Red Hat Product Errata RHSA-2026:85309 - Security Advisory
Issued:
2026-10-19
Updated:
2026-10-19

RHSA-2026:85309 - Security Advisory

Synopsis

Important: bubblewrap security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for bubblewrap is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces.

Security Fix(es):

  • bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVE-2026-87766)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x

Fixes

  • BZ - 2530542 - CVE-2026-87766 bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

Red Hat Enterprise Linux for x86_64 9

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
x86_64
bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 5bbae4ffd3b724db488ce5b26d74f74d7215d2787aa022a859e322c9045ff661
bubblewrap-debuginfo-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: b8883ca89e1fb28c4d661960ae1cf4c0fbb38419d30a193ae0d455febdbb9e38
bubblewrap-debugsource-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 519a2f84d561beb67d244a76e6d70ab71fc0c41cf0d53914ab5b7b15d134e876

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
x86_64
bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 5bbae4ffd3b724db488ce5b26d74f74d7215d2787aa022a859e322c9045ff661
bubblewrap-debuginfo-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: b8883ca89e1fb28c4d661960ae1cf4c0fbb38419d30a193ae0d455febdbb9e38
bubblewrap-debugsource-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 519a2f84d561beb67d244a76e6d70ab71fc0c41cf0d53914ab5b7b15d134e876

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
s390x
bubblewrap-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 5cf44cc2ea43c4d48c5e339b766d932b5493bb890652667a9ca1747b58584c30
bubblewrap-debuginfo-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 1a455e98c3f8e1887a743adb7c5d99a401a7b846c778e154ea1d0d9969d6a4a6
bubblewrap-debugsource-0.6.3-1.el9_8.1.s390x.rpm SHA-256: c5238f53b9090f5c4c241c4179bd1fd2e8813cb4a5e087ed65427d8680689a04

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
s390x
bubblewrap-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 5cf44cc2ea43c4d48c5e339b766d932b5493bb890652667a9ca1747b58584c30
bubblewrap-debuginfo-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 1a455e98c3f8e1887a743adb7c5d99a401a7b846c778e154ea1d0d9969d6a4a6
bubblewrap-debugsource-0.6.3-1.el9_8.1.s390x.rpm SHA-256: c5238f53b9090f5c4c241c4179bd1fd2e8813cb4a5e087ed65427d8680689a04

Red Hat Enterprise Linux for Power, little endian 9

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
ppc64le
bubblewrap-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: 430ab7f003442a7cac9d35da98521d5e9ea14a0903439564859d6245b431b2d4
bubblewrap-debuginfo-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: baf69d62e28d970d291b528246bfba281f105a8e85e9bb39755b816e02f2e35a
bubblewrap-debugsource-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: afb89299d55393c33a62fcef66b27e3635d8aa6ae09c103270da4750c6ab40d7

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
ppc64le
bubblewrap-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: 430ab7f003442a7cac9d35da98521d5e9ea14a0903439564859d6245b431b2d4
bubblewrap-debuginfo-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: baf69d62e28d970d291b528246bfba281f105a8e85e9bb39755b816e02f2e35a
bubblewrap-debugsource-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: afb89299d55393c33a62fcef66b27e3635d8aa6ae09c103270da4750c6ab40d7

Red Hat Enterprise Linux for ARM 64 9

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
aarch64
bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 0c446962e2a4e4f3bfd1277ba7a58e9179cda58b910b7bc1bce207f3322ca7f0
bubblewrap-debuginfo-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 895fab9c7d2d2976cd3537d2bd47d35d53bca5aa51ed6b21205324c573c0cfa8
bubblewrap-debugsource-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 7d86415abb63e79fd749e7e54256a87e9d9b123f777c0bd0e0beafd1cdd150c9

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
aarch64
bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 0c446962e2a4e4f3bfd1277ba7a58e9179cda58b910b7bc1bce207f3322ca7f0
bubblewrap-debuginfo-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 895fab9c7d2d2976cd3537d2bd47d35d53bca5aa51ed6b21205324c573c0cfa8
bubblewrap-debugsource-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 7d86415abb63e79fd749e7e54256a87e9d9b123f777c0bd0e0beafd1cdd150c9

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
ppc64le
bubblewrap-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: 430ab7f003442a7cac9d35da98521d5e9ea14a0903439564859d6245b431b2d4
bubblewrap-debuginfo-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: baf69d62e28d970d291b528246bfba281f105a8e85e9bb39755b816e02f2e35a
bubblewrap-debugsource-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: afb89299d55393c33a62fcef66b27e3635d8aa6ae09c103270da4750c6ab40d7

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
x86_64
bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 5bbae4ffd3b724db488ce5b26d74f74d7215d2787aa022a859e322c9045ff661
bubblewrap-debuginfo-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: b8883ca89e1fb28c4d661960ae1cf4c0fbb38419d30a193ae0d455febdbb9e38
bubblewrap-debugsource-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 519a2f84d561beb67d244a76e6d70ab71fc0c41cf0d53914ab5b7b15d134e876

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
aarch64
bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 0c446962e2a4e4f3bfd1277ba7a58e9179cda58b910b7bc1bce207f3322ca7f0
bubblewrap-debuginfo-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 895fab9c7d2d2976cd3537d2bd47d35d53bca5aa51ed6b21205324c573c0cfa8
bubblewrap-debugsource-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 7d86415abb63e79fd749e7e54256a87e9d9b123f777c0bd0e0beafd1cdd150c9

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
s390x
bubblewrap-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 5cf44cc2ea43c4d48c5e339b766d932b5493bb890652667a9ca1747b58584c30
bubblewrap-debuginfo-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 1a455e98c3f8e1887a743adb7c5d99a401a7b846c778e154ea1d0d9969d6a4a6
bubblewrap-debugsource-0.6.3-1.el9_8.1.s390x.rpm SHA-256: c5238f53b9090f5c4c241c4179bd1fd2e8813cb4a5e087ed65427d8680689a04

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
x86_64
bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 5bbae4ffd3b724db488ce5b26d74f74d7215d2787aa022a859e322c9045ff661
bubblewrap-debuginfo-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: b8883ca89e1fb28c4d661960ae1cf4c0fbb38419d30a193ae0d455febdbb9e38
bubblewrap-debugsource-0.6.3-1.el9_8.1.x86_64.rpm SHA-256: 519a2f84d561beb67d244a76e6d70ab71fc0c41cf0d53914ab5b7b15d134e876

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
aarch64
bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 0c446962e2a4e4f3bfd1277ba7a58e9179cda58b910b7bc1bce207f3322ca7f0
bubblewrap-debuginfo-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 895fab9c7d2d2976cd3537d2bd47d35d53bca5aa51ed6b21205324c573c0cfa8
bubblewrap-debugsource-0.6.3-1.el9_8.1.aarch64.rpm SHA-256: 7d86415abb63e79fd749e7e54256a87e9d9b123f777c0bd0e0beafd1cdd150c9

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
ppc64le
bubblewrap-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: 430ab7f003442a7cac9d35da98521d5e9ea14a0903439564859d6245b431b2d4
bubblewrap-debuginfo-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: baf69d62e28d970d291b528246bfba281f105a8e85e9bb39755b816e02f2e35a
bubblewrap-debugsource-0.6.3-1.el9_8.1.ppc64le.rpm SHA-256: afb89299d55393c33a62fcef66b27e3635d8aa6ae09c103270da4750c6ab40d7

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8

SRPM
bubblewrap-0.6.3-1.el9_8.1.src.rpm SHA-256: ecfd11ca0855817d52dd05f1e3b2b1c145df72c40b930aa4f604483ac1811d60
s390x
bubblewrap-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 5cf44cc2ea43c4d48c5e339b766d932b5493bb890652667a9ca1747b58584c30
bubblewrap-debuginfo-0.6.3-1.el9_8.1.s390x.rpm SHA-256: 1a455e98c3f8e1887a743adb7c5d99a401a7b846c778e154ea1d0d9969d6a4a6
bubblewrap-debugsource-0.6.3-1.el9_8.1.s390x.rpm SHA-256: c5238f53b9090f5c4c241c4179bd1fd2e8813cb4a5e087ed65427d8680689a04

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.