Red Hat Openshift

SSSD PAM Responder NULLPtr DoS (CVE2026127101)
CVE-2026-127101 5.5 - Medium - November 12, 2026

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.

NULL Pointer Dereference

SSSD PAM responder NULL ptr deref via malformed OAuth2 JSON
CVE-2026-127100 5.5 - Medium - November 12, 2026

A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.

NULL Pointer Dereference

SSSD RSA cert to SSH key stack buffer overflow (CVE2026127099)
CVE-2026-127099 5.9 - Medium - November 12, 2026

A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.

Stack Overflow

systemd-gpt-auto-generator auto-mount enables TEE memory leak in OpenShift
CVE-2026-121876 7.9 - High - November 12, 2026

A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.

Privacy violation

XFSprogs xfs_admin Command Injection (Local PrivEsc)
CVE-2026-108472 7.8 - High - November 11, 2026

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.

Shell injection

Podman Auto-Update Metadata Label DoS via Malicious Image
CVE-2026-121885 6.5 - Medium - November 10, 2026

A flaw was found in Podman. An attacker can trigger a Denial of Service (DoS) by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container and auto-update processes it, arbitrary system services are restarted with the user's privileges, potentially allowing an attacker to shut down the host system when Podman runs with administrative privileges.

Reliance on Untrusted Inputs in a Security Decision

libstdc++ buffer overflow on failed bytebybyte writes (DoS/Corruption)
CVE-2026-125709 4.2 - Medium - November 10, 2026

A flaw was found in libstdc++. When a byte-by-byte write operation fails during file stream processing, the library may still append data into the internal memory buffer. An attacker capable of inducing repeated write failures in an affected service can trigger a buffer overflow, potentially resulting in a Denial of Service (DoS) or memory corruption.

Memory Corruption

Ansible-Core git module argument injection (CVE-2026-84503)
CVE-2026-84503 6.7 - Medium - November 09, 2026

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

Argument Injection

OpenShift approve-csr.service signs any CSR without validation
CVE-2026-19706 8.3 - High - November 09, 2026

During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window.

Missing Authentication for Critical Function

Podman seccomp AF_VSOCK/NETLINK_AUDIT bypass via 64-bit int truncation
CVE-2026-123876 4.4 - Medium - November 06, 2026

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules.

Denylist / Deny List

Ansiblecore User Module Symlink PrivEsc via SSH Key Generation
CVE-2026-123037 6.7 - Medium - November 06, 2026

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

insecure temporary file

OpenShift Bare Metal: Unsecured HTTP Server Exposes Images & Pull Secret
CVE-2026-82976 7.1 - High - November 03, 2026

A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info("Open", "path", name) if name == "/" { return f, nil } ... ``` **cmd/controller/main.go file server bound on all interfaces without auth or TLS** ```go http.Handle("/", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default ":8084" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"}, ... ``` ### Attack Pattern Adjacent provisioning-network client GET / lists UUID image names download ISO/initramfs extract embedded Ignition recover cluster pull secret and SSH key.

Exposure of Information Through Directory Listing

Queue Pointer Corruption in libslirp => Host DoS via Burst Traffic
CVE-2026-120831 6.5 - Medium - November 03, 2026

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.

Memory Corruption

libslirp ICMP error out-of-bounds heap read in Red Hat QEMU
CVE-2026-120830 7.4 - High - November 03, 2026

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

Out-of-bounds Read

json-glib Denial of Service via Infinite Loop in JSONPath Slice Evaluator
CVE-2026-120194 7.5 - High - October 31, 2026

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

Infinite Loop

gcc libstdc++ std::from_chars OOB Read DoS
CVE-2026-115456 3.7 - Low - October 30, 2026

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, potentially leading to invalid data parsing or an application crash.

Out-of-bounds Read

Stack Buffer Overflow in GCC libstdc++ Bitset Extraction
CVE-2026-115455 6.5 - Medium - October 30, 2026

A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).

Memory Corruption

GCC libstdc++ integer wrap in std::vector<bool> leads to DoS
CVE-2026-114691 5.9 - Medium - October 30, 2026

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.

Integer Overflow or Wraparound

GCC libstdc++ Parallel Search OOB Buffer DoS
CVE-2026-114690 6.2 - Medium - October 30, 2026

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).

Memory Corruption

Red Hat Enterprise Linux 9 Kernel: local_bh imbalance in seg6_input_core() leads to softirq starvati
CVE-2026-118593 5.9 - Medium - October 30, 2026

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.

Improper Locking

RCE through Unverified Script Download in OpenShift Ansible Installer
CVE-2026-92092 7.4 - High - October 29, 2026

A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts without integrity verification. A remote attacker, by performing a Man-in-the-Middle (MITM) attack or compromising the HTTP server providing these scripts, could substitute an arbitrary executable. This malicious executable would then run with the installer's user ID (UID) and full cluster-provisioning privileges, leading to arbitrary code execution.

Download of Code Without Integrity Check

dnsmasq DHCPv6 Hostname OOB Read on Local Network
CVE-2026-93009 4.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.

Out-of-bounds Read

dnsmasq DHCP Leasequery Allows Local Network to Leak Lease Data
CVE-2026-93010 4.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on.

AuthZ

dnsmasq TFTP cache reuse allows malicious PXE boot
CVE-2026-93006 6.8 - Medium - October 29, 2026

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

Operation on a Resource after Expiration or Release

DNSMASQ TCP Connection Flood causing DNS Service Denial
CVE-2026-93007 5.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

Resource Exhaustion

dnsmasq DNSSEC buffer overrun, allows heap metadata overwrite
CVE-2026-93011 5.3 - Medium - October 29, 2026

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

Memory Corruption

dnsmasq CNAME Cache Pollution via Unverified DNS Response
CVE-2026-93008 6.8 - Medium - October 29, 2026

A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.

Insufficient Verification of Data Authenticity

Polkit Int Underflow in Auth Agent Causing DoS
CVE-2026-85498 3.5 - Low - October 29, 2026

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

Out-of-bounds Read

Samba vfs_ceph_rgw openat() Access Control Bypass (CVE-2026-109411)
CVE-2026-109411 8.1 - High - October 28, 2026

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When a client requests an existing file using mismatched character casing, the module fails to perform a case-insensitive lookup correctly, causing the server to treat the operation as creating a new file. As a result, the server skips standard permission checks on the existing file, allowing the attacker to access or overwrite sensitive data owned by other users.

Improper Handling of Case Sensitivity

gssproxy NULL pointer deref DoS via unauthenticated GSSX request
CVE-2026-116497 5.5 - Medium - October 26, 2026

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.

NULL Pointer Dereference

libslirp ICMP Echo Reply Length Mismatch Leak (CVE2026115449)
CVE-2026-115449 3.5 - Low - October 22, 2026

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

Information Disclosure

OpenShift oc image extract symlink traversal leads to arbitrary write
CVE-2026-115424 5.5 - Medium - October 22, 2026

A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory.

Symlink following

Red Hat ca-certificates RPM Weak Intermediate CA Trust Bypass
CVE-2026-114406 6.8 - Medium - October 21, 2026

The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

Improper Certificate Validation

Go containers/storage FD leak in ApplyLayer/ApplyUncompressedLayer
CVE-2026-114236 3.3 - Low - October 21, 2026

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process file descriptor limit

Missing Release of Resource after Effective Lifetime

Red Hat libmodulemd OOB Read in YAML Serialization (CVE-2026-92824)
CVE-2026-92824 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.

Out-of-bounds Read

libmodulemd DOS via unlimited nested YAML xmd recursion
CVE-2026-92822 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.

Stack Exhaustion

Red Hat libmodulemd DoS via Unbounded Decompression Size
CVE-2026-92823 6.2 - Medium - October 21, 2026

A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.

Data Amplification

Linux device-mapper-multipath OOB read/DoS
CVE-2026-114038 5.1 - Medium - October 21, 2026

A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).

Out-of-bounds Read

bootc/ostree: Bypass Image Signature Validation on Reboot
CVE-2026-16460 7.4 - High - October 19, 2026

A flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot.

Insufficient Verification of Data Authenticity

Bootc SigPolicy Flaw Enables Unsigned Image Exec as Root
CVE-2026-16487 - October 19, 2026

nfs-utils rpc.statd DoS via Memory Leak
CVE-2026-89096 5.9 - Medium - October 16, 2026

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

Missing Release of Resource after Effective Lifetime

libtirpc Denial of Service via Unbounded PMAPPROC_DUMP Decoding
CVE-2026-85977 5.3 - Medium - October 16, 2026

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion.

Excessive Platform Resource Consumption within a Loop

libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS Data
CVE-2026-85231 6.5 - Medium - October 16, 2026

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate.

Allocation of Resources Without Limits or Throttling

Local DoS via fsidd assertion failure in nfs-utils
CVE-2026-89098 5.5 - Medium - October 16, 2026

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

assertion failure

LUKSmeta boundary validation flaw allows metadata overwrite and data loss
CVE-2026-111555 6 - Medium - October 16, 2026

A flaw was found in luksmeta. Improper boundary validation of metadata slots allows an attacker capable of supplying or modifying a disk header to redirect wipe or load operations outside the intended metadata area. An attacker could exploit this vulnerability by providing a crafted header with valid checksums to overwrite or zero out encrypted payload data, resulting in persistent data loss and corrupted storage. Exploitation typically requires privileged access to modify raw block devices or the ability to induce an administrator to process an untrusted disk image.

Improper Validation of Specified Index, Position, or Offset in Input

cifs-utils LPE via Unsanitized CIFS Mount Options (Privilege Escalation)
CVE-2026-104715 7.8 - High - October 16, 2026

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System (CIFS) share using a user-controlled credentials file, input values are not properly sanitized before being assembled into mount options. A local attacker can exploit this vulnerability to inject unauthorized mount options, allowing them to bypass permission checks and execute files with administrative (root) privileges.

Argument Injection

Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEsc
CVE-2026-92982 8.5 - High - October 15, 2026

A flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions.

1336

DPDK vhost-crypto Integer Overflow, Host Buffer Overrun
CVE-2026-86849 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.

Memory Corruption

DPDK nfp vDPA Driver Buffer Overflow via Excess Virtqueues
CVE-2026-86856 6.5 - Medium - October 14, 2026

A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.

Memory Corruption

DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back Chain
CVE-2026-86847 6.5 - Medium - October 14, 2026

A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.

Access of Uninitialized Pointer