{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "Red Hat OpenShift Container Platform 4: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/red-hat--red-hat-openshift-container-platform-4/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/red-hat--red-hat-openshift-container-platform-4/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115449/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115449/",
   "title": "CVE-2026-115449 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.",
   "date_published": "2026-10-22T21:20:56Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-115424/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-115424/",
   "title": "CVE-2026-115424 · Red Hat OpenShift Container Platform 4 · disclosed",
   "content_text": "A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.",
   "date_published": "2026-10-22T21:12:27Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites.\n\nDue to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/almalinux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 10 (ca-certificates 2026.2.92_v9.0.319-100.3.el10_2)",
   "content_text": "Fixed versions: ca-certificates 2026.2.92_v9.0.319-100.3.el10_2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/almalinux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 8 (ca-certificates 2026.2.92_v9.0.319-81.3.el8_10)",
   "content_text": "Fixed versions: ca-certificates 2026.2.92_v9.0.319-81.3.el8_10.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/almalinux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in AlmaLinux 9 (ca-certificates 2026.2.92_v9.0.319-90.3.el9_8)",
   "content_text": "Fixed versions: ca-certificates 2026.2.92_v9.0.319-90.3.el9_8.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in openSUSE Tumbleweed (ca-certificates-mozilla 2.92-2.1)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-2.1.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/rocky-linux-10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in Rocky Linux 10 (ca-certificates 0:2026.2.92_v9.0.319-100.3.el10_2)",
   "content_text": "Fixed versions: ca-certificates 0:2026.2.92_v9.0.319-100.3.el10_2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/rocky-linux-8",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in Rocky Linux 8 (ca-certificates 0:2026.2.92_v9.0.319-81.3.el8_10)",
   "content_text": "Fixed versions: ca-certificates 0:2026.2.92_v9.0.319-81.3.el8_10.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/rocky-linux-9",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in Rocky Linux 9 (ca-certificates 0:2026.2.92_v9.0.319-90.3.el9_8)",
   "content_text": "Fixed versions: ca-certificates 0:2026.2.92_v9.0.319-90.3.el9_8.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.3 (ca-certificates-mozilla 2.92-150200.50.2)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.4 (ca-certificates-mozilla 2.92-150200.50.2)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-micro-5.5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.5 (ca-certificates-mozilla 2.92-150200.50.2)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Basesystem 15 SP7 (ca-certificates-mozilla 2.92-150200.50.2)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-module-for-development-tools-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Development Tools 15 SP7 (ca-certificates-mozilla-prebuilt 2.92-150200.50.3)",
   "content_text": "Fixed versions: ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-11-sp4-ltss-extreme-core",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE (openssl-certs 2.92-0.7.39.1)",
   "content_text": "Fixed versions: openssl-certs 2.92-0.7.39.1.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114406/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114406/",
   "title": "CVE-2026-114406 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ca-certificates-mozilla 2.92-150200.50.2 and 1 more)",
   "content_text": "Fixed versions: ca-certificates-mozilla 2.92-150200.50.2, ca-certificates-mozilla-prebuilt 2.92-150200.50.3.",
   "date_published": "2026-10-21T20:56:26Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114236/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114236/",
   "title": "CVE-2026-114236 · Red Hat Confidential Compute Attestation · disclosed",
   "content_text": "storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor\nlimit",
   "date_published": "2026-10-21T08:04:32Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92824/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92824/",
   "title": "CVE-2026-92824 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.",
   "date_published": "2026-10-21T03:18:41Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92822/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92822/",
   "title": "CVE-2026-92822 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.",
   "date_published": "2026-10-21T03:18:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92823/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92823/",
   "title": "CVE-2026-92823 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.",
   "date_published": "2026-10-21T03:18:37Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114038/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114038/",
   "title": "CVE-2026-114038 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).",
   "date_published": "2026-10-21T00:26:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-114038/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-114038/",
   "title": "CVE-2026-114038 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (multipath-tools 0.15.1-1)",
   "content_text": "Fixed versions: multipath-tools 0.15.1-1.",
   "date_published": "2026-10-21T00:26:49Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-16460/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-16460/",
   "title": "CVE-2026-16460 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.",
   "date_published": "2026-10-19T06:40:50Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89096/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89096/",
   "title": "CVE-2026-89096 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.",
   "date_published": "2026-10-16T23:06:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89096/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89096/",
   "title": "CVE-2026-89096 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (nfs-utils 1:3.1.1-1)",
   "content_text": "Fixed versions: nfs-utils 1:3.1.1-1.",
   "date_published": "2026-10-16T23:06:19Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · disclosed",
   "content_text": "A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · fixed in openSUSE Tumbleweed (libtirpc 1.3.8-1.1)",
   "content_text": "Fixed versions: libtirpc 1.3.8-1.1.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85977/fixed/red-hat-hummingbird-1",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85977/",
   "title": "CVE-2026-85977 · Red Hat Hardened Images · fixed in Red Hat hummingbird 1 (libtirpc 0:1.3.8-0.1.hum1 and 1 more)",
   "content_text": "Fixed versions: libtirpc 0:1.3.8-0.1.hum1, libtirpc-devel 0:1.3.8-0.1.hum1.",
   "date_published": "2026-10-16T18:20:43Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85231/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85231/",
   "title": "CVE-2026-85231 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.",
   "date_published": "2026-10-16T18:20:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-85231/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-85231/",
   "title": "CVE-2026-85231 · Red Hat Enterprise Linux 10 · fixed in openSUSE Tumbleweed (libtirpc 1.3.8-1.1)",
   "content_text": "Fixed versions: libtirpc 1.3.8-1.1.",
   "date_published": "2026-10-16T18:20:40Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89098/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89098/",
   "title": "CVE-2026-89098 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.",
   "date_published": "2026-10-16T17:43:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-89098/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-89098/",
   "title": "CVE-2026-89098 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (nfs-utils 1:3.1.1-1)",
   "content_text": "Fixed versions: nfs-utils 1:3.1.1-1.",
   "date_published": "2026-10-16T17:43:21Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111555/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111555/",
   "title": "CVE-2026-111555 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.",
   "date_published": "2026-10-16T12:19:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-111555/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-111555/",
   "title": "CVE-2026-111555 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (luksmeta 10-2)",
   "content_text": "Fixed versions: luksmeta 10-2.",
   "date_published": "2026-10-16T12:19:44Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · disclosed",
   "content_text": "A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.21",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.21 (cifs-utils 7.1-r1)",
   "content_text": "Fixed versions: cifs-utils 7.1-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.22",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.22 (cifs-utils 7.3-r1)",
   "content_text": "Fixed versions: cifs-utils 7.3-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.23",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.23 (cifs-utils 7.4-r1)",
   "content_text": "Fixed versions: cifs-utils 7.4-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/alpine-v3.24",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Alpine 3.24 (cifs-utils 7.5-r1)",
   "content_text": "Fixed versions: cifs-utils 7.5-r1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-13",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 13 (cifs-utils 2:7.4-1+deb13u1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1+deb13u1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Debian 14 (cifs-utils 2:7.9-1)",
   "content_text": "Fixed versions: cifs-utils 2:7.9-1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-espos",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-high-performance-computing-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.3",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.3 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-micro-5.5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Micro 5.5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-module-for-basesystem-15-sp7",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Module for Basesystem 15 SP7 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-12-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 12 SP5-LTSS (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp4-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP4-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp5-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP5-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-15-sp6-ltss",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server 15 SP6-LTSS (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp4",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP4 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP5 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-for-sap-applications-15-sp6",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server for SAP Applications 15 SP6 (cifs-utils 6.15-150400.3.27.1)",
   "content_text": "Fixed versions: cifs-utils 6.15-150400.3.27.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/suse-linux-enterprise-server-ltss-extended-security-12-sp5",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 (cifs-utils 6.9-13.32.2)",
   "content_text": "Fixed versions: cifs-utils 6.9-13.32.2.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-22.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 22.04 LTS (cifs-utils 2:6.14-1ubuntu0.7)",
   "content_text": "Fixed versions: cifs-utils 2:6.14-1ubuntu0.7.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-24.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 24.04 LTS (cifs-utils 2:7.0-2ubuntu0.6)",
   "content_text": "Fixed versions: cifs-utils 2:7.0-2ubuntu0.6.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.04-lts",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.04 LTS (cifs-utils 2:7.4-1ubuntu0.26.04.4)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu0.26.04.4.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-104715/fixed/ubuntu-26.10",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-104715/",
   "title": "CVE-2026-104715 · Red Hat Enterprise Linux 10 · fixed in Ubuntu 26.10 (cifs-utils 2:7.4-1ubuntu3.1)",
   "content_text": "Fixed versions: cifs-utils 2:7.4-1ubuntu3.1.",
   "date_published": "2026-10-16T06:47:10Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-92982/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-92982/",
   "title": "CVE-2026-92982 · Red Hat Ansible Automation Platform 2.6 · disclosed",
   "content_text": "A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.",
   "date_published": "2026-10-15T15:36:57Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86849/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86849/",
   "title": "CVE-2026-86849 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.",
   "date_published": "2026-10-14T17:52:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86849/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86849/",
   "title": "CVE-2026-86849 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86849/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86849/",
   "title": "CVE-2026-86849 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:15Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86856/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86856/",
   "title": "CVE-2026-86856 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.",
   "date_published": "2026-10-14T17:52:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86856/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86856/",
   "title": "CVE-2026-86856 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86856/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86856/",
   "title": "CVE-2026-86856 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:14Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86847/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86847/",
   "title": "CVE-2026-86847 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.",
   "date_published": "2026-10-14T17:52:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86847/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86847/",
   "title": "CVE-2026-86847 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86847/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86847/",
   "title": "CVE-2026-86847 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:12Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86846/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86846/",
   "title": "CVE-2026-86846 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.",
   "date_published": "2026-10-14T17:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86846/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86846/",
   "title": "CVE-2026-86846 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86846/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86846/",
   "title": "CVE-2026-86846 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:07Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86845/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86845/",
   "title": "CVE-2026-86845 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.",
   "date_published": "2026-10-14T17:52:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86845/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86845/",
   "title": "CVE-2026-86845 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86845/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86845/",
   "title": "CVE-2026-86845 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:06Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86566/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86566/",
   "title": "CVE-2026-86566 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.",
   "date_published": "2026-10-14T17:52:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86566/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86566/",
   "title": "CVE-2026-86566 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:52:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86566/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86566/",
   "title": "CVE-2026-86566 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:52:01Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86848/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86848/",
   "title": "CVE-2026-86848 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:08Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86567/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86567/",
   "title": "CVE-2026-86567 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T17:50:03Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · fixed in Debian 14 (dpdk 25.11.4-1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100236/fixed/opensuse-tumbleweed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100236/",
   "title": "CVE-2026-100236 · Red Hat Fast Datapath for RHEL 10 · fixed in openSUSE Tumbleweed (dpdk 25.11.4-1.1)",
   "content_text": "Fixed versions: dpdk 25.11.4-1.1.",
   "date_published": "2026-10-14T16:33:25Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-86565/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-86565/",
   "title": "CVE-2026-86565 · Red Hat Fast Datapath for RHEL 10 · disclosed",
   "content_text": "A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.",
   "date_published": "2026-10-14T16:08:22Z"
  }
 ]
}