Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ksm: use range-walk function to jump over holes in scangetnextrmapitem CVE-2025-68211 kernel: ip6tunnel: use skbvlaninetprepare in ip6tnlrcv CVE-2026-23003 kernel: netfilter:...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-core (UTSA-2026-093036)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093036 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mx4j (UTSA-2026-093031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093031 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

OPENSUSE-SU-2026:11615-1 python313-GitPython-3.1.59-3.1 on GA media

These are all security issues fixed in the python313-GitPython-3.1.59-3.1 package on the GA media of openSUSE Tumbleweed...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098875)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098875 advisory. In the Linux kernel, the following vulnerability has been resolved: net: use skbheaderpointer for TCPv4 GSO fragoff check Syzbot reported a KMSAN uninit-value warnin...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098756)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098756 advisory. In the Linux kernel, the following vulnerability has been resolved: schhfsc: make hfscqlennotify idempotent hfscqlennotify is not idempotent either and not friendly ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: metrics (UTSA-2026-093160)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093160 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-build-tools (UTSA-2026-022370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022370 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-57171

Trestle (compliance-trestle), a Python SDK and CLI for managing OSCAL compliance documents, is affected by an arbitrary file write via path traversal in the catalog-generate, profile-generate, and ssp-generate author commands. The output argument is joined onto the Trestle root but guarded only b...

CVE-2026-57171 Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)

Compliance-trestle Trestle is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author commands write generated Markdown to an attacker-influenced output...

CVE-2026-57170

compliance-trestle (Trestle), a Python SDK for managing OSCAL compliance documents, is vulnerable to server-side template injection in versions prior to 3.12.4 and 4.0.0 through 4.0.3. The custom Jinja2 include tags (mdsection_include and md_clean_include) re-parse included Markdown file content ...

CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

DEBIAN-CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssl: openssl-3.5.8-0.1.hum1 aarch64, x8664 openssl-config-fips-3.5.8-0.1.hum1 aarch64, x8664 openssl-devel-3.5.8-0.1.hum1 aarch64, x8664 openssl-devel-engine-3.5.8-0.1.hum1 aarch64, x8664...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: openssl3: openssl3-devel-3.5.8-0.1.hum1 aarch64, x8664 openssl3-devel-engine-3.5.8-0.1.hum1 aarch64, x8664 openssl3-libs-3.5.8-0.1.hum1 aarch64, x8664 openssl3-3.5.8-0.1.hum1.src src...

CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

CVE-2026-65637

Apache Tomcat contains an improper input validation vulnerability in its HTTP/2 implementation where the fix for CVE-2026-32990 (strict SNI validation) was incomplete, allowing a no-authority bypass of strict SNI validation . The issue affects 11.0.20–11.0.24 , 10.1.53–10.1.57 , and 9.0.115–9.0.1...

CVE-2026-65637 Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...

CVE-2026-65637

Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to version 11.0.25, 10.1.58 or 9.0.121,...