Threat database

CVE-2026-88842 is a low-severity vulnerability in BusyBox's dpkg component used in Red Hat Hardened Images. The issue occurs because the write_status_file() function does not reset a field cursor between package stanzas, which can cause the second package stanza to be dropped from the status file when removing two packages in a single operation if the first stanza is larger. This results in limited data corruption but no direct impact on confidentiality, availability, or privilege escalation.

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.

CVE-2026-109970 is a medium severity vulnerability in Red Hat Enterprise Linux 10 involving the clevis PKCS#11 pin handling. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file with world-readable permissions due to the default umask. Additionally, the PIN file may not be cleaned up if the decryption script exits prematurely, leaving sensitive information accessible indefinitely.

CVE-2026-109969 is a vulnerability in the clevis PKCS#11 pin component of Red Hat Enterprise Linux 10. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without enforcing permission restrictions or verifying peer credentials. This allows any local user, under permissive process umask settings, to connect to the control socket and inject arbitrary device or key pairs, or connect to the data socket to receive LUKS passphrases. The vulnerability has a medium severity with a CVSS score of 4.7.

CVE-2026-100231 is a medium severity vulnerability in the GStreamer ASF muxer plugin used in Red Hat Enterprise Linux 10. The flaw causes an out-of-bounds heap write when writing Unicode metadata tags containing non-Basic Multilingual Plane characters (e.g., emoji) to ASF containers. This occurs due to incorrect buffer size calculation for UTF-16LE encoding, potentially leading to denial of service or limited memory corruption.

CVE-2026-88829 is a vulnerability in BusyBox httpd's reverse proxy feature used in Red Hat Hardened Images. The flaw causes only the first HTTP request on a TCP connection to have its path rewritten, allowing subsequent pipelined requests to bypass path restrictions and access unintended backend paths.

CVE-2026-90954 is a high-severity vulnerability in BusyBox's dpkg-deb archive extraction used in Red Hat Hardened Images. It involves improper link resolution before file access during extraction of specially crafted .deb packages. An attacker can exploit the handling of deferred symlinks to write arbitrary files outside the intended extraction directory, potentially leading to full compromise of confidentiality, integrity, and availability.

CVE-2026-86476 is a heap buffer overflow vulnerability in gst-plugins-base on Red Hat Enterprise Linux 10. It occurs when video buffers with GstVideoMeta metadata declare plane strides and offsets that exceed the actual memory allocation, leading to out-of-bounds writes. A local attacker controlling the sending side of a GStreamer IPC pipeline can exploit this flaw to cause denial of service or potentially execute code within the affected process.

Red Hat has issued a security advisory addressing vulnerabilities in the ffmpeg component used within the Red Hat Enterprise Linux AI 3.5 platform. The advisory fixes CVE-2026-8461 and others related to out-of-bounds reads and writes. These vulnerabilities affect internal RPM packages supported only as part of the Red Hat AI application platform. Updated ffmpeg packages are provided to remediate these issues.

Two high-severity vulnerabilities were identified in libsoup, an HTTP client/server library for GNOME. The first is a heap use-after-free triggered by a GOAWAY frame in the HTTP/2 client (CVE-2026-85197). The second is a heap buffer overflow in SoupSession caused by a crafted SETTINGS frame with an INITIAL_WINDOW_SIZE parameter (CVE-2026-85534). Both issues can lead to memory corruption. These vulnerabilities affect multiple versions of libsoup across various Linux distributions including Red Hat and Ubuntu. Fixes are available through official updates.

A security update for the rhc-worker-playbook component in Red Hat Enterprise Linux addresses a local privilege escalation vulnerability in the ansible.posix authorized_key module. The issue involves symlink-following during a chown operation, which could allow unauthorized privilege escalation. The update is rated as Important by Red Hat and affects Red Hat Enterprise Linux 8.8 variants. No CVSS score is provided for this vulnerability.

CVE-2026-110036 is an integer overflow or wraparound vulnerability in the device-mapper-persistent-data component of Red Hat Enterprise Linux 10. A local attacker can trigger a denial of service by causing a user or system tool to process crafted device metadata with an excessively large block index. This leads to an arithmetic error in synchronous block reading logic, causing the application to panic and terminate unexpectedly. The vulnerability has a low CVSS score of 3.3 and does not impact confidentiality or integrity.

A denial of service vulnerability (CVE-2026-84445) exists in the gRPC-Go library used by the rhc client tool and daemon in Red Hat Enterprise Linux 9. This flaw allows denial of service via malformed RPC requests. Red Hat has released updated rhc packages to address this issue across multiple architectures and variants of Red Hat Enterprise Linux 9. No known exploits are reported in the wild. The Helm CLI for Red Hat OpenShift v4.3.0 is unrelated to this vulnerability fix.

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

CVE-2026-88838 is a medium severity vulnerability in BusyBox's mount utility used in Red Hat Hardened Images. It allows a non-root user to bypass mount security restrictions configured in /etc/fstab by using clearing-mask options on the command line. These options bypass the non-root flag filter and override intended protections such as nosuid, nodev, and noexec when the combined options are re-parsed.

CVE-2026-88833 is an integer underflow vulnerability in the BusyBox udhcpc DHCP client used in Red Hat Hardened Images. The flaw occurs when the client processes raw DHCP packets and replaces the validated packet length with an attacker-controlled value from the IP header without re-validation. This leads to an integer underflow during header size subtraction, causing a memory copy operation with an excessively large length. An attacker on the same network segment can exploit this to crash the DHCP client, resulting in denial of service and loss of network connectivity.

CVE-2026-105460 is an out-of-bounds read vulnerability in the btmon Bluetooth monitor tool included with BlueZ on Red Hat Enterprise Linux 10. The flaw occurs when processing crafted HCI Return Link Keys events from a maliciously crafted btsnoop capture file, which can cause btmon to read beyond its allocated buffer and crash. This vulnerability has a medium severity rating and does not impact confidentiality or integrity but can cause a denial of service due to application crash.

Technology Preview features are not fully supported, may not be functionally complete, and are not suitable for deployment in production.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including multiple OpenSSH packages. This update addresses several vulnerabilities identified by multiple CVEs. The advisory provides updated RPM versions for various architectures. No explicit patch versions or affected versions are detailed in the advisory. The severity is assessed as medium.

CVE-2026-109976 is a medium severity vulnerability in Red Hat Enterprise Linux 10 involving an out-of-bounds write in the clevis PKCS#11 pin component. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in getpeername result handling. This crash causes a denial of service that prevents LUKS disk decryption from completing during system boot.