apply number-length validator on streaming integer path
of async parser
* Changes of 2.18.7
+ #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
+ #1600: Rework 3rd party licenses in jar
+ #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
* Changes of 2.18.6
+ #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
+ #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
+ #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
* Changes of 2.18.5
+ #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
+ #1446: Invalid package reference to "java.lang.foreign" from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
* Changes of 2.18.3
+ #1391: Fix issue where the parser can read back old number
state when parsing later numbers
+ #1397: Jackson changes additional values to infinite in case
of special JSON structures and existing infinite values
+ #1398: Fix issue that feature
COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
characterEscape is used
* Changes of 2.18.2
+ #1359: Non-surrogate characters being incorrectly combined
when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
enabled
* Changes of 2.18.1
+ #1353: Use fastdoubleparser 1.0.90
* Changes of 2.18.
+ #223: 'UTF8JsonGenerator' writes supplementary characters as a
surrogate pair: should use 4-byte encoding
+ #1230: Improve performance of 'float' and 'double' parsing
from 'TextBuffer'
+ #1251: 'InternCache' replace synchronized with 'ReentrantLock'
- the cache size limit is no longer strictly enforced for
performance reasons but we should never go far about the limit
+ #1252: 'ThreadLocalBufferManager' replace synchronized with
'ReentrantLock'
+ #1257: Increase InternCache default max size from 100 to 200
+ #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
+ #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
classes to prevent use by downstream consumers
+ #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
from 3.0)
+ #1274: 'NUL'-corrupted keys, values on JSON serialization
+ #1277: Add back Java 22 optimisation in FastDoubleParser
+ #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
/getDecimalValue()' to avoid String allocation
+ #1305: Make helper methods of 'WriterBasedJsonGenerator'
non-final to allow overriding
+ #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
limit maximum number of Tokens allowed per document#
+ #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
decoding proble
Changes for jackson-databind:
- Update to 2.18.8
* Changes of 2.18.8
+ #5950: Improve 'UUIDeserializer' error handling
+ #5951: Improve 'InetSocketAddress' deserialization
(bsc#1268899, CVE-2026-54514)
+ #5969: '@JsonView' by-passed for some "setterless" creator
properties
+ #5971: '@JsonView' by-passed for unwrapped creator parameters
+ #5974: '@JsonIgnore' on Record property ignored with
'PropertyNamingStrategy'
+ #5981: 'BasicPolymorphicTypeValidator' setting
'allowIfSubTypeIsArray()' should validate element type
(bsc#1268898, CVE-2026-54513)
+ #5988: 'PolymorphicTypeValidator' needs to validate generic
type parameters too (bsc#1268897, CVE-2026-54512)
+ #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
fold case using JVM default locale (Turkish-I bug)
* Changes of 2.18.4
+ #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
Record property ignored for deserialization
+ #5049: Duplicate creator property "b" (index 0 vs 1) on simple
java record
* Changes of 2.18.3
+ #4444: The 'KeyDeserializer' specified in the class with
'@JsonDeserialize(keyUsing = ...)' is overwritten by the
'KeyDeserializer' specified in the 'ObjectMapper'.
+ #4827: Subclassed Throwable deserialization fails since
v2.18.0 - no creator index for property 'cause'
+ #4844: Fix wrap
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS).
A denial of service vulnerability exists in the Golang crypto/tls package used by Red Hat OpenShift Virtualization v4.21 images. The issue involves indefinite KeyUpdate messages that can cause service disruption. Red Hat has released OpenShift Container Platform 4.21.34 with updated packages and images that address this vulnerability. Users of OpenShift Container Platform 4.21 are advised to upgrade to these versions to remediate the issue.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CVE-2026-64034)
* kernel: dm-integrity: don't increment hash_offset twice (CVE-2026-72099)
Bug Fix(es) and Enhancement(s):
* gve: backport large queue depth patches [rhel-10.2.z] (JIRA:RHEL-219261)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A high-severity vulnerability (CVE-2026-76561) affects the pki-core:10.6 module in Red Hat Enterprise Linux 8. The issue involves the certprofile-import component of Dogtag/PKI, which allows code execution via unsanitized profile content, categorized under CWE-78 (command injection). Red Hat has issued an important security advisory with an update to address this vulnerability. No known exploits in the wild have been reported. The update is available for multiple Red Hat Enterprise Linux 8 variants and architectures.
A high severity vulnerability (CVE-2026-22984) in the Linux kernel's libceph component was resolved by adding explicit bounds checking to prevent potential out-of-bounds reads in the handle_auth_done() function. This vulnerability could lead to serious impacts including confidentiality, integrity, and availability violations. The issue affects multiple Linux kernel versions prior to specific patched releases. Ubuntu has released security updates addressing this and numerous other kernel vulnerabilities. Users are advised to update to the fixed kernel versions and reboot their systems. Due to ABI changes, recompilation of third-party kernel modules may be necessary.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana12.4 package to address multiple security vulnerabilities identified by CVE identifiers including CVE-2026-101903 and CVE-2026-93450. The advisory provides updated RPM packages for the aarch64 and x86_64 architectures. No explicit affected versions are detailed in the advisory. The update is classified as a security fix and is available via Red Hat's official channels.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically addressing vulnerabilities in the grafana12.4 package. The update fixes CVE-2026-93981, which affects versions prior to 12.4.10-0.10.hum1. No explicit CVSS score is provided, but the severity is assessed as high. The advisory includes updated RPMs for aarch64 and x86_64 architectures. No known exploits are reported in the wild, and no official fix beyond the update is mentioned.
Red Hat has issued a security update for Red Hat Hardened Images RPMs addressing a vulnerability identified as CVE-2026-17084 in python3.10 packages. The update includes multiple python3.10-related RPMs for aarch64 and x86_64 architectures. No specific details about the nature of the vulnerability or its exploitation are provided. The severity is assessed as medium.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-6.12.0-211.16.1.el10_2.
Security Fix(es):
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing high severity vulnerabilities identified by CVE-2026-94603 and CVE-2026-79705. The update affects several podman-related packages including podman, podman-docker, podman-machine, podman-remote, and podmansh. The advisory does not provide detailed technical information about the vulnerabilities but classifies them as high severity. Updated RPMs version 6.1.3-1.hum1 are available for affected architectures. No explicit patch version range is provided, but the advisory indicates that the update resolves the issues. No known exploits in the wild have been reported.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple updated httpd-related packages. This update addresses several security issues identified by multiple CVEs. The advisory provides updated RPM versions for aarch64 and x86_64 architectures but does not specify detailed vulnerability descriptions or affected versions. The advisory indicates a high severity level and provides updated packages to remediate the issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CVE-2026-45856)
* kernel: KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CVE-2026-63794)
* kernel: futex: Fix race on the initial mm->futex.phash.ref allocation (CVE-2026-80775)
Bug Fix(es) and Enhancement(s):
* Backport of protocol attribute to IP addresses (IFA_PROTO) [rhel-9.8.z] (JIRA:RHEL-169936)
* try_charge_memcg() refactor in kernel 5.14.0-687.36.1 causes premature memcg OOM with GiB of clean page cache present [rhel-9.8.z] (JIRA:RHEL-269060)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.