RHSA-2026:74922MediumCVSS 6.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
October 2, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-12345 →

📋 Description

CVE-2026-12345 — python: python: Arbitrary file deletion via race condition during temporary directory cleanup

🎯 Affected products16

  • Red Hat Hardened Images
  • python3.12-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-0:3.12.15-1.hum1@src as a component of Red Hat Hardened Images
  • python3.12-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-debug-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-debug-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-devel-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-devel-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-idle-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-idle-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-libs-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-libs-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-test-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-test-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images
  • python3.12-tkinter-0:3.12.15-1.hum1@aarch64 as a component of Red Hat Hardened Images
  • python3.12-tkinter-0:3.12.15-1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: To mitigate this issue, ensure kernel symlink protection is enabled (active by default in RHEL) by verifying sysctl fs.protected_symlinks is set to 1. Additionally, restrict exposure on shared systems by setting the TMPDIR environment variable to a secure, user-private directory rather than a public shared path (e.g., export TMPDIR=/path/to/private_tmp).

🔗 References (5)