Red Hat Product Errata RHSA-2026:95346 - Security Advisory
Issued:
2026-11-06
Updated:
2026-11-06

RHSA-2026:95346 - Security Advisory

Synopsis

Critical: OpenShift Container Platform 4.22.22 bug fix and security update

Type/Severity

Security Advisory: Critical

Topic

Red Hat OpenShift Container Platform release 4.22.22 is now available with updates to packages and images that fix several bugs and add enhancements.

This release includes a security update for Red Hat OpenShift Container Platform 4.22.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.

This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.22. See the following advisory for the RPM packages for this release:

https://access.redhat.com/errata/RHBA-2026:95345

Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

Security Fix(es):

  • kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432)
  • curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458)
  • qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080)
  • openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456)
  • bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630)
  • cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007)
  • kernel: smb: client: fix double-free in SMB2_close() replay (CVE-2026-64597)
  • kernel: sctp: fix auth_hmacs array size in struct sctp_cookie (CVE-2026-68376)
  • expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214)
  • kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() (CVE-2026-80824)
  • openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782)
  • kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure (CVE-2026-89777)
  • kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011)
  • bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300)
  • libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453)
  • bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888)
  • bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313)
  • kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222)
  • kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364)
  • kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
  • kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725)
  • brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497)
  • kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936)
  • libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932)
  • openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798)
  • unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252)
  • kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929)
  • openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072)
  • openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076)
  • libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226)
  • libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206)
  • libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207)
  • kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003)
  • kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Solution

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

The sha values for the release are as follows:

(For x86_64 architecture)
The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5

(For s390x architecture)
The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef

(For ppc64le architecture)
The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f

(For aarch64 architecture)
The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced

All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Affected Products

  • Red Hat OpenShift Container Platform 4.22 for RHEL 9 x86_64
  • Red Hat OpenShift Container Platform 4.22 for RHEL 8 x86_64
  • Red Hat OpenShift Container Platform for Power 4.22 for RHEL 9 ppc64le
  • Red Hat OpenShift Container Platform for Power 4.22 for RHEL 8 ppc64le
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.22 for RHEL 9 s390x
  • Red Hat OpenShift Container Platform for IBM Z and LinuxONE 4.22 for RHEL 8 s390x
  • Red Hat OpenShift Container Platform for ARM 64 4.22 for RHEL 9 aarch64
  • Red Hat OpenShift Container Platform for ARM 64 4.22 for RHEL 8 aarch64

Fixes

  • BZ - 2438762 - CVE-2026-26007 cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
  • BZ - 2462114 - CVE-2026-71226 libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path
  • BZ - 2492108 - CVE-2026-52929 kernel: sctp: stream: fully roll back denied add-stream state
  • BZ - 2496759 - CVE-2026-8932 libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse
  • BZ - 2496764 - CVE-2026-8458 curl: libcurl: Unauthorized connection reuse due to a logical error
  • BZ - 2499603 - CVE-2026-12080 qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys
  • BZ - 2506133 - CVE-2026-50252 unbound: Unbound: DNS cache poisoning via UDP source port predictability
  • BZ - 2511932 - CVE-2026-64597 kernel: smb: client: fix double-free in SMB2_close() replay
  • BZ - 2513253 - CVE-2026-68376 kernel: sctp: fix auth_hmacs array size in struct sctp_cookie
  • BZ - 2514115 - CVE-2025-31936 kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM
  • BZ - 2515348 - CVE-2026-14456 openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server
  • BZ - 2517559 - CVE-2026-18798 openssl: QUIC server may trigger double free when processing INITIAL packet
  • BZ - 2517560 - CVE-2026-63072 openssl: heap buffer overflow in CMS key unwrapping
  • BZ - 2517561 - CVE-2026-63076 openssl: invalid pointer dereference in CMP server via crafted protectionAlg
  • BZ - 2528642 - CVE-2026-80824 kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release()
  • BZ - 2535066 - CVE-2026-89777 kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure
  • BZ - 2535170 - CVE-2026-90003 kernel: futex: Prevent rcuwait use-after-free during requeue PI
  • BZ - 2535227 - CVE-2026-90011 kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload
  • BZ - 2537080 - CVE-2026-84782 openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset
  • BZ - 2546385 - CVE-2026-98222 kernel: KEYS: encrypted: fix integer overflow of datablob_len
  • BZ - 2546487 - CVE-2026-98364 kernel: xfrm: hold net_device reference under RCU in bundle creation
  • BZ - 2546494 - CVE-2026-98320 kernel: netfilter: flowtable: hold reference on ct until flow is released
  • BZ - 2547476 - CVE-2026-77214 expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer
  • BZ - 2550254 - CVE-2026-94453 libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP
  • BZ - 2550256 - CVE-2026-77206 libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code
  • BZ - 2550258 - CVE-2026-77207 libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS
  • BZ - 2553390 - CVE-2026-98432 kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
  • BZ - 2554835 - CVE-2026-98466 kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2
  • BZ - 2555068 - CVE-2026-98725 kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()
  • BZ - 2556406 - CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages
  • BZ - 2556407 - CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay
  • BZ - 2556413 - CVE-2026-96888 bind: bind: Denial of Service via assertion failure during redirect processing
  • BZ - 2556415 - CVE-2026-97313 bind: bind: Denial of service via assertion failure in RPZ query processing
  • BZ - 2558973 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder
  • OCPBUGS-129524 - [4.22] Bootimage bump tracker

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.