Red Hat Hardened Images.

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

• containers crun
• Red Hat Hardened Images
• Path traversal

Crun: crun: rootful krun with passt executes container payload as host root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-178

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Libxml2: double-free/uaf in libxml2 python bindings

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Race condition

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• CWE-775

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Popt-devel: popt-static: short realloc in poptconfigfiletostring

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Code injection

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

• vim
• Red Hat Hardened Images
• Code injection

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Denial of service

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Race condition

Popt-devel: popt-static: size_t underflow in singleoptionhelp

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Rpm: heap buffer overflow in ndb slot table parsing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Denial of service

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Popt-devel: popt-static: off-by-one in poptstuffargs

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Race condition

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-755

Libarchive: libarchive: signed integer overflow in archive_write_zip_header

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Memory corruption

Libssh: libssh: authentication bypass via missing gssapi principal check

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Broken access control

Libssh: libssh: use-after-free via data callbacks on closed channels

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libssh: libssh: denial of service via automatic certificate authentication loop

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Denial of service

Libssh: libssh: denial of service via sftp responses with unknown request ids

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-253
• CWE-1310

Libssh: libssh: information disclosure via proxycommand %r username expansion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
• Command injection

Libssh: libssh: denial of service via oversized sftp read length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libssh: libssh: denial of service via unchecked proxycommand fork() failure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-390

Libssh: libssh: denial of service via zero advertised channel packet size

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libssh: libssh: information disclosure via short gssapi curve25519 public key

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Memory corruption

Libssh: libssh: stack buffer overflow in sftp server longname construction

• Red Hat Enterprise Linux 10
• Red Hat Hardened Images
• Memory corruption

Libsolv: stack-based buffer overflow in libsolv eddsa pgp signature verification allows denial of service

• OpenSUSE libsolv
• Red Hat Enterprise Linux 10
• Memory corruption

Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Memory corruption

Sssd: use-after-free crash in sssd' 'sssd_pam' process

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Libtiff: libtiff: heap-based buffer overflow via crafted pixarlog-compressed tiff image

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Util-linux: util-linux: heap use-after-free in libblkid nested partition probing

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Memory corruption

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-923

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libaom: libaom: remote code execution via svc layer context handling with attacker-controlled frames

• Red Hat Enterprise Linux AI 3.3 for RHEL 9
• Red Hat Enterprise Linux AI 3.4 for RHEL 9
• Memory corruption

Libaom: libaom: heap-buffer-overflow read via missing bounds check in ctrl_set_layer_id

• Red Hat Enterprise Linux AI 3.3 for RHEL 9
• Red Hat Enterprise Linux AI 3.4 for RHEL 9
• Memory corruption