Red Hat: Red Hat Security Releases - October 2026, BugRater

CVE-2026-109082 BR2026-0000-026964 Red Hat Build of Keycloak, Red Hat Single Sign-On 7 unclaimed

A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak. This component handles advanced authentication flows wher...

Credited as Red Hat would like to thank MZOUGHI Mohamed Amine (zerOiQ) for reporting this issue

CVE-2026-107935 BR2026-0000-026998 Red Hat Build of Podman Desktop, Red Hat Certification Program for Red Hat Enterprise Linux 9, Red Hat Edge Manager 1 unclaimed

A path traversal vulnerability was found in gvproxy, the network forwarder provided by the gvisor-tap-vsock package. The unauthenticated /services/forwarder/expose endpoint does not validate the ca...

Credited as Lucas Celant (Red Hat)

CVE-2026-108094 BR2026-0000-027103 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 r...

Credited as Red Hat would like to thank Calif.io (security-disclosures@calif.io), in collaboration with Anthropic for reporting this issue

CVE-2026-109194 BR2026-0000-027126 Red Hat Quay 3 unclaimed

A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authentica...

Credited as Red Hat would like to thank Xanlar Agamalizade for reporting this issue

CVE-2026-109195 BR2026-0000-027127 Red Hat Quay 3 unclaimed

A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because ...

Credited as Red Hat would like to thank Xanlar Agamalizade for reporting this issue

CVE-2026-105306 BR2026-0000-027458 Red Hat Build of Keycloak, Red Hat Single Sign-On 7 unclaimed

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive ...

Credited as Red Hat would like to thank DungSoCool for reporting this issue

CVE-2026-87744 BR2026-0000-027491 Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat, Exploit Intelligence unclaimed

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operati...

Credited as Red Hat would like to thank Michael Read ((https://github.com/Michael-JRead)) for reporting this issue

CVE-2026-108119 BR2026-0000-027570 Red Hat Hardened Images, Red Hat Enterprise Linux 6 unclaimed

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains in...

Credited as Red Hat would like to thank TAE3 for reporting this issue

CVE-2026-109854 BR2026-0000-028034 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the app...

Credited as Red Hat would like to thank Chamod Anuradha Denipitiya for reporting this issue

CVE-2026-109832 BR2026-0000-028097 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 unclaimed

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an ...

Credited as Red Hat would like to thank Aisle Research for reporting this issue

CVE-2026-109833 BR2026-0000-028109 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 unclaimed

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes i...

Credited as Red Hat would like to thank Aisle Research for reporting this issue

CVE-2026-107193 BR2026-0000-028965 Red Hat Satellite 6 unclaimed

A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged...

Credited as Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue

CVE-2026-105460 BR2026-0000-028970 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture ...

Credited as Red Hat would like to thank zhailiangliang (Loongson Technology) for reporting this issue

CVE-2026-107889 BR2026-0000-029005 Red Hat Build of Keycloak, Red Hat Single Sign-On 7 unclaimed

A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator...

Credited as Red Hat would like to thank Mohammed LACHHAB for reporting this issue

CVE-2026-88833 BR2026-0000-029045 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-v...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-88834 BR2026-0000-029046 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-88838 BR2026-0000-029047 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-110036 BR2026-0000-029180 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessivel...

Credited as Found by AISLE in partnership with Red Hat

CVE-2026-107651 BR2026-0000-030081 Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when parsing split metadata chunks. A remote attacker could exp...

Credited as Red Hat would like to thank Ege BALCI for reporting this issue

CVE-2026-108093 BR2026-0000-030086 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without ensuring the parasite data is present before dereferencing it. Opening a specia...

Credited as Red Hat would like to thank Alexey Khairov (codem4ster), Konstantin Talgarenko (Marcusov), and Nikolay Kravtsov (Kolya080808) for reporting this issue

CVE-2026-100231 BR2026-0000-030612 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emo...

Credited as Red Hat would like to thank Bruno Fournier (Independent researcher) for reporting this issue

CVE-2026-109969 BR2026-0000-030613 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a p...

Credited as Sergio Correia (Red Hat)

CVE-2026-109970 BR2026-0000-030614 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default proce...

Credited as Sergio Correia (Red Hat)

CVE-2026-109971 BR2026-0000-030615 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through proc...

Credited as Sergio Correia (Red Hat)

CVE-2026-86476 BR2026-0000-030616 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the a...

Credited as Red Hat would like to thank Yehia Ezzat (Independent researcher) for reporting this issue

CVE-2026-88829 BR2026-0000-030617 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connectio...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-90954 BR2026-0000-030618 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once afte...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-100229 BR2026-0000-030619 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in GStreamer's H.266 codec parser library (libgstcodecparsers). An out-of-bounds write vulnerability exists in the DCI parsing function, where a reserved field value is incorrectly...

Credited as Red Hat would like to thank Bruno Fournier for reporting this issue

CVE-2026-88842 BR2026-0000-030620 Red Hat Hardened Images unclaimed

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza i...

Credited as Red Hat would like to thank Shubham Raj (Causal Security) for reporting this issue

CVE-2026-109968 BR2026-0000-030738 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 unclaimed

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restricti...

Credited as Sergio Correia (Red Hat)

CVE-2026-106062 BR2026-0000-031023 Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 unclaimed

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit a...

Credited as Red Hat would like to thank Jim Alves-Foss for reporting this issue

CVE-2026-86561 BR2026-0000-031033 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.

Credited as Red Hat would like to thank Ivar Al-Safawi for reporting this issue

CVE-2026-93683 BR2026-0000-031034 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before va...

Credited as Red Hat would like to thank Naseeb Dangi (AOSP Lab @Nankai University) and Xiang Li (AOSP Lab @Nankai University) for reporting this issue

CVE-2026-86562 BR2026-0000-031068 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

Credited as Red Hat would like to thank Ivar Al-Safawi for reporting this issue

CVE-2026-86563 BR2026-0000-031069 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

Credited as Red Hat would like to thank Ivar Al-Safawi for reporting this issue

CVE-2026-100236 BR2026-0000-031084 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, a...

Credited as Red Hat would like to thank Alexandru-Ionut Jipa for reporting this issue

CVE-2026-107203 BR2026-0000-031150 Red Hat Satellite 6 unclaimed

An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package. The domain and subnet interface API checks only that the caller holds a host permiss...

Credited as Red Hat would like to thank Wenhao Wu (Southeast University) for reporting this issue

CVE-2026-86566 BR2026-0000-031160 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.

Credited as Red Hat would like to thank Anthropic Research and Arthur Chan (Ada Logics) for reporting this issue

CVE-2026-86567 BR2026-0000-031161 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.

Credited as Red Hat would like to thank Ivar Al-Safawi for reporting this issue

CVE-2026-86845 BR2026-0000-031162 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-afte...

Credited as Red Hat would like to thank Anthropic Research for reporting this issue

CVE-2026-86846 BR2026-0000-031163 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto back...

Credited as Red Hat would like to thank Anthropic Research for reporting this issue

CVE-2026-86847 BR2026-0000-031164 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to ha...

Credited as Red Hat would like to thank Anthropic Research for reporting this issue

CVE-2026-86856 BR2026-0000-031165 Fast Datapath for RHEL 10, Fast Datapath for RHEL 8, Fast Datapath for RHEL 9 unclaimed

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Credited as Red Hat would like to thank Anthropic Research for reporting this issue