Threats Tagged 'cve-2026-43329'

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.57. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:60018 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/ Security Fix(es): * kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources (CVE-2025-10263) * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * samba: Remote Code Execution in SAMR (CVE-2026-4408) * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845) * gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability (CVE-2026-42009) * gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * icu: Stack buffer overflow in the SRBRoot::addTag function (CVE-2025-5222) * kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (CVE-2025-40026) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260) * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011) * gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.17 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html-single/updating_clusters/index#updating-cluster-cli.

This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-570.17.1.el9_6. Security Fix(es): * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-6.12.0-211.16.1.el10_2. Security Fix(es): * kernel: rxrpc: Fix RxGK token loading to check bounds (CVE-2026-31641) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) * kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle (CVE-2026-64530) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) Bug Fix(es) and Enhancement(s): * xfs corruption from [xfs_trans_cancel] during inode allocation [rhel-10.0.z] (JIRA:RHEL-142606) * [RFE] Requesting FOU and GUE/GRE support in RHEL 10 [rhel-10.0.z] (JIRA:RHEL-144983) * "Send error in SessSetup" messages fill up the logs [rhel-10.0.z] (JIRA:RHEL-145510) * Host kernel panics with "unexpected #NM exception" at restore_fpregs_from_fpstate [rhel-10.0.z] (JIRA:RHEL-148634) * blktests throtl/001 failed [rhel-10.0.z] (JIRA:RHEL-180588) * RHEL 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.0.z] (JIRA:RHEL-188179) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: libceph: make decode_pool() more resilient against corrupted osdmaps (CVE-2025-71116) * kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CVE-2026-22990) * kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613) * kernel: xen/privcmd: fix double free via VMA splitting (CVE-2026-31787) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: ipc: limit next_id allocation to the valid ID range (CVE-2026-52923) * kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976) Bug Fix(es) and Enhancement(s): * xfs corruption from [xfs_trans_cancel] during inode allocation [rhel-10.0.z] (JIRA:RHEL-142606) * [RFE] Requesting FOU and GUE/GRE support in RHEL 10 [rhel-10.0.z] (JIRA:RHEL-144983) * "Send error in SessSetup" messages fill up the logs [rhel-10.0.z] (JIRA:RHEL-145510) * Host kernel panics with "unexpected #NM exception" at restore_fpregs_from_fpstate [rhel-10.0.z] (JIRA:RHEL-148634) * blktests throtl/001 failed [rhel-10.0.z] (JIRA:RHEL-180588) * RHEL 10: s390: Revert support for DCACHE_WORD_ACCESS [rhel-10.0.z] (JIRA:RHEL-188179) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation (CVE-2026-23270) * kernel: netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CVE-2026-23455) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) Bug Fix(es) and Enhancement(s): * NVMe-FC: Panic during NVMe Controller Reset tests (JIRA:RHEL-178449) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CVE-2025-21648) * kernel: cachestat: fix page cache statistics permission checking (CVE-2025-21691) * kernel: ALSA: aloop: Fix racy access at PCM trigger (CVE-2026-23191) * kernel: mptcp: fix slab-use-after-free in __inet_lookup_established (CVE-2026-31669) * kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027) * kernel: RDMA/umem: Fix double dma_buf_unpin in failure path (CVE-2026-43128) * kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198) * kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: scsi: qla2xxx: Completely fix fcport double free (CVE-2026-43414) * kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852) * kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) * kernel: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CVE-2026-46227) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) * kernel: exit: prevent preemption of oopsing TASK_DEAD task (CVE-2026-46173) * kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync (CVE-2026-46244) Bug Fix(es) and Enhancement(s): * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.6.z] (JIRA:RHEL-172991) * [rhel-9] WARNING: possible recursive locking detected - vmd_enable_domain+0x757/0x910 [rhel-9.6.z] (JIRA:RHEL-174469) * RHEL9.4 - s390/mm: Add missing secure storage access fixups [rhel-9.6.z] (JIRA:RHEL-183316) * drm/mgag200: 300 ms busy loop [rhel-9.6.z] (JIRA:RHEL-150177) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) Bug Fix(es) and Enhancement(s): * Backport Zen5 IFUNC changes to prefer AVX512/EVEX?512 string implementations on RHEL 10 [rhel-10] (JIRA:RHEL-174869) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * [RHEL-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:RHEL-169057) * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.8.z] (JIRA:RHEL-172993) * nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [rhel-9.8.z] (JIRA:RHEL-178273) * sched/fair: Skip sched_balance_running cmpxchg when balance is not due [rhel-9.8.z] (JIRA:RHEL-182776) * [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [rhel-9.8.z] (JIRA:RHEL-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm/amd/display: Do not skip unrelated mode changes in DSC validation (CVE-2026-31488) * kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (CVE-2026-43038) * kernel: netfilter: flowtable: strictly check for maximum number of actions (CVE-2026-43329) * kernel: ALSA: aloop: Fix peer runtime UAF during format-change stop (CVE-2026-46090) * kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054) * kernel: RDMA/iwcm: Fix workqueue list corruption by removing work_list (CVE-2026-45898) * kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189) * kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CVE-2026-46176) Bug Fix(es) and Enhancement(s): * [RHEL-9.8.z]: Update the mlx5 drivers to v6.19 (JIRA:RHEL-169057) * iavf: during POD churn vlan filters may not be added for a vlan interface, spoofchk drops subsequent packets [rhel-9.8.z] (JIRA:RHEL-172993) * nf_conntrack_sctp: vtag corruption with late INIT in ESTABLISHED state across conntrack zones [rhel-9.8.z] (JIRA:RHEL-178273) * sched/fair: Skip sched_balance_running cmpxchg when balance is not due [rhel-9.8.z] (JIRA:RHEL-182776) * [REGRESSION] ISST-Spyre: Jenkins workload causes soft lock warning to appear on screen. Workload hangs. [rhel-9.8.z] (JIRA:RHEL-183183) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.