RHSA-2026:81391MediumCVSS 6.3

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Published
October 12, 2026
Last Modified
November 7, 2026

🔗 CVE IDs covered (3)

CVE-2026-108119 →CVE-2026-88842 →CVE-2026-92205 →

📋 Description

CVE-2026-88842 — busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption CVE-2026-92205 — busybox: busybox: Arbitrary file creation via directory traversal CVE-2026-108119 — busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses CVE-2026-26158 fix

🎯 Affected products11

  • Red Hat Hardened Images
  • busybox-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images
  • busybox-1:1.37.0-9.4.hum1@src as a component of Red Hat Hardened Images
  • busybox-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • busybox-petitboot-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-petitboot-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images
  • busybox-petitboot-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images
  • busybox-shared-1:1.37.0-9.4.hum1@aarch64 as a component of Red Hat Hardened Images
  • busybox-shared-1:1.37.0-9.4.hum1@s390x as a component of Red Hat Hardened Images
  • busybox-shared-1:1.37.0-9.4.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Do not use BusyBox dpkg for package management on systems where package integrity is critical. Remove packages one at a time if BusyBox dpkg must be used. Upstream should reset field_start at the beginning of each stanza iteration in write_status_file(). Workaround: Avoid extracting untrusted archives using BusyBox's built-in extraction utilities. If archive extraction is strictly necessary, utilize fully featured alternatives like GNU tar within a restricted privilege environment. Workaround: Avoid extracting tar archives from untrusted sources using busybox, especially with elevated privileges or into a directory that will be reused for a subsequent extraction. If untrusted archives must be processed, extract into a freshly created, isolated directory with minimal privileges on a single filesystem boundary and discard it (including any links left on disk) after each extraction.

🔗 References (7)