CVE-2026-101295: Improper Limitation of a Pathname to a Restricted Directory

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

PT-2026-103278

Name of the Vulnerable Software and Affected Versions oc-mirror affected versions not specified Red Hat Assisted Installer for OpenShift Container Platform affected versions not specified OpenShift Container Platform affected versions not specified Description A path traversal and arbitrary file...

CVE-2026-75939

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-75939

CVE-2026-75939 affects openshift/oc-mirror , where the PGP release image signature verification incorrectly checks for signature errors before the entire signed body is consumed. This ordering flaw allows a remote attacker who intercepts or manipulates traffic to the signature endpoint to craft a...

EUVD-2026-83918

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-75939 Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-75939 Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

CVE-2026-75939

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

PT-2026-96112

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 affected versions not specified Description A flaw in the oc-mirror tool allows for the bypass of PGP Pretty Good Privacy release image signature verification. The tool incorrectly checks for signature...

CVE-2026-75939: Improper Verification of Cryptographic Signature

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP Pretty Good Privacy release image signatures by checking for signature errors before the entire signed body is processed, leading to a bypass of the signature verification. A remote attacker, by intercepting or manipulatin...

Linux Distros Unpatched Vulnerability : CVE-2026-90433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with...

DEBIAN-CVE-2026-90433

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

AZL-102828 CVE-2026-90433 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90433

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

EUVD-2026-82094

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90433 spi: oc-tiny: switch to managed controller allocation

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90433 spi: oc-tiny: switch to managed controller allocation

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

CVE-2026-90433

CVE-2026-90433 affects the Linux kernel's spi: oc-tiny driver . A use-after-free vulnerability exists due to a mismatch in allocation management: the controller is allocated with the non-managed spi_alloc_host() while the interrupt is registered with devm_request_irq(). During device removal, the...

CVE-2026-90433: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: spi: oc-tiny: switch to managed controller allocation The controller is allocated with the non-managed spiallochost while the interrupt is registered with devmrequestirq. During removal, spibitbangstop only unregisters the...

PT-2026-94781

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the oc-tiny SPI driver where the controller is allocated using the non-managed spi alloc host function while the interrupt is registered via devm request irq. During t...