RHSA-2026:21695

Vulnerability from csaf_redhat - Published: 2026-06-04 17:00 - Updated: 2026-07-09 17:55
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.12.91 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.12.91 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.91. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:21694 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes Security Fix(es): None For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-9714

A flaw was found in libxstl/libxml2. The 'exsltDynMapFunction' function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling 'dyn:map()', leading to stack exhaustion and a local denial of service.

6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-606 - Unchecked Input for Loop Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Workaround
Threats
Impact Moderate
CVE-2026-3497

A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-824 - Access of Uninitialized Pointer
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-27135

A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-617 - Reachable Assertion
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-35535

A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.

7.4 (High)
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-272 - Least Privilege Violation
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Threats
Impact Important
CVE-2026-43284

A flaw was found in the Linux kernel's xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-123 - Write-what-where Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-43503

A flaw was found in the Linux kernel's networking (skbuff) component. When skb_try_coalesce() attaches paged fragments, it can lose the SKBFL_SHARED_FRAG marker. This can lead to the Encapsulating Security Payload (ESP) input decrypting data in place over page-cache backed fragments, potentially resulting in data corruption.

7.0 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-664 - Improper Control of a Resource Through its Lifetime
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-46300

A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-123 - Write-what-where Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: 8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0 —
Vendor Fix fix
Workaround
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:21695 self
https://access.redhat.com/security/updates/classi… external
https://bugzilla.redhat.com/show_bug.cgi?id=2392605 external
https://bugzilla.redhat.com/show_bug.cgi?id=2447085 external
https://bugzilla.redhat.com/show_bug.cgi?id=2448754 external
https://bugzilla.redhat.com/show_bug.cgi?id=2454714 external
https://bugzilla.redhat.com/show_bug.cgi?id=2467771 external
https://bugzilla.redhat.com/show_bug.cgi?id=2477015 external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-9714 self
https://bugzilla.redhat.com/show_bug.cgi?id=2392605 external
https://www.cve.org/CVERecord?id=CVE-2025-9714 external
https://nvd.nist.gov/vuln/detail/CVE-2025-9714 external
https://gitlab.gnome.org/GNOME/libxml2/-/commit/6… external
https://gitlab.gnome.org/GNOME/libxslt/-/issues/148 external
https://access.redhat.com/security/cve/CVE-2026-3497 self
https://bugzilla.redhat.com/show_bug.cgi?id=2447085 external
https://www.cve.org/CVERecord?id=CVE-2026-3497 external
https://nvd.nist.gov/vuln/detail/CVE-2026-3497 external
https://ubuntu.com/security/CVE-2026-3497 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-27135 self
https://bugzilla.redhat.com/show_bug.cgi?id=2448754 external
https://www.cve.org/CVERecord?id=CVE-2026-27135 external
https://nvd.nist.gov/vuln/detail/CVE-2026-27135 external
https://github.com/nghttp2/nghttp2/commit/5c7df8f… external
https://github.com/nghttp2/nghttp2/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-35535 self
https://bugzilla.redhat.com/show_bug.cgi?id=2454714 external
https://www.cve.org/CVERecord?id=CVE-2026-35535 external
https://nvd.nist.gov/vuln/detail/CVE-2026-35535 external
https://bugs.debian.org/1130593 external
https://bugs.launchpad.net/ubuntu/+source/sudo/+b… external
https://github.com/sudo-project/sudo/commit/3e474… external
https://www.qualys.com/2026/03/10/crack-armor.txt external
https://access.redhat.com/security/cve/CVE-2026-43284 self
https://bugzilla.redhat.com/show_bug.cgi?id=2467771 external
https://access.redhat.com/security/vulnerabilitie… external
https://www.cve.org/CVERecord?id=CVE-2026-43284 external
https://nvd.nist.gov/vuln/detail/CVE-2026-43284 external
https://dirtyfrag.io/ external
https://access.redhat.com/security/cve/CVE-2026-43503 self
https://bugzilla.redhat.com/show_bug.cgi?id=2480902 external
https://www.cve.org/CVERecord?id=CVE-2026-43503 external
https://nvd.nist.gov/vuln/detail/CVE-2026-43503 external
https://git.kernel.org/pub/scm/linux/security/vul… external
https://access.redhat.com/security/cve/CVE-2026-46300 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477015 external
https://www.cve.org/CVERecord?id=CVE-2026-46300 external
https://nvd.nist.gov/vuln/detail/CVE-2026-46300 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift Container Platform release 4.12.91 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nThis release includes a security update for Red Hat OpenShift Container\nPlatform 4.12.\n\nRed Hat Product Security has rated this update as having a security impact\nof  Low. A Common Vulnerability Scoring System (CVSS) base score, which\ngives a detailed severity rating, is available for each vulnerability from\nthe CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.12.91. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHBA-2026:21694\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nSecurity Fix(es):\n\nNone\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:21695",
        "url": "https://access.redhat.com/errata/RHSA-2026:21695"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2392605",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392605"
      },
      {
        "category": "external",
        "summary": "2447085",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
      },
      {
        "category": "external",
        "summary": "2448754",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
      },
      {
        "category": "external",
        "summary": "2454714",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
      },
      {
        "category": "external",
        "summary": "2467771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467771"
      },
      {
        "category": "external",
        "summary": "2477015",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477015"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21695.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.12.91 bug fix and security update",
    "tracking": {
      "current_release_date": "2026-07-09T17:55:49+00:00",
      "generator": {
        "date": "2026-07-09T17:55:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.2"
        }
      },
      "id": "RHSA-2026:21695",
      "initial_release_date": "2026-06-04T17:00:30+00:00",
      "revision_history": [
        {
          "date": "2026-06-04T17:00:30+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-04T17:00:30+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-09T17:55:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.12",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.12",
                  "product_id": "8Base-RHOSE-4.12",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.12::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhcos-x86_64-412.86.202605271418-0",
                "product": {
                  "name": "rhcos-x86_64-412.86.202605271418-0",
                  "product_id": "rhcos-x86_64-412.86.202605271418-0",
                  "product_identification_helper": {
                    "purl": "pkg:generic/redhat/rhcos@412.86.202605271418?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhcos-x86_64-412.86.202605271418-0 as a component of Red Hat OpenShift Container Platform 4.12",
          "product_id": "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        },
        "product_reference": "rhcos-x86_64-412.86.202605271418-0",
        "relates_to_product_reference": "8Base-RHOSE-4.12"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-9714",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2025-09-02T13:03:56.452000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2392605"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libxstl/libxml2. The \u0027exsltDynMapFunction\u0027 function in libexslt/dynamic.c does not contain a recursion depth check, which may cause an infinite loop via a specially crafted XSLT document while handling \u0027dyn:map()\u0027, leading to stack exhaustion and a local denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "No evidence was found for arbitrary memory corruption through this flaw, limiting its impact to Availability only, and reducing its severity to Moderate.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-9714"
        },
        {
          "category": "external",
          "summary": "RHBZ#2392605",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2392605"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-9714",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-9714"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9714"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21",
          "url": "https://gitlab.gnome.org/GNOME/libxml2/-/commit/677a42645ef22b5a50741bad5facf9d8a8bc6d21"
        },
        {
          "category": "external",
          "summary": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/148",
          "url": "https://gitlab.gnome.org/GNOME/libxslt/-/issues/148"
        }
      ],
      "release_date": "2025-09-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        },
        {
          "category": "workaround",
          "details": "The impact of this flaw may be reduced by setting strict resource limits to the stack size of processes at the operational system level. This can be achieved either through the \u0027ulimit\u0027 shell built-in or the \u0027limits.conf\u0027 file.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "libxslt: libxml2: Inifinite recursion at exsltDynMapFunction function in libexslt/dynamic.c"
    },
    {
      "cve": "CVE-2026-3497",
      "cwe": {
        "id": "CWE-824",
        "name": "Access of Uninitialized Pointer"
      },
      "discovery_date": "2026-03-12T19:01:37.007806+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447085"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "IMPORTANT: This vulnerability affects the OpenSSH GSSAPI delta as implemented in Red Hat Enterprise Linux and OpenShift Container Platform. An unauthenticated attacker could send a specially crafted GSSAPI message during key exchange, leading to the use of uninitialized variables and potentially undefined behavior. The severity of the impact is dependent on compiler hardening configurations.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447085",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447085"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-3497",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://ubuntu.com/security/CVE-2026-3497",
          "url": "https://ubuntu.com/security/CVE-2026-3497"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/03/12/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/03/12/3"
        }
      ],
      "release_date": "2026-03-12T18:27:44.917000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability\u0027s attack surface.\n\nEdit `/etc/ssh/sshd_config` and add or modify the line:\n```\nGSSAPIKeyExchange no\n```\n\nAfter saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.\n\n```\n# systemctl restart sshd\n```",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "openssh: OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables"
    },
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "discovery_date": "2026-03-18T19:02:13.823002+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448754"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448754",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448754"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-27135",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27135"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1",
          "url": "https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"
        },
        {
          "category": "external",
          "summary": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6",
          "url": "https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"
        }
      ],
      "release_date": "2026-03-18T17:59:02.045000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination"
    },
    {
      "cve": "CVE-2026-35535",
      "cwe": {
        "id": "CWE-272",
        "name": "Least Privilege Violation"
      },
      "discovery_date": "2026-04-03T03:01:03.124541+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454714"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454714",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454714"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35535",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35535"
        },
        {
          "category": "external",
          "summary": "https://bugs.debian.org/1130593",
          "url": "https://bugs.debian.org/1130593"
        },
        {
          "category": "external",
          "summary": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042",
          "url": "https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/2143042"
        },
        {
          "category": "external",
          "summary": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69",
          "url": "https://github.com/sudo-project/sudo/commit/3e474c2f201484be83d994ae10a4e20e8c81bb69"
        },
        {
          "category": "external",
          "summary": "https://www.qualys.com/2026/03/10/crack-armor.txt",
          "url": "https://www.qualys.com/2026/03/10/crack-armor.txt"
        }
      ],
      "release_date": "2026-04-03T02:21:33.584000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "sudo: Sudo: Privilege escalation due to failure in privilege drop calls"
    },
    {
      "cve": "CVE-2026-43284",
      "cwe": {
        "id": "CWE-123",
        "name": "Write-what-where Condition"
      },
      "discovery_date": "2026-05-07T15:56:04.044000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2467771"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires unprivileged user or network namespace creation, while the RxRPC variant depends on the rxrpc module being available on the target system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel\u0027s xfrm-ESP and RxRPC subsystems to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43284"
        },
        {
          "category": "external",
          "summary": "RHBZ#2467771",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467771"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43284",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43284"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43284",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43284"
        },
        {
          "category": "external",
          "summary": "https://dirtyfrag.io/",
          "url": "https://dirtyfrag.io/"
        }
      ],
      "release_date": "2026-05-07T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: \"Dirty Frag\" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel"
    },
    {
      "cve": "CVE-2026-43503",
      "cwe": {
        "id": "CWE-664",
        "name": "Improper Control of a Resource Through its Lifetime"
      },
      "discovery_date": "2026-05-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480902"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s networking (skbuff) component. When skb_try_coalesce() attaches paged fragments, it can lose the SKBFL_SHARED_FRAG marker. This can lead to the Encapsulating Security Payload (ESP) input decrypting data in place over page-cache backed fragments, potentially resulting in data corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Impact is rated as Important because the privileged file-backed cache pages may be modified through a shared-page ownership bypass. Within Red Hat Enterprise Linux and Red Hat OpenShift Container Platform, this vulnerability was fixed at the same time as CVE-2026-46300.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-43503"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480902",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480902"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-43503",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-43503"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43503",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43503"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43503.mbox",
          "url": "https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43503.mbox"
        }
      ],
      "release_date": "2026-05-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers"
    },
    {
      "cve": "CVE-2026-46300",
      "cwe": {
        "id": "CWE-123",
        "name": "Write-what-where Condition"
      },
      "discovery_date": "2026-05-13T13:28:21.270000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477015"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Linux kernel\u0027s XFRM ESP-in-TCP subsystem. Unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files, including sensitive system files. An attacker can exploit this to overwrite privileged binaries and gain root privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel\u0027s XFRM ESP-in-TCP subsystem to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-46300"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477015",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477015"
        },
        {
          "category": "external",
          "summary": "RHSB-2026-003",
          "url": "https://access.redhat.com/security/vulnerabilities/RHSB-2026-003"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-46300",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-46300"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300"
        }
      ],
      "release_date": "2026-05-13T12:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-04T17:00:30+00:00",
          "details": "For OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 architecture)\n      The image digest is sha256:3701cb0c9cd5c3123709a9ec33af15b4c6fe414f62b316a27cbbc07f5857a869\n\nAll OpenShift Container Platform 4.12 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:21695"
        },
        {
          "category": "workaround",
          "details": "See the security bulletin for a detailed mitigation procedure.",
          "product_ids": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHOSE-4.12:rhcos-x86_64-412.86.202605271418-0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: \"Fragnesia\" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.