Red Hat Product Errata RHSA-2026:94537 - Security Advisory
Issued:
2026-11-09
Updated:
2026-11-09

RHSA-2026:94537 - Security Advisory

Synopsis

Critical: OpenShift Container Platform 5.0.1 bug fix and security update

Type/Severity

Security Advisory: Critical

Topic

Red Hat OpenShift Container Platform release 5.0.1 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 5.0.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 5.0.1. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:94536

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/

Security Fix(es):

  • kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
  • qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)
  • openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
  • cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)
  • kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
  • kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
  • kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
  • kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936)
  • openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
  • openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
  • openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
  • libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)
  • kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)
  • kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a

(For s390x architecture)
The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef

(For ppc64le architecture)
The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52

(For aarch64 architecture)
The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621

All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

  • Red Hat OpenShift Container Platform 5.0 for RHEL 10 x86_64
  • Red Hat OpenShift Container Platform 5.0 for RHEL 9 x86_64
  • Red Hat OpenShift Container Platform 5.0 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform for Power 5.0 for RHEL 10 ppc64le
  • Red Hat OpenShift Container Platform for Power 5.0 for RHEL 9 ppc64le
  • Red Hat OpenShift Container Platform for Power 5.0 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 5.0 for RHEL 10 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 5.0 for RHEL 9 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 5.0 for RHEL 8 s390x
  • Red Hat OpenShift Container Platform for ARM 64 5.0 for RHEL 10 aarch64
  • Red Hat OpenShift Container Platform for ARM 64 5.0 for RHEL 9 aarch64
  • Red Hat OpenShift Container Platform for ARM 64 5.0 for RHEL 8 aarch64

Fixes

  • BZ - 2438762 - CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
  • BZ - 2462114 - CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
  • BZ - 2499603 - CVE-2026-12080 qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
  • BZ - 2513253 - CVE-2026-68376 kernel: sctp: fix auth_hmacs array size in struct sctp_cookie
  • BZ - 2514115 - CVE-2025-31936 kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM
  • BZ - 2515348 - CVE-2026-14456 openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server
  • BZ - 2517559 - CVE-2026-18798 openssl: QUIC server may trigger double free when processing INITIAL packet
  • BZ - 2517560 - CVE-2026-63072 openssl: heap buffer overflow in CMS key unwrapping
  • BZ - 2517561 - CVE-2026-63076 openssl: invalid pointer dereference in CMP server via crafted protectionAlg
  • BZ - 2528642 - CVE-2026-80824 kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  • BZ - 2535066 - CVE-2026-89777 kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure
  • BZ - 2535170 - CVE-2026-90003 kernel: futex: Prevent rcuwait use-after-free during requeue PI
  • BZ - 2546385 - CVE-2026-98222 kernel: KEYS: encrypted: fix integer overflow of datablob_len
  • BZ - 2546494 - CVE-2026-98320 kernel: netfilter: flowtable: hold reference on ct until flow is released
  • BZ - 2547476 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer
  • BZ - 2550254 - CVE-2026-94453 libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP
  • BZ - 2550256 - CVE-2026-77206 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
  • BZ - 2550258 - CVE-2026-77207 libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
  • BZ - 2553390 - CVE-2026-98432 kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.