Red Hat Product Errata RHSA-2026:89197 - Security Advisory
Issued:
2026-10-27
Updated:
2026-10-27

RHSA-2026:89197 - Security Advisory

Synopsis

Critical: OpenShift Container Platform 4.22.20 bug fix and security update

Type/Severity

Security Advisory: Critical

Topic

Red Hat OpenShift Container Platform release 4.22.20 is now available with
updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container
Platform 4.22.

Red Hat Product Security has rated this update as having a security impact
of Critical. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container
Platform 4.22.20. See the following advisory for the RPM packages for this
release:

https://access.redhat.com/errata/{RPM_ADVISORY}

Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

Security Fix(es):

  • ca-certificates: Distrust eMudhra intermediate CA certificates due to

security concerns (CVE-2026-114406)

  • kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via

improper value handling (CVE-2025-35973)

  • libpcap: libpcap: Out-of-bounds read and write vulnerability allows

arbitrary memory access (CVE-2026-0799)

  • bind: BIND: Denial of Service via malformed DNS64 responses

(CVE-2026-19666)

  • bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in

DNS negative cache handling (CVE-2026-19667)

  • openssh: OpenSSH sshd: Security bypass due to incorrect handling of

forwarding and tunneling options (CVE-2026-59999)

  • libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling

(CVE-2026-63382)

  • libevent: Libevent: Denial of Service via malformed RPC data

(CVE-2026-63383)

  • libevent: Libevent: Denial of Service via integer conversion error in

`evtag_unmarshal_header` (CVE-2026-63384)

  • libevent: Libevent: HTTP header handling bugs create risk of access

control bypass. (CVE-2026-63385)

  • libevent: Libevent: Off-by-one stack buffer overflow leading to denial of

service or data corruption (CVE-2026-63387)

  • libevent: Libevent: Arbitrary code execution via heap out-of-bounds write

in AF_UNIX handling (CVE-2026-63388)

  • kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing

(CVE-2026-64564)

  • expat: Expat: Denial of Service via quadratic complexity in attribute

processing (CVE-2026-66046)

  • kernel: drm/amdgpu/vce: fix integer overflow in image size

(CVE-2026-68108)

  • kernel: openvswitch: fix GSO userspace truncation underflow

(CVE-2026-68123)

  • bind: BIND: Denial of Service via crafted DNSSEC reply (CVE-2026-80274)
  • kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
  • kernel: KVM: s390: vsie: zero stale crypto bits (CVE-2026-80921)
  • kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device

(CVE-2026-81003)

  • libxml2: libxml2: Arbitrary code execution via stack-based buffer

overflow in xmlSnprintfElements (CVE-2026-86140)

  • pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via

crafted regular expressions (CVE-2026-86145)

  • pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match

(CVE-2026-89161)

  • kernel: nvme-tcp: fix host memory disclosure on R2T for a read command

(CVE-2026-89481)

  • kernel: nfsd: revoke copy-notify stateids before dropping their reference

(CVE-2026-89663)

  • kernel: nfsd: initialize copy-notify stateid before publishing it

(CVE-2026-89669)

  • kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF

(CVE-2026-89690)

  • kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension

(CVE-2026-89811)

  • kernel: media: cx231xx: reject geometry changes while the VBI queue is

busy (CVE-2026-89894)

  • kernel: nvme: add missing SRCU grace period in error path

(CVE-2026-89972)

  • kernel: NFSD: Prevent client use-after-free during blocked-lock reaping

(CVE-2026-90036)

  • kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()

(CVE-2026-90227)

  • kernel: netfilter: nfnetlink_log: wait for rcu grace period before

freeing pernet state (CVE-2026-93288)

  • kernel: perf: Fix addr_filter_ranges lifetime (CVE-2026-93817)
  • expat: Expat: XML Injection via Malformed UTF-16 Input (CVE-2026-93990)
  • rpcbind: Unbounded memory allocation in rpcbind statistics tracking

allows unauthenticated remote denial of service (CVE-2026-94640)

  • kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()

(CVE-2026-97417)

  • kernel: ipv4: validate checksum_start before completing checksum

(CVE-2026-99999)

  • pcre2: pcre2: Out-of-bounds write via crafted regular expression

(CVE-2026-103111)

  • tornado: Tornado: Denial of Service via decompression bomb in

CurlAsyncHTTPClient (CVE-2026-103262)

  • gnutls: gnutls: Information disclosure via heap overread in RSA key

exchange (CVE-2026-5260)

  • curl: curl: Cookie injection via malicious HTTP server using super

cookies (CVE-2026-8924)

  • URI: URI (for Perl): Security bypass due to incorrect hostname encoding

via missing Unicode normalization (CVE-2026-19953)

  • gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c

(CVE-2026-40467)

  • gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
  • gnutls: gnutls: Security bypass due to incorrect name constraint handling

(CVE-2026-42011)

  • gnutls: gnutls: Certificate validation bypass due to improper handling of

URI and SRV SANs (CVE-2026-42012)

  • gnutls: gnutls: Certificate validation bypass due to oversized Subject

Alternative Name (CVE-2026-42013)

  • openssh: OpenSSH: sftp client allows attacker to control downloaded file

location (CVE-2026-59995)

  • kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation

(CVE-2026-68257)

  • kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound

(CVE-2026-80887)

  • libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow

(CVE-2026-86138)

  • libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to

xpointer length saturation (CVE-2026-86142)

  • libxml2: libxml2: Data integrity issues due to integer overflow in write

callbacks (CVE-2026-86143)

  • libxml2: libxml2: Information disclosure, SSRF, or denial of service due

to improper parseFlags propagation. (CVE-2026-86144)

  • kernel: nvme-tcp: reject a read that transferred too few bytes

(CVE-2026-89480)

  • kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody()

entry (CVE-2026-93207)

  • kernel: svcrdma: Reject Write/Reply chunks with segcount 0

(CVE-2026-93228)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 4.22 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions
on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813

(For s390x architecture)
The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e

(For ppc64le architecture)
The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2

(For aarch64 architecture)
The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866

All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

  • Red Hat OpenShift Container Platform 4.22 for RHEL 9 x86_64
  • Red Hat OpenShift Container Platform 4.22 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform for Power 4.22 for RHEL 9 ppc64le
  • Red Hat OpenShift Container Platform for Power 4.22 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.22 for RHEL 9 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.22 for RHEL 8 s390x
  • Red Hat OpenShift Container Platform for ARM 64 4.22 for RHEL 9 aarch64
  • Red Hat OpenShift Container Platform for ARM 64 4.22 for RHEL 8 aarch64

Fixes

  • BZ - 2462960 - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service
  • BZ - 2467437 - CVE-2026-42011 gnutls: gnutls: Security bypass due to incorrect name constraint handling
  • BZ - 2467441 - CVE-2026-42012 gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs
  • BZ - 2467448 - CVE-2026-42013 gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name
  • BZ - 2467450 - CVE-2026-5260 gnutls: gnutls: Information disclosure via heap overread in RSA key exchange
  • BZ - 2496765 - CVE-2026-8924 curl: curl: Cookie injection via malicious HTTP server using super cookies
  • BZ - 2497927 - CVE-2026-59995 openssh: OpenSSH: sftp client allows attacker to control downloaded file location
  • BZ - 2497942 - CVE-2026-59999 openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options
  • BZ - 2499655 - CVE-2026-40468 gawk: gawk: Memory corruption via integer overflow
  • BZ - 2499658 - CVE-2026-40467 gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c
  • BZ - 2510890 - CVE-2026-64564 kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing
  • BZ - 2513361 - CVE-2026-68108 kernel: drm/amdgpu/vce: fix integer overflow in image size
  • BZ - 2513372 - CVE-2026-68257 kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation
  • BZ - 2513451 - CVE-2026-68123 kernel: openvswitch: fix GSO userspace truncation underflow
  • BZ - 2514104 - CVE-2025-35973 kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling
  • BZ - 2517901 - CVE-2026-66046 expat: Expat: Denial of Service via quadratic complexity in attribute processing
  • BZ - 2520654 - CVE-2026-63383 libevent: Libevent: Denial of Service via malformed RPC data
  • BZ - 2520655 - CVE-2026-63387 libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption
  • BZ - 2520658 - CVE-2026-63384 libevent: Libevent: Denial of Service via integer conversion error in `evtag_unmarshal_header`
  • BZ - 2520660 - CVE-2026-63382 libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling
  • BZ - 2520661 - CVE-2026-63388 libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling
  • BZ - 2520666 - CVE-2026-63385 libevent: Libevent: HTTP header handling bugs create risk of access control bypass.
  • BZ - 2526492 - CVE-2026-19953 URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization
  • BZ - 2528542 - CVE-2026-80792 kernel: ipv6: fix use-after-free in ip6_finish_output2()
  • BZ - 2528788 - CVE-2026-80887 kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound
  • BZ - 2528986 - CVE-2026-86138 libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow
  • BZ - 2528987 - CVE-2026-86143 libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks
  • BZ - 2528989 - CVE-2026-86140 libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements
  • BZ - 2528990 - CVE-2026-86142 libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation
  • BZ - 2528992 - CVE-2026-86144 libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation.
  • BZ - 2528993 - CVE-2026-86145 pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
  • BZ - 2529093 - CVE-2026-0799 libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access
  • BZ - 2531066 - CVE-2026-80921 kernel: KVM: s390: vsie: zero stale crypto bits
  • BZ - 2531747 - CVE-2026-89161 pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
  • BZ - 2532095 - CVE-2026-89480 kernel: nvme-tcp: reject a read that transferred too few bytes
  • BZ - 2532103 - CVE-2026-89690 kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF
  • BZ - 2532111 - CVE-2026-89669 kernel: nfsd: initialize copy-notify stateid before publishing it
  • BZ - 2532184 - CVE-2026-89481 kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
  • BZ - 2532231 - CVE-2026-89663 kernel: nfsd: revoke copy-notify stateids before dropping their reference
  • BZ - 2532515 - CVE-2026-81003 kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device
  • BZ - 2535140 - CVE-2026-89972 kernel: nvme: add missing SRCU grace period in error path
  • BZ - 2535158 - CVE-2026-90036 kernel: NFSD: Prevent client use-after-free during blocked-lock reaping
  • BZ - 2535309 - CVE-2026-89811 kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension
  • BZ - 2535338 - CVE-2026-89894 kernel: media: cx231xx: reject geometry changes while the VBI queue is busy
  • BZ - 2535435 - CVE-2026-19667 bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling
  • BZ - 2535466 - CVE-2026-80274 bind: BIND: Denial of Service via crafted DNSSEC reply
  • BZ - 2535477 - CVE-2026-19666 bind: BIND: Denial of Service via malformed DNS64 responses
  • BZ - 2536346 - CVE-2026-90227 kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed()
  • BZ - 2538967 - CVE-2026-93990 expat: Expat: XML Injection via Malformed UTF-16 Input
  • BZ - 2540182 - CVE-2026-93207 kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry
  • BZ - 2540230 - CVE-2026-93228 kernel: svcrdma: Reject Write/Reply chunks with segcount 0
  • BZ - 2540391 - CVE-2026-93817 kernel: perf: Fix addr_filter_ranges lifetime
  • BZ - 2540479 - CVE-2026-97417 kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack()
  • BZ - 2540500 - CVE-2026-93288 kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state
  • BZ - 2543797 - CVE-2026-103111 pcre2: pcre2: Out-of-bounds write via crafted regular expression
  • BZ - 2544534 - CVE-2026-103262 tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient
  • BZ - 2553429 - CVE-2026-99999 kernel: ipv4: validate checksum_start before completing checksum
  • BZ - 2556046 - CVE-2026-114406 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.