Filtered by vendor Redhat Subscriptions
Filtered by product Openshift Subscriptions
Total 1468 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-71226 2 Redhat, Smuellerdd 10 Enterprise Linux, Enterprise Linux Eus, Hardened Images and 7 more 2026-11-09 7.3 High
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers.
CVE-2026-12080 2 Qemu, Redhat 5 Qemu, Enterprise Linux, Enterprise Linux Nvidia and 2 more 2026-11-09 7.3 High
A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path.
CVE-2026-13595 3 Kernel, Linux, Redhat 10 Util-linux, Util-linux, Cost Management On Premise and 7 more 2026-11-09 6.8 Medium
A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.
CVE-2026-93683 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 6.4 Medium
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
CVE-2026-86856 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 6.5 Medium
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
CVE-2026-86849 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
CVE-2026-86847 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
CVE-2026-86846 2 Dpdk, Redhat 4 Dpdk, Enterprise Linux, Openshift and 1 more 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
CVE-2026-86845 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
CVE-2026-86566 3 Dpdk, Red Hat, Redhat 6 Dpdk, Enterprise Linux, Enterprise Linux and 3 more 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
CVE-2026-86561 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-09 6.5 Medium
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
CVE-2026-100236 2 Dpdk, Redhat 4 Dpdk, Enterprise Linux, Openshift and 1 more 2026-11-09 8.6 High
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.
CVE-2026-86848 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 8.8 High
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
CVE-2026-86567 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-09 8.8 High
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-86565 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-09 8.2 High
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
CVE-2026-86563 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-09 7.8 High
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVE-2026-86562 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-09 7.8 High
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
CVE-2026-92092 1 Redhat 2 Openshift, Openshift Container Platform 2026-11-09 7.4 High
A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.
CVE-2024-2905 1 Redhat 3 Enterprise Linux, Openshift, Rhel Eus 2026-11-07 6.2 Medium
A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, potentially exposing sensitive authentication data to unauthorized access.
CVE-2026-75939 1 Redhat 2 Openshift, Openshift Container Platform 2026-11-07 7.4 High
A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulating network traffic to the signature endpoint, could exploit this to craft a PGP message with a valid Red Hat release key ID but a forged signature. This enables the `oc-mirror` tool to accept and mirror a malicious release payload into a disconnected registry, potentially compromising the integrity of software deployments.