Important: kernel-livepatch-6.18.51-120.162

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.51-120.162 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.51-120.163

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.51-120.163 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.48-109.150

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.48-109.150 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.188-233.393

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.188-233.393 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.103-127.188

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.12.103-127.188 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.54-121.166

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.54-121.166 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: mariadb

Issue Overview: MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, STAsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does n...

Important: nautilus

Issue Overview: A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a...

Medium: polkit

Issue Overview: A flaw was found in polkit. A regression in the fix for CVE-2026-4897 introduced a stack buffer underflow out-of-bounds read in the readcookie function of the polkit-agent-helper-1 setuid helper. When an empty cookie is read from standard input, the string-length computation...

Medium: lvm2

Issue Overview: A flaw was found in libdm. A remote attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command...

Medium: rust

Issue Overview: gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1. CVE-2026-82247 gitoxide before 0.38.2 fails to validate carriage return characters in URL...

Medium: rust

Issue Overview: gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1. CVE-2026-82247 gitoxide before 0.38.2 fails to validate carriage return characters in URL...

Important: aws-workload-credentials-provider

Issue Overview: rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1...

Important: rclone

Issue Overview: rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64...

Important: kernel-livepatch-6.12.110-135.202

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.12.110-135.202 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.103-129.197

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.12.103-129.197 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: docker

Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...

Important: amazon-efs-utils

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

Important: ruby3.4

Issue Overview: An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an...

Important: glibc

Issue Overview: A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexical...

Important: glibc

Issue Overview: A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexical...

Important: freerdp

Issue Overview: FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sending out-of-order messages. Attackers can send a Geometry CLEAR message that nulls presentation-geometry, then send...

Important: glib-networking

Issue Overview: A flaw was found in glib-networking. When establishing connections using Transport Layer Security TLS version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive sessio...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: cifs: validate DFS referral string offsets CVE-2026-72318 In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use CVE-2026-74752 In the Linux kernel, the...

Medium: python3.12

Issue Overview: tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to...

Important: librsvg2

Issue Overview: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the...

Important: librsvg2

Issue Overview: A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions Xincludes with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that is still in use by the...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: vhost: fix vhostgetavailidx for a non empty ring CVE-2026-74356 In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use CVE-2026-74752 In the Linux kernel, t...

Medium: python3.14

Issue Overview: tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to...

Medium: perl-URI

Issue Overview: URI::idna::nameprep only lowercased the label and skipped the Unicode normalization that RFC 3490/3491 require. As a result, a host that was not already in NFC encoded to a non-standard A-label that disagrees with what browsers, curl, Go, Java, and Python compute for the same inpu...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ACPI: platform: Use acpibusgetprimarydevice CVE-2026-100072 In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfrefcount field as unique CVE-2026-100074 In the Linux kernel, the...

Important: python-mistune

Issue Overview: Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parselinktext that allows remote attackers to cause denial of service through unbalanced square brackets. Attackers can submit markdown containing long runs of unmatched brackets to mistune.html,...

Medium: rust

Issue Overview: gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic,...

Medium: rust-cargo-c

Issue Overview: gitoxide's gix-url crate ?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions = 0.49.0 fixed in 0.58.1. CVE-2026-82247 Affected Packages: rust-cargo-c Issue Correction: Run dnf update rust-cargo-c...

Important: jackson-core

Issue Overview: StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values...

Important: gnome-remote-desktop

Issue Overview: A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By...

Medium: perl-podlators

Issue Overview: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap subtracts from the output width to get the space available for text...

Important: jackson-databind

Issue Overview: PolymorphicTypeValidator bypass via generic type arguments and array element types in jackson-databind allows arbitrary class instantiation incomplete fix for CVE-2026-54512 CVE-2026-110879 CVE-2026-110879 Affected Packages: jackson-databind Issue Correction: Run dnf update...

Important: python-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, caller-supplied prompt text can become executable syntax in the bash activation prompt. An attacker must influence the value passed to virtualenv, and a user must subsequently activate the...

Important: python3.13-virtualenv

Issue Overview: virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination...

Medium: rust

Issue Overview: gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic,...

Medium: bouncycastle

Issue Overview: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS before 2.73.12. CVE-2026-12185 In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce...

Important: python-pillow

Issue Overview: Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand allocates a non-empty output and then faults while replicating edges by reading the first pixel from empty input storage;...

Important: kernel-livepatch-6.12.100-125.179

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.12.100-125.179 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.48-107.148

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.18.48-107.148 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.188-233.386

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.188-233.386 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.188-233.385

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.188-233.385 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.1.186-228.376

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period CVE-2026-98432 Affected Packages: kernel-livepatch-6.1.186-228.376 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: rpm

Issue Overview: A heap-based buffer overflow flaw was found in rpm. RPMTAGFILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of...

Important: rpm

Issue Overview: A heap-based buffer overflow flaw was found in rpm. RPMTAGFILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content -- of...