RHSA-2026:95346CriticalCVSS 9.8

Red Hat Security Advisory: OpenShift Container Platform 4.22.22 bug fix and security update

Published
November 6, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (34)

CVE-2026-14456 →CVE-2026-52929 →CVE-2026-94300 →CVE-2026-94453 →CVE-2026-96888 →CVE-2025-31936 →CVE-2026-12080 →CVE-2026-26007 →CVE-2026-84782 →CVE-2026-98320 →CVE-2026-98725 →CVE-2026-18798 →CVE-2026-71226 →CVE-2026-77207 →CVE-2026-90011 →CVE-2026-98222 →CVE-2026-19630 →CVE-2026-63072 →CVE-2026-80824 →CVE-2026-63076 →CVE-2026-68376 →CVE-2026-77206 →CVE-2026-89777 →CVE-2026-90003 →CVE-2026-98364 →CVE-2026-111497 →CVE-2026-8458 →CVE-2026-77214 →CVE-2026-97313 →CVE-2026-98432 →CVE-2026-98466 →CVE-2026-8932 →CVE-2026-50252 →CVE-2026-64597 →

📋 Description

CVE-2025-31936 — kernel: microcode_ctl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM CVE-2026-8458 — curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8932 — libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse CVE-2026-12080 — qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys CVE-2026-14456 — openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server CVE-2026-18798 — openssl: QUIC server may trigger double free when processing INITIAL packet CVE-2026-19630 — bind: BIND: Denial of Service via unbounded processing of crafted DNS messages CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-50252 — unbound: Unbound: DNS cache poisoning via UDP source port predictability CVE-2026-52929 — kernel: sctp: stream: fully roll back denied add-stream state CVE-2026-63072 — openssl: heap buffer overflow in CMS key unwrapping CVE-2026-63076 — openssl: invalid pointer dereference in CMP server via crafted protectionAlg CVE-2026-64597 — kernel: smb: client: fix double-free in SMB2_close() replay CVE-2026-68376 — kernel: sctp: fix auth_hmacs array size in struct sctp_cookie CVE-2026-71226 — libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path CVE-2026-77206 — libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code CVE-2026-77207 — libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS CVE-2026-77214 — expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer CVE-2026-80824 — kernel: usb: usbfs: fix use-after-free of usb_device in usbdev_release() CVE-2026-84782 — openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission CVE-2026-89777 — kernel: vfio/pci: clear vdev->msi_perm after freeing it on init failure CVE-2026-90003 — kernel: futex: Prevent rcuwait use-after-free during requeue PI CVE-2026-90011 — kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload CVE-2026-94300 — bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94453 — libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP CVE-2026-96888 — bind: bind: Denial of Service via assertion failure during redirect processing CVE-2026-97313 — bind: bind: Denial of service via assertion failure in RPZ query processing CVE-2026-98222 — kernel: KEYS: encrypted: fix integer overflow of datablob_len CVE-2026-98320 — kernel: netfilter: flowtable: hold reference on ct until flow is released CVE-2026-98364 — kernel: xfrm: hold net_device reference under RCU in bundle creation CVE-2026-98432 — kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period CVE-2026-98466 — kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 CVE-2026-98725 — kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() CVE-2026-111497 — brotli: Out-of-Bounds Write in Google Brotli Decoder

🎯 Affected products5

  • Red Hat OpenShift Container Platform 4.22
  • rhcos-aarch64-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-ppc64le-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-s390x-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22
  • rhcos-x86_64-4.22.9.8.202611032353-0 as a component of Red Hat OpenShift Container Platform 4.22

✅ Remediation

For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follows: (For x86_64 architecture) The image digest is sha256:03bc1715c33a8a6de571bb9845ac07f93eebcc03a5ff6182494fcbb6dfeb49a5 (For s390x architecture) The image digest is sha256:a9601db1bd5d346d36995ae07f4afdea3e035a39c9eae27dbbfb6c520459b7ef (For ppc64le architecture) The image digest is sha256:9768a3f0ac725a5f42ac57510462f59ebd2263c1ab5db73a60abf95017cab28f (For aarch64 architecture) The image digest is sha256:908d6504efd530449459ad80d64ddf272ac7d832032be88bd37b19f17bf0fced All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli. Workaround: This vulnerability only affects systems using Intel Trust Domain Extensions (TDX) on Intel Xeon 6 processors. Systems not using Intel TDX are not vulnerable to this issue. Disabling Intel TDX, where feasible, removes the exposure to this vulnerability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: If the `guest-ssh-add-authorized-keys` command is not required, it can be disabled by adding it to the qemu-guest-agent block list (qemu-ga --block-rpcs). This prevents the vulnerable code path from being reached while preserving all other guest-agent functionality. Workaround: Option 1: Rate-limit or Firewall Inbound QUIC (UDP 443) [Goal: Slow or block QUIC Initial packets before they reach the vulnerable listener.] A. Confirm QUIC Exposure - Check if any service is listening on UDP 443: ~~~ $ ss -ulnp | grep ':443' # or $ sudo lsof -iUDP:443 -n -P ~~~ Note: If no service is listening on UDP 443, this CVE does not apply (TCP 443 is unaffected). B. Restrict Access to UDP 443 ( Default-deny UDP 443 and allow only trusted networks:) ~~~ $ sudo firewall-cmd --permanent --remove-service=quic 2>/dev/null $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="443" protocol="udp" accept' $ sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" port port="443" protocol="udp" drop' $ sudo firewall-cmd --reload ~~~ C. Verify - Confirm the restriction by testing from an external host (the connection should fail or be throttled): ~~~ $ nc -u -v YOUR_HOST 443 ~~~ Option 2: Disable QUIC Server If QUIC/HTTP3 is not required, remove the vulnerable code path entirely and use TLS/TCP instead. Recommended Mitigation Priority Priority : Action 1.Confirm UDP 443 QUIC listener exists and OpenSSL version is in affected range 2.Block or rate-limit UDP 443 at firewall/edge (immediate) 3.Disable QUIC/HTTP3 on the service if not needed 4.Upgrade OpenSSL to fixed release when available 5.Application owners: set SSL_VALUE_QUIC_MAX_PENDING_CONNS if default 256 is too high Workaround: Disable the so-reuseport option by explicitly setting so-reuseport: no in your unbound.conf file. This prevents the deterministic mapping of worker threads to outbound UDP source ports, effectively stopping the cache poisoning vector. Additionally, restrict who can query the resolver using the access-control directive to reduce the overall attack surface, and restart the Unbound service to apply the changes. Workaround: To mitigate this issue, prevent the `sctp` kernel module from loading. Create a file named `/etc/modprobe.d/disable-sctp.conf` with the following content: ``` install sctp /bin/true blacklist sctp ``` After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. Applications or services that rely on the SCTP protocol cannot use this mitigation and should prioritize applying the fix. Workaround: If SMB/CIFS client functionality is not required, the 'cifs' kernel module can be blocklisted to prevent it from loading. Systems that do not mount SMB/CIFS shares are not affected. For systems that require SMB client access, ensure connections are only made to trusted SMB servers. Workaround: To prevent the SCTP kernel module from loading, blacklist it by creating a file `/etc/modprobe.d/disable-sctp.conf` with the content `blacklist sctp`. Regenerate the initramfs using `dracut -f -v` (RHEL 8/9/10) or `mkinitrd -f -v /boot/initramfs-$(uname -r).img $(uname -r)` (RHEL 7), then reboot the system. This action may affect applications dependent on SCTP. Workaround: To mitigate this issue, applications should avoid initializing libkcapi handles with the `KCAPI_INIT_AIO` flag, preferring synchronous interfaces instead. If the real AIO path must be enabled, applications must ensure that `outiov` buffers are not immediately freed or reused after an error return, allowing all kernel completions to finish. This operational control prevents delayed kernel writes into potentially reallocated or freed memory. Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: Disable GSS-TSIG in the BIND configuration if Kerberos-authenticated dynamic DNS functionality is not required, or restrict network access to the DNS service using firewall controls. To disable GSS-TSIG, comment out or remove the `tkey-gssapi-keytab` and `tkey-gssapi-credential` directives within `/etc/named.conf` (and any referenced include files), then restart the service: systemctl restart named If operating named inside a chroot environment, execute: systemctl restart named-chroot Alternatively, restrict UDP and TCP traffic on port 53 to trusted network segments using host or network firewalls to block untrusted external access. Caveats: Disabling GSS-TSIG prevents clients from performing Kerberos-authenticated dynamic DNS modifications, which may disrupt environments relying on automated Active Directory or Identity Management (IdM) enrollment. Warning: Restarting the BIND service will momentarily interrupt active DNS query processing and domain name resolution for dependent network clients. Workaround: If IKE-over-TCP is not required, administrators can temporarily mitigate this vulnerability by setting `listen-tcp=no` in the Libreswan configuration. This disables the vulnerable IKE-over-TCP functionality. If IKE-over-TCP is required, administrators should restrict access to the listener to trusted peers where practical and apply the app…

🔗 References (38)