Red Hat Enterprise Linux 9.0

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

Gimp: gimp: arbitrary code execution or denial of service via buffer overflow in gif image processing

Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function

Cri-o: /etc/passwd tampering privesc

Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Libsolv: heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data

Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the user, where a fail pass occurs in the gru_check_chiplet_assignment function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

parport: Proper fix for array out-of-bounds access

Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382)

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

Binutils: binutils: arbitrary code execution via malformed xcoff object file processing

Gimp: gimp dds plug-in heap-based buffer overflow via bpp mismatch in load_layer() (ddsread.c)

ice: fix double-free of tx_buf skb

netfilter: nat: use kfree_rcu to release ops

Virtio-win: virtio-win: memory corruption via use-after-free in virtio blk device reset

drm/gem: Try to fix change_handle ioctl, attempt 4

Keycloak: offline session token dos

Tracker-miners: sandbox escape

Podman: kernel: containers in shared ipc namespace are vulnerable to denial of service attack

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records.

Samba: infinite loop in mdssvc rpc service for spotlight

A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x**

Rsync: info leak via uninitialized stack contents

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue results from the lack of proper handling of user-supplied data, which can lead to an assertion failure. This may allow an unauthenticated remote attacker to create a denial of service condition on the system.

Squid: dos against http and https

Rsync: --safe-links option bypass leads to path traversal

Undertow: outofmemoryerror due to @multipartconfig handling