Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.19.47. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHBA-2026:66369

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry
on expiry (CVE-2026-43114)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.19 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.19.47 bug fix and security update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

* kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

* kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

* kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

* kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

* kernel: packet: use consistent hard_header_len in non-ring send paths ()

Bug Fix(es) and Enhancement(s):

* RT scheduler livelock caused by missing backport of 94894c9c477e (JIRA:RHEL-244407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

* kernel: rxrpc: Fix potential UAF after skb_unshare() failure (CVE-2026-45998)

* kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)

* kernel: Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CVE-2026-46056)

* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)

* kernel: ipv6: fix possible UAF in icmpv6_rcv() (CVE-2026-53006)

* kernel: Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CVE-2026-53071)

* kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info() (CVE-2026-53196)

* kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode (CVE-2026-63886)

* kernel: crypto: qat - validate RSA CRT component lengths (CVE-2026-64304)

* kernel: packet: use consistent hard_header_len in non-ring send paths ()

Bug Fix(es) and Enhancement(s):

* RT scheduler livelock caused by missing backport of 94894c9c477e (JIRA:RHEL-244407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.20.38. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2026:66375

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry
on expiry (CVE-2026-43114)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.20 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.20.38 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.21.33. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/RHSA-2026:66350

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/release_notes/

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry
on expiry (CVE-2026-43114)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.21 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.21.33 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.13. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHSA-2026:63091

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

Security Fix(es):

* kernel: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (CVE-2026-43114)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Security Advisory: OpenShift Container Platform 4.22.13 bug fix and security update

linux-hwe-edge

linux-aws-5.0

linux-aws-5.3

linux-azure

linux-azure-5.3

linux-azure-edge

linux-gcp

linux-gcp-5.3

linux-gke-4.15

linux-gke-5.4

linux-gkeop-5.4

linux-hwe

linux-oem

linux-oracle-5.0

linux-oracle-5.3

linux-aws-5.11

linux-aws-5.13

linux-aws-5.15

linux-aws-5.8

linux-azure-5.11

linux-azure-5.13

linux-azure-5.15

linux-azure-5.8

linux-azure-fde

linux-azure-fde-5.15

linux-gcp-5.11

linux-gcp-5.13

linux-gcp-5.15

linux-gcp-5.8

linux-gke

linux-gke-5.15

linux-gkeop

linux-gkeop-5.15

linux-hwe-5.11

linux-hwe-5.13

linux-hwe-5.15

linux-hwe-5.8

linux-ibm-5.15

linux-intel-5.13

linux-intel-iotg-5.15

linux-lowlatency-hwe-5.15

linux-nvidia-tegra-5.15

linux-oem-5.10

linux-oem-5.13

linux-oem-5.14

linux-oem-5.6

linux-oracle-5.11

linux-oracle-5.13

linux-oracle-5.15

linux-oracle-5.8

linux-raspi2

linux-riscv

linux-riscv-5.11

linux-riscv-5.15

linux-riscv-5.8

linux

linux-allwinner-5.19

linux-aws

linux-aws-5.19

linux-aws-6.2

linux-aws-6.5

linux-aws-6.8

linux-azure-5.19

linux-azure-6.2

linux-azure-6.5

linux-azure-6.8

linux-azure-fde-5.19

linux-azure-fde-6.2

linux-azure-fde-6.8

linux-gcp-5.19

linux-gcp-6.2

linux-gcp-6.5

linux-gcp-6.8

linux-hwe-5.19

linux-hwe-6.2

linux-hwe-6.5

linux-hwe-6.8

linux-ibm

linux-ibm-6.8

linux-intel-iot-realtime

linux-intel-iotg

linux-kvm

linux-lowlatency

linux-lowlatency-hwe-5.19

linux-lowlatency-hwe-6.2

linux-lowlatency-hwe-6.5

linux-lowlatency-hwe-6.8

linux-nvidia

linux-nvidia-6.2

linux-nvidia-6.5

linux-nvidia-6.8

linux-nvidia-tegra

linux-nvidia-tegra-igx

linux-oem-5.17

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry New test case fails unexpectedly when avx2 matching functions are used. The test first loads a ranomly generated pipapo set with 'ipv4 . port' key, i.e.  nft -f foo. This works.  Then, it reloads the set after a flush: (echo flush set t s; cat foo) | nft -f - This is expected to work, because its the same set after all and it was already loaded once. But with avx2, this fails: nft reports a clashing element. The reported clash is of following form:     We successfully re-inserted       a . b       c . d Then we try to insert a . d avx2 finds the already existing a . d, which (due to 'flush set') is marked as invalid in the new generation.  It skips the element and moves to next. Due to incorrect masking, the skip-step finds the next matching element *only considering the first field*, i.e. we return the already reinserted "a . b", even though the last field is different and the entry should not have been matched. No such error is reported for the generic c implementation (no avx2) or when the last field has to use the 'nft_pipapo_avx2_lookup_slow' fallback. Bisection points to 7711f4bb4b36 ("netfilter: nft_set_pipapo: fix range overlap detection") but that fix merely uncovers this bug. Before this commit, the wrong element is returned, but erronously reported as a full, identical duplicate. The root-cause is too early return in the avx2 match functions. When we process the last field, we should continue to process data until the entire input size has been consumed to make sure no stale bits remain in the map.

CVE-2026-43114: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry in Linux kernel

CVE-2026-43114 is a critical vulnerability in the Linux kernel's netfilter component affecting the nft_set_pipapo_avx2 AVX2 matching functions. The flaw causes incorrect matching behavior when reloading a pipapo set with an 'ipv4 . port' key, leading to erroneous identification of non-matching entries as duplicates. This can result in data integrity issues and unexpected network filtering behavior. The issue is fixed in later kernel versions after 5.7. No known exploits are reported in the wild.

Search: CVE-2026-43114