RHSA-2026:54581
Vulnerability from csaf_redhat - Published: 2026-08-18 12:08 - Updated: 2026-08-19 20:53Summary
Red Hat Security Advisory: OpenShift Container Platform 4.20.34 bug fix and security update
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.20.34 is now available with
updates to packages and images that fix several bugs and add enhancements.
This release includes a security update for Red Hat OpenShift Container
Platform 4.20.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.20.34. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:54580
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/
Security Fix(es):
* kernel: Arm Processors: Privilege escalation or information disclosure
via writes to higher exception level resources (CVE-2025-10263)
* samba: Missing access check on reparse point operations (CVE-2026-1933)
* sssd: sssd: sudo LDAP provider searches entire directory tree for
sudoRole objects by default, enabling privilege escalation (CVE-2026-14474)
* icu: Stack buffer overflow in the SRBRoot::addTag function
(CVE-2025-5222)
* kernel: KVM: x86: Don't (re)check L1 intercepts when completing userspace
I/O (CVE-2025-40026)
* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath
allows Kerberos authentication bypass (CVE-2026-14476)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.20 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
7.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise.
8.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
|
Threats
Impact
Important
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK>
5.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.
7.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
8.0 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: 9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
38 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Container Platform release 4.20.34 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\n This release includes a security update for Red Hat OpenShift Container\nPlatform 4.20.\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains the container images for Red Hat OpenShift Container\nPlatform 4.20.34. See the following advisory for the RPM packages for this\nrelease:\n\nhttps://access.redhat.com/errata/RHSA-2026:54580\n\nSpace precludes documenting all of the container images in this advisory.\nSee the following Release Notes documentation, which will be updated\nshortly for this release, for details about these changes:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nSecurity Fix(es):\n\n* kernel: Arm Processors: Privilege escalation or information disclosure\nvia writes to higher exception level resources (CVE-2025-10263)\n* samba: Missing access check on reparse point operations (CVE-2026-1933)\n* sssd: sssd: sudo LDAP provider searches entire directory tree for\nsudoRole objects by default, enabling privilege escalation (CVE-2026-14474)\n* icu: Stack buffer overflow in the SRBRoot::addTag function\n(CVE-2025-5222)\n* kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace\nI/O (CVE-2025-40026)\n* sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath\nallows Kerberos authentication bypass (CVE-2026-14476)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:54581",
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2368600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368600"
},
{
"category": "external",
"summary": "2406712",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
},
{
"category": "external",
"summary": "2447317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447317"
},
{
"category": "external",
"summary": "2486958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486958"
},
{
"category": "external",
"summary": "2496556",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496556"
},
{
"category": "external",
"summary": "2496581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496581"
},
{
"category": "external",
"summary": "OCPBUGS-58179",
"url": "https://issues.redhat.com/browse/OCPBUGS-58179"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54581.json"
}
],
"title": "Red Hat Security Advisory: OpenShift Container Platform 4.20.34 bug fix and security update",
"tracking": {
"current_release_date": "2026-08-19T20:53:18+00:00",
"generator": {
"date": "2026-08-19T20:53:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:54581",
"initial_release_date": "2026-08-18T12:08:13+00:00",
"revision_history": [
{
"date": "2026-08-18T12:08:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-18T12:08:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-19T20:53:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Container Platform 4.20",
"product": {
"name": "Red Hat OpenShift Container Platform 4.20",
"product_id": "9Base-RHOSE-4.20",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:4.20::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-aarch64-4.20.9.6.202608121719-0",
"product": {
"name": "rhcos-aarch64-4.20.9.6.202608121719-0",
"product_id": "rhcos-aarch64-4.20.9.6.202608121719-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.20.9.6.202608121719?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-ppc64le-4.20.9.6.202608121719-0",
"product": {
"name": "rhcos-ppc64le-4.20.9.6.202608121719-0",
"product_id": "rhcos-ppc64le-4.20.9.6.202608121719-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.20.9.6.202608121719?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-s390x-4.20.9.6.202608121719-0",
"product": {
"name": "rhcos-s390x-4.20.9.6.202608121719-0",
"product_id": "rhcos-s390x-4.20.9.6.202608121719-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.20.9.6.202608121719?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "rhcos-x86_64-4.20.9.6.202608121719-0",
"product": {
"name": "rhcos-x86_64-4.20.9.6.202608121719-0",
"product_id": "rhcos-x86_64-4.20.9.6.202608121719-0",
"product_identification_helper": {
"purl": "pkg:generic/redhat/rhcos@4.20.9.6.202608121719?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-aarch64-4.20.9.6.202608121719-0 as a component of Red Hat OpenShift Container Platform 4.20",
"product_id": "9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0"
},
"product_reference": "rhcos-aarch64-4.20.9.6.202608121719-0",
"relates_to_product_reference": "9Base-RHOSE-4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-ppc64le-4.20.9.6.202608121719-0 as a component of Red Hat OpenShift Container Platform 4.20",
"product_id": "9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0"
},
"product_reference": "rhcos-ppc64le-4.20.9.6.202608121719-0",
"relates_to_product_reference": "9Base-RHOSE-4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-s390x-4.20.9.6.202608121719-0 as a component of Red Hat OpenShift Container Platform 4.20",
"product_id": "9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0"
},
"product_reference": "rhcos-s390x-4.20.9.6.202608121719-0",
"relates_to_product_reference": "9Base-RHOSE-4.20"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhcos-x86_64-4.20.9.6.202608121719-0 as a component of Red Hat OpenShift Container Platform 4.20",
"product_id": "9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
},
"product_reference": "rhcos-x86_64-4.20.9.6.202608121719-0",
"relates_to_product_reference": "9Base-RHOSE-4.20"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-5222",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2025-05-26T13:39:54.361000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2368600"
}
],
"notes": [
{
"category": "description",
"text": "A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the \u0027subtag\u0027 struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "icu: Stack buffer overflow in the SRBRoot::addTag function",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-5222"
},
{
"category": "external",
"summary": "RHBZ#2368600",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2368600"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-5222",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5222"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-5222",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5222"
},
{
"category": "external",
"summary": "https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957",
"url": "https://unicode-org.atlassian.net/jira/software/c/projects/ICU/issues/ICU-22957"
}
],
"release_date": "2024-11-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "icu: Stack buffer overflow in the SRBRoot::addTag function"
},
{
"cve": "CVE-2025-10263",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-06-09T11:01:37.157725+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2486958"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Linux kernel on ARM processors. A race condition in Translation Lookaside Buffer Invalidation (TLBI) operations during memory permission changes allows a local attacker to write to memory resources owned by higher privilege levels. This could allow an unprivileged local attacker to gain kernel privileges or a guest VM to escape to the hypervisor, resulting in complete system compromise.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Linux kernel on ARM processors, allowing a local unprivileged attacker to achieve privilege escalation to kernel level or a guest virtual machine to escape to the hypervisor. The vulnerability stems from a race condition during Translation Lookaside Buffer Invalidation (TLBI) operations when memory permissions are altered, enabling writes to higher exception level resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-10263"
},
{
"category": "external",
"summary": "RHBZ#2486958",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2486958"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-10263",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10263"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-10263",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10263"
},
{
"category": "external",
"summary": "https://developer.arm.com/documentation/112137",
"url": "https://developer.arm.com/documentation/112137"
}
],
"release_date": "2026-06-09T09:23:18.802000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "kernel: Arm Processors: Privilege escalation or information disclosure via writes to higher exception level resources"
},
{
"cve": "CVE-2025-40026",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"discovery_date": "2025-10-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2406712"
}
],
"notes": [
{
"category": "description",
"text": "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O\n\nWhen completing emulation of instruction that generated a userspace exit\nfor I/O, don\u0027t recheck L1 intercepts as KVM has already finished that\nphase of instruction execution, i.e. has already committed to allowing L2\nto perform I/O. If L1 (or host userspace) modifies the I/O permission\nbitmaps during the exit to userspace, KVM will treat the access as being\nintercepted despite already having emulated the I/O access.\n\nPivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation.\nOf the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the\nintended \"recipient\") can reach the code in question. gp_interception()\u0027s\nuse is mutually exclusive with is_guest_mode(), and\ncomplete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with\nEMULTYPE_SKIP.\n\nThe bad behavior was detected by a syzkaller program that toggles port I/O\ninterception during the userspace I/O exit, ultimately resulting in a WARN\non vcpu-\u003earch.pio.count being non-zero due to KVM no completing emulation\nof the I/O instruction.\n\n WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm]\n Modules linked in: kvm_intel kvm irqbypass\n CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015\n RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm]\n PKRU: 55555554\n Call Trace:\n \u003cTASK\u003e\n kvm_fast_pio+0xd6/0x1d0 [kvm]\n vmx_handle_exit+0x149/0x610 [kvm_intel]\n kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm]\n kvm_vcpu_ioctl+0x244/0x8c0 [kvm]\n __x64_sys_ioctl+0x8a/0xd0\n do_syscall_64+0x5d/0xc60\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n \u003c/TASK\u003e",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "KVM x86 was re-checking L1 instruction intercepts while completing a userspace I/O emulation for an L2 instruction. If L1 (or host userspace) modified I/O interception during the exit, KVM could wrongly treat the already-emulated I/O as intercepted and leave vcpu-\u003earch.pio.count non-zero, triggering a WARN and potentially disrupting the guest.\nPractical exploitation requires local access to /dev/kvm and the ability to run nested virtualization or manipulate I/O bitmaps.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-40026"
},
{
"category": "external",
"summary": "RHBZ#2406712",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406712"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-40026",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-40026"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40026"
},
{
"category": "external",
"summary": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T",
"url": "https://lore.kernel.org/linux-cve-announce/2025102841-CVE-2025-40026-760b@gregkh/T"
}
],
"release_date": "2025-10-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "workaround",
"details": "This vulnerability can be mitigated by disabling nested virtualization. Create a file in `/etc/modprobe.d/` with a descriptive name, such as `cve-2026-53359-mitigation.conf`. In that file, disable nested virtualization for the `kvm_intel` and `kvm_amd` kernel modules:\n```\noptions kvm-intel nested=0\noptions kvm-amd nested=0\n```\n\nUse `lsmod` to determine if either module is already loaded. If so, remove loaded modules with `modprobe -r`. To validate that nested virtualization is disabled, read the files `/sys/module/kvm_intel/parameters/nested` and `/sys/module/kvm_amd/parameters/nested`. If these modules are loaded, those files should read `N` to indicate that the feature is disabled.\n\nIn OpenShift 4, a MachineConfig can be utilized to create a modprobe configuration allowing control of the module on applicable nodes. See the following article for an example.\n\nhttps://access.redhat.com/solutions/6979679",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "kernel: KVM: x86: Don\u0027t (re)check L1 intercepts when completing userspace I/O"
},
{
"acknowledgments": [
{
"names": [
"Asim Viladi Oglu Manizada"
]
}
],
"cve": "CVE-2026-1933",
"cwe": {
"id": "CWE-284",
"name": "Improper Access Control"
},
"discovery_date": "2026-03-13T08:29:39.852000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2447317"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Samba\u2019s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata through SMB operations even on read-only exports. This could allow modification of SMB-visible file behavior, including converting files into symbolic links or other reparse point types.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "samba: Missing access check on reparse point operations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated Important severity by Red Hat Product Security, because authenticated users with filesystem-level write permissions may bypass Samba\u2019s SMB-layer read-only protections for reparse point operations.\n\nThe flaw affects shares configured with \"read only = yes\", where Samba failed to properly enforce access checks when setting or deleting reparse point metadata. An attacker with existing write permissions on the underlying filesystem may manipulate SMB reparse point metadata to alter how files are presented to SMB clients, including converting files into symbolic links.\n\nThe vulnerability does not bypass underlying filesystem access controls or grant additional operating system privileges. However, successful exploitation may significantly disrupt file access for users of the affected share, including making large portions of a shared filesystem unavailable through widespread reparse point modification. Because the attack requires authenticated access and existing filesystem write permissions, Privileges Required are assessed as Low (PR:L).\n\n```\n\nThis vulnerability affects Samba versions beginning with the introduction of NTFS-style reparse point support in Samba 4.21.\n\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-1933"
},
{
"category": "external",
"summary": "RHBZ#2447317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447317"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-1933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-1933"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-1933",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1933"
},
{
"category": "external",
"summary": "https://bugzilla.samba.org/show_bug.cgi?id=15992",
"url": "https://bugzilla.samba.org/show_bug.cgi?id=15992"
}
],
"release_date": "2026-05-27T12:08:33.095000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "workaround",
"details": "Administrators can mitigate this issue by ensuring users who access a read only = yes Samba share do not have filesystem-level write permission to the exported files.\n\nA server administrator may also monitor and remove unintended \"user.SmbReparse\" xattr (extended attributes) and the associated FILE_ATTRIBUTE_REPARSE_POINT \"user.DosAttrib\" bit metadata if exploitation is suspected.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "samba: Missing access check on reparse point operations"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-14474",
"cwe": {
"id": "CWE-1188",
"name": "Initialization of a Resource with an Insecure Default"
},
"discovery_date": "2026-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496556"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SSSD\u0027s LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this as Important because the attack requires only low-privilege delegated LDAP write access to any subtree, which is a common delegation pattern in enterprise environments. The default ldap_sudo_search_base configuration searches the entire directory tree, allowing sudo rule injection from outside the intended sudoers container.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14474"
},
{
"category": "external",
"summary": "RHBZ#2496556",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496556"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14474",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14474"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14474",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14474"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "workaround",
"details": "Set ldap_sudo_search_base explicitly in /etc/sssd/sssd.conf to restrict the search to the designated sudoers container:\n\n[domain/example.com] ldap_sudo_search_base = ou=sudoers,dc=example,dc=com\n\nAdditionally, restrict LDAP ACLs to prevent non-admin principals from creating sudoRole objects outside the designated sudoers container.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation"
},
{
"acknowledgments": [
{
"names": [
"Ian Murphy"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-14476",
"cwe": {
"id": "CWE-23",
"name": "Relative Path Traversal"
},
"discovery_date": "2026-04-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2496581"
}
],
"notes": [
{
"category": "description",
"text": "A path traversal flaw was found in SSSD\u0027s AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this as Moderate because exploitation requires high privileges (AD GPO management access) and on default RHEL configurations with SELinux enforcing, the realistic impact is limited to Kerberos authentication bypass via krb5 configuration injection. SELinux blocks writes to most security-critical paths such as /etc/cron.d/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14476"
},
{
"category": "external",
"summary": "RHBZ#2496581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2496581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14476",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14476"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14476",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14476"
}
],
"release_date": "2026-07-07T09:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-18T12:08:13+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64, s390x, ppc64le, and aarch64 architectures. The image digests\nmay be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\nThe sha values for the release are as follows:\n\n (For x86_64 architecture)\n The image digest is\nsha256:a6182ea1e41a144d7bcd4bd93596851b907ff1ae7711c1c29b8b26baf3eb03f7\n\n (For s390x architecture)\n The image digest is\nsha256:2dfe6dad7b9a4411e3280cf9a6e3136482221c28f6407ebd4867446ed08a1cbc\n\n (For ppc64le architecture)\n The image digest is\nsha256:bc0a8650a476f595596c60a554b6068ffe5e08ebe98addbf27de6d576c2f6dd1\n\n (For aarch64 architecture)\n The image digest is\nsha256:f670213448b515446bcaf81fd580f5c17ac1bf6dd84e66ba94cdfcf5c3d4d5e0\n\nAll OpenShift Container Platform 4.20 users are advised to upgrade to these\nupdated packages and images when they are available in the appropriate\nrelease channel. To check for available updates, use the OpenShift CLI (oc)\nor web console. Instructions for upgrading a cluster are available at\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/updating_clusters/index#updating-cluster-cli.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:54581"
},
{
"category": "workaround",
"details": "Set ad_gpo_access_control = disabled in /etc/sssd/sssd.conf to disable GPO fetching entirely. Note that this removes GPO-based login policy enforcement.",
"product_ids": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"9Base-RHOSE-4.20:rhcos-aarch64-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-ppc64le-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-s390x-4.20.9.6.202608121719-0",
"9Base-RHOSE-4.20:rhcos-x86_64-4.20.9.6.202608121719-0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…