CERT-FR flags multiple vulnerabilities in Red Hat products (RHEL, CodeReady Linux Builder) enabling security bypass and DoS
CERT-FR published advisory CERTFR-2026-AVI-1373 on multiple vulnerabilities in Red Hat products, mainly Red Hat Enterprise Linux and CodeReady Linux Builder across many architectures and support streams. According to the advisory, some flaws allow an attacker to bypass the security policy, cause a denial of service, or exploit an unspecified security issue. The advisory lists about 50 CVEs and 22 Red Hat security bulletins (RHSA) issued between 16 and 22 October 2026. It does not report active exploitation and gives no CVSS scores or per-CVE mapping.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1373 covers about 50 CVEs in Red Hat Enterprise Linux and CodeReady Linux Builder, including the Real Time, Real Time for NFV and SAP Solutions variants. It says some flaws let an attacker bypass the security policy, cause a denial of service, or exploit a security issue the vendor did not specify. It gives no CVSS scores, no component, no attacker requirements and no mapping from each CVE to an impact. Affected streams are RHEL 6 (ELS), 7 (ELS), 8, 9 and 10 on x86_64, aarch64, s390x and ppc64le, including EUS, AUS, TUS, 4-years-of-updates and Extended Life Cycle. Fixes are in 22 RHSA bulletins dated 16 to 22 October 2026. The advisory does not report active exploitation.
Como foi descoberta
The advisory only says that multiple vulnerabilities were discovered in Red Hat products. It does not say who found them, how, or when they were reported. It reached the public as a CERT-FR advisory published on 23 October 2026, pointing to the Red Hat security bulletins (RHSA) for the fixes.
Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:19.
Detalhes técnicos
- Impacts: security policy bypass, denial of service, unspecified security issue.
- Affected: RHEL 6 (ELS), 7 (ELS), 8, 9 and 10 for x86_64, ARM 64 (aarch64), IBM z Systems (s390x) and Power little endian (ppc64le), including EUS, AUS, TUS, 4-years-of-updates, Extended Life Cycle and Update Services for SAP Solutions streams; Real Time and Real Time for NFV; CodeReady Linux Builder.
- Bulletins: RHSA-2026:83707, 83738, 83739, 83775, 83796, 83797, 84677, 84793, 85000, 85774, 85928, 86089, 87086, 87098, 87264, 87374, 87375, 87822, 88204, 88206, 88477.
- CVEs referenced include CVE-2025-38147, CVE-2025-68745 and numerous CVE-2026-xxxxx identifiers; the advisory does not tie each CVE to a specific flaw or product.
Remediação
- Apply the fixes in the relevant Red Hat security bulletins (RHSA) for the installed RHEL stream and architecture, as CERT-FR directs.
Linha do tempo
-
CERT-FR flags multiple vulnerabilities in Red Hat products (RHEL, CodeReady Linux Builder) enabling security bypass and DoS
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1373 on multiple vulnerabilities in Red Hat products, mainly Red Hat Enterprise Linux and CodeReady Linux Builder across many architectures and support streams. According to the advisory, some flaws allow an attacker to bypass the security policy, cause a denial of service, or exploit an unspecified security issue. The advisory lists about 50 CVEs and 22 Red Hat security bulletins (RHSA) issued between 16 and 22 October 2026. It does not report active exploitation and gives no CVSS scores or per-CVE mapping.
Technical Details
- Impacts: security policy bypass, denial of service, unspecified security issue.
- Affected: RHEL 6 (ELS), 7 (ELS), 8, 9 and 10 for x86_64, ARM 64 (aarch64), IBM z Systems (s390x) and Power little endian (ppc64le), including EUS, AUS, TUS, 4-years-of-updates, Extended Life Cycle and Update Services for SAP Solutions streams; Real Time and Real Time for NFV; CodeReady Linux Builder.
- Bulletins: RHSA-2026:83707, 83738, 83739, 83775, 83796, 83797, 84677, 84793, 85000, 85774, 85928, 86089, 87086, 87098, 87264, 87374, 87375, 87822, 88204, 88206, 88477.
- CVEs referenced include CVE-2025-38147, CVE-2025-68745 and numerous CVE-2026-xxxxx identifiers; the advisory does not tie each CVE to a specific flaw or product.
Remediation
- Apply the fixes in the relevant Red Hat security bulletins (RHSA) for the installed RHEL stream and architecture, as CERT-FR directs.