RHSA-2026:94537CriticalCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 5.0.1 bug fix and security update

Published
November 9, 2026
Last Modified
November 12, 2026

🔗 CVE IDs covered (19)

CVE-2026-63072 →CVE-2026-77206 →CVE-2026-77207 →CVE-2026-94453 →CVE-2025-31936 →CVE-2026-14456 →CVE-2026-18798 →CVE-2026-26007 →CVE-2026-68376 →CVE-2026-98222 →CVE-2026-12080 →CVE-2026-77214 →CVE-2026-89777 →CVE-2026-90003 →CVE-2026-98320 →CVE-2026-98432 →CVE-2026-63076 →CVE-2026-71226 →CVE-2026-80824 →

📋 Description

CVE-2025-31936 — kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM CVE-2026-12080 — qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys CVE-2026-14456 — openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-18798 — openssl: QUIC server may trigger double free when processing INITIAL packet CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-63072 — openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63076 — openssl: invalid pointer dereference in CMP server via crafted protectionAlg CVE-2026-68376 — kernel: sctp: fix auth_hmacs array size in struct sctp_cookie CVE-2026-71226 — libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path CVE-2026-77206 — libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code CVE-2026-77207 — libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS CVE-2026-77214 — expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer CVE-2026-80824 — kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() CVE-2026-89777 — kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure CVE-2026-90003 — kernel: futex: Prevent rcuwait use-after-free during requeue PI CVE-2026-94453 — libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-98222 — kernel: KEYS: encrypted: fix integer overflow of datablob_len CVE-2026-98320 — kernel: netfilter: flowtable: hold reference on ct until flow is released CVE-2026-98432 — kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period

🎯 Affected products9

  • Red Hat OpenShift Container Platform 5.0
  • rhcos-aarch64-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-aarch64-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-ppc64le-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-ppc64le-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-s390x-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-s390x-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-x86_64-5.0.10.2.202611022203-0 as a component of Red Hat OpenShift Container Platform 5.0
  • rhcos-x86_64-5.0.9.8.202611022248-0 as a component of Red Hat OpenShift Container Platform 5.0

✅ Remediation

For OpenShift Container Platform 5.0 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:a43b861d912fad275f7c1c76cae38c2b5a33f4f1245807b376fe59707d3ef98a (For s390x architecture) The image digest is sha256:f6751e3ea690956d259ae46c4a13f72991ffdc971adf1fd4efd39421aabae4ef (For ppc64le architecture) The image digest is sha256:bab84a6ab4c6c8ad2e31b46e7ff912e3a88b4d33195447e2af7b2056e6f05c52 (For aarch64 architecture) The image digest is sha256:85501dcf8e8eca0c50fbe806f3352900f817aa65f4a68cf7a6bbbae627be4621 All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/5.0/html-single/updating_clusters/index#updating-cluster-cli. Workaround: This vulnerability only affects systems using Intel Trust Domain Extensions (TDX) on Intel Xeon 6 processors. Systems not using Intel TDX are not vulnerable to this issue. Disabling Intel TDX, where feasible, removes the exposure to this vulnerability. Workaround: If the `guest-ssh-add-authorized-keys` command is not required, it can be disabled by adding it to the qemu-guest-agent block list (qemu-ga --block-rpcs). This prevents the vulnerable code path from being reached while preserving all other guest-agent functionality. Workaround: Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.] A. Confirm QUIC Exposure - Check if any service is listening on UDP 443: ~~~ $ ss -ulnp | grep ':443' # or $ sudo lsof -iUDP:443 -n -P ~~~ Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected). B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:) ~~~ $ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept' $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop' $ sudo firewall-cmd --reload ~~~ C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled): ~~~ $ nc -u -v YOUR_HOST 443 ~~~ Option 2: Disable QUIC Server If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead. Recommended Mitigation Priority Priority : Action 1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range 2.Block or rate-limit UDP 443 at firewall/edge (immediate) 3.Disable QUIC/HTTP3 on the service if not needed 4.Upgrade OpenSSL to fixed release when available 5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To prevent the SCTP kernel module from loading, blacklist it by creating a file `/etc/modprobe.d/disable-sctp.conf` with the content `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (RHEL 8/9/10) or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (RHEL 7), then reboot the system. This action may affect applications dependent on SCTP. Workaround: To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. If IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the appropriate security update once available. Workaround: See the security bulletin for a detailed mitigation procedure.

🔗 References (22)