RHSA-2026:89197CriticalCVSS 8.8

Red Hat Security Advisory: OpenShift Container Platform 4.22.20 bug fix and security update

Published
October 27, 2026
Last Modified
October 30, 2026

🔗 CVE IDs covered (58)

CVE-2026-42011 →CVE-2026-68123 →CVE-2026-68257 →CVE-2026-89481 →CVE-2026-97417 →CVE-2026-5260 →CVE-2026-40467 →CVE-2026-90036 →CVE-2026-93207 →CVE-2026-94640 →CVE-2026-103111 →CVE-2025-35973 →CVE-2026-68108 →CVE-2026-80887 →CVE-2026-89894 →CVE-2026-114406 →CVE-2026-0799 →CVE-2026-64564 →CVE-2026-86138 →CVE-2026-86140 →CVE-2026-89972 →CVE-2026-93817 →CVE-2026-63387 →CVE-2026-86143 →CVE-2026-89663 →CVE-2026-63384 →CVE-2026-42013 →CVE-2026-63388 →CVE-2026-81003 →CVE-2026-19667 →CVE-2026-89690 →CVE-2026-90227 →CVE-2026-103262 →CVE-2026-59999 →CVE-2026-42012 →CVE-2026-63383 →CVE-2026-80274 →CVE-2026-80921 →CVE-2026-89669 →CVE-2026-93288 →CVE-2026-99999 →CVE-2026-8924 →CVE-2026-19953 →CVE-2026-40468 →CVE-2026-59995 →CVE-2026-86145 →CVE-2026-89161 →CVE-2026-86142 →CVE-2026-89811 →CVE-2026-93990 →CVE-2026-80792 →CVE-2026-89480 →CVE-2026-93228 →CVE-2026-19666 →CVE-2026-63382 →CVE-2026-63385 →CVE-2026-66046 →CVE-2026-86144 →

📋 Description

CVE-2025-35973 — kernel: hypervisor: Intel Processors: Privilege escalation in Ring 0 via improper value handling CVE-2026-0799 — libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access CVE-2026-5260 — gnutls: gnutls: Information disclosure via heap overread in RSA key exchange CVE-2026-8924 — curl: curl: Cookie injection via malicious HTTP server using super cookies CVE-2026-19666 — bind: BIND: Denial of Service via malformed DNS64 responses CVE-2026-19667 — bind9: bind: BIND 9: Denial of Service via 16-bit length truncation in DNS negative cache handling CVE-2026-19953 — URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-40467 — gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c CVE-2026-40468 — gawk: gawk: Memory corruption via integer overflow CVE-2026-42011 — gnutls: gnutls: Security bypass due to incorrect name constraint handling CVE-2026-42012 — gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs CVE-2026-42013 — gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name CVE-2026-59995 — openssh: OpenSSH: sftp client allows attacker to control downloaded file location CVE-2026-59999 — openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options CVE-2026-63382 — libevent: libevent: Multiple HTTP Parser Bugs Enable Request Smuggling CVE-2026-63383 — libevent: Libevent: Denial of Service via malformed RPC data CVE-2026-63384 — libevent: Libevent: Denial of Service via integer conversion error in evtag_unmarshal_header CVE-2026-63385 — libevent: Libevent: HTTP header handling bugs create risk of access control bypass. CVE-2026-63387 — libevent: Libevent: Off-by-one stack buffer overflow leading to denial of service or data corruption CVE-2026-63388 — libevent: Libevent: Arbitrary code execution via heap out-of-bounds write in AF_UNIX handling CVE-2026-64564 — kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing CVE-2026-66046 — expat: Expat: Denial of Service via quadratic complexity in attribute processing CVE-2026-68108 — kernel: drm/amdgpu/vce: fix integer overflow in image size CVE-2026-68123 — kernel: openvswitch: fix GSO userspace truncation underflow CVE-2026-68257 — kernel: drm/amdkfd: fix 32-bit overflow in CWSR total size calculation CVE-2026-80274 — bind: BIND: Denial of Service via crafted DNSSEC reply CVE-2026-80792 — kernel: ipv6: fix use-after-free in ip6_finish_output2() CVE-2026-80887 — kernel: drm/vmwgfx: use check_add_overflow for shader size+offset bound CVE-2026-80921 — kernel: KVM: s390: vsie: zero stale crypto bits CVE-2026-81003 — kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device CVE-2026-86138 — libxml2: libxml2: Arbitrary code execution via heap-based buffer overflow CVE-2026-86140 — libxml2: libxml2: Arbitrary code execution via stack-based buffer overflow in xmlSnprintfElements CVE-2026-86142 — libxml2: libxml2: Heap-based buffer overflow in xmlXPtrEval due to xpointer length saturation CVE-2026-86143 — libxml2: libxml2: Data integrity issues due to integer overflow in write callbacks CVE-2026-86144 — libxml2: libxml2: Information disclosure, SSRF, or denial of service due to improper parseFlags propagation. CVE-2026-86145 — pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions CVE-2026-89161 — pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match CVE-2026-89480 — kernel: nvme-tcp: reject a read that transferred too few bytes CVE-2026-89481 — kernel: nvme-tcp: fix host memory disclosure on R2T for a read command CVE-2026-89663 — kernel: nfsd: revoke copy-notify stateids before dropping their reference CVE-2026-89669 — kernel: nfsd: initialize copy-notify stateid before publishing it CVE-2026-89690 — kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF CVE-2026-89811 — kernel: drm/amdkfd: Add TLB flush after MES queue eviction/suspension CVE-2026-89894 — kernel: media: cx231xx: reject geometry changes while the VBI queue is busy CVE-2026-89972 — kernel: nvme: add missing SRCU grace period in error path CVE-2026-90036 — kernel: NFSD: Prevent client use-after-free during blocked-lock reaping CVE-2026-90227 — kernel: nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() CVE-2026-93207 — kernel: SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry CVE-2026-93228 — kernel: svcrdma: Reject Write/Reply chunks with segcount 0 CVE-2026-93288 — kernel: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state CVE-2026-93817 — kernel: perf: Fix addr_filter_ranges lifetime CVE-2026-93990 — expat: Expat: XML Injection via Malformed UTF-16 Input CVE-2026-94640 — rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service CVE-2026-97417 — kernel: netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() CVE-2026-99999 — kernel: ipv4: validate checksum_start before completing checksum CVE-2026-103111 — pcre2: pcre2: Out-of-bounds write via crafted regular expression CVE-2026-103262 — tornado: Tornado: Denial of Service via decompression bomb in CurlAsyncHTTPClient CVE-2026-114406 — ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns

🎯 Affected products5

  • Red Hat OpenShift Container Platform 4.22
  • rhcos-aarch64-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-ppc64le-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-s390x-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-x86_64-4.22.9.8.202610241758-0 as a component of Red Hat OpenShift Container Platform 4.22

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:de2f336eccccd7fb1ea129be52c9f0707c4f76e22c470c044fcbbe25cc77f813 (For s390x architecture) The image digest is sha256:0962c551381579fa9f69cfdee77946d34fc106f35d6ef0435bdcf5953e03a19e (For ppc64le architecture) The image digest is sha256:9d8ebfeb1e602b2e6899b412c2421a146f6286fcbff43c077134dea62ebfc9b2 (For aarch64 architecture) The image digest is sha256:7bb91006d7c9a001f6d78f42d4630d132fd606112f813897a8b2dc577e577866 All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: This is a hardware-level vulnerability in the affected Intel processors. There is no code-level fix available in Red Hat OpenShift sandboxed containers or other affected Red Hat components; the issue must be addressed at the processor firmware layer. Red Hat recommends that customers apply the latest CPU microcode or system firmware update from their hardware manufacturer. Intel has released microcode updates addressing this issue; see Intel Security Advisory INTEL-SA-01428 (https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01428.html) for affected processor families and update guidance. Intel has indicated that a further Trusted Computing Base (TCB) recovery is planned for this issue. Red Hat will update this guidance if additional remediation steps become necessary once that information is available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve Workaround: To mitigate this issue, disable the `dns64` feature in the BIND resolver configuration if it is not required. This can be done by removing or commenting out the `dns64` configuration block in `named.conf` or related configuration files. After modifying the configuration, the BIND service (`named`) must be reloaded or restarted for the changes to take effect. This action may temporarily interrupt DNS resolution services. Workaround: To reduce the exposure to this vulnerability, configure BIND 9 to forward all DNS queries to trusted, non-vulnerable upstream DNS servers. This prevents the local `named` instance from directly interacting with potentially malicious authoritative servers. Example configuration in `named.conf`: ``` options { forwarders { 192.0.2.1; 192.0.2.2; }; forward only; }; ``` Replace `192.0.2.1` and `192.0.2.2` with the IP addresses of your trusted upstream DNS servers. After modifying the configuration, restart the `named` service for the changes to take effect. This configuration may impact DNS resolution if the configured forwarders are unavailable or do not provide comprehensive resolution. Workaround: To mitigate this issue, users should avoid processing untrusted or maliciously crafted input with `gawk`. Exercise caution when executing `gawk` scripts or commands that process data from unknown or unverified sources. Workaround: Do not execute untrusted awk scripts or process untrusted inputs that could trigger oversized calculations in builtin.c. Workaround: To mitigate this issue, avoid using the `sftp server:/path .` command when connecting to untrusted or potentially malicious SFTP servers. Exercise caution and verify the authenticity of SFTP servers before initiating file transfers, especially when using commands that implicitly define the download destination, and also avoid running SFTP sessions with elevated privileges (such as root). Workaround: To mitigate this issue, if `DisableForwarding=yes` is set in `/etc/ssh/sshd_config` to prevent all forwarding, ensure that `PermitTunnel` is explicitly set to `no` in the same configuration file. This will enforce the intended security policy. After modifying `/etc/ssh/sshd_config`, restart the `sshd` service for the changes to take effect. This may temporarily interrupt active SSH sessions. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content: ``` install sctp /bin/true blacklist sctp ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix. Workaround: To mitigate, avoid parsing untrusted XML where possible. Where parsing is required, restrict sources using network controls and enforce strict limits on document size, attribute counts, and request rates at the application or proxy level. Additionally, apply strict execution timeouts to cap parser cost and interrupt processes before they can exhaust CPU resources. Workaround: If AMD GPU Video Codec Engine (VCE) functionality is not required, the `amdgpu` kernel module can be prevented from loading to mitigate this vulnerability. This can be achieved by blacklisting the module. To blacklist the `amdgpu` module, create a file named `/etc/modprobe.d/blacklist-amdgpu.conf` with the following content: ``` blacklist amdgpu ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This may impact graphics performance or functionality if AMD GPU features are in use. Workaround: To mitigate this issue, disable DNSSEC validation in the BIND resolver configuration. This can be achieved by setting `dnssec-enable no;` and `dnssec-validation no;` within the `options` block in `named.conf` or an included configuration file. A restart of the `named` service is required for the changes to take effect and may impact DNS resolution during the restart. Disabling DNSSEC validation will reduce the security posture of DNS resolution by removing integrity protection for DNS data. Workaround: To mitigate this vulnerability, prevent the vmwgfx kernel module from loading if VMware virtual graphics acceleration is not needed: 1. Create a configuration file to prevent the module from being loaded: # echo "install vmwgfx /bin/true" > /etc/modprobe.d/disable-vmwgfx.conf 2. If the module is currently loaded, reboot the system for the change to take effect: # reboot Warning: Disabling this module prevents VMware guest graphics acceleration and may impair graphical desktop environments running inside VMware virtual machines. A reboot is necessary if the driver is already active in memory. Workaround: Bound XML document and QName (prefix + local name) size before intern. Cap process …

🔗 References (61)