SB2026092189 - Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.19
Published: September 21, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 vulnerabilities.
1) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-4878)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to a time-of-check time-of-use race condition in libcap when performing operations subject to a time-of-check time-of-use condition. A local user can exploit the race condition to escalate privileges.
User interaction is required.
2) Out-of-bounds read (CVE-ID: CVE-2026-39979)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to a boundary condition in the "jv_parse_sized()" function. A remote attacker can trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.
3) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-40164)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to inefficient algorithmic complexity within hardcoded MurmurHash3 seed. A remote attacker can cause a denial of service condition on the target system.
4) Use-after-free (CVE-ID: CVE-2026-41035)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and disclose sensitive information.
The vulnerability exists due to use-after-free in receive_xattr() in xattrs.c when processing xattr data from a malicious rsync sender. A remote attacker can send specially crafted xattr metadata to cause a denial of service and disclose sensitive information.
Exploitation requires xattr transfer to be enabled. On Linux, additional conditions apply: the receiver must use --fake-super or an xattr filter that passes non-user namespace xattrs; on FreeBSD and macOS, configurations using xattrs are affected when more than one xattr is processed.
5) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-46300) Exploited
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to improper state management in skb_try_coalesce() when transferring paged fragments during TCP receive coalescing. A local user can trigger packet processing that moves shared fragments into an unmarked skb to cause memory corruption.
The issue can lead ESP input to incorrectly treat an uncloned nonlinear skb as not having shared fragments and perform in-place decryption over externally owned or page-cache-backed fragments.
Remediation
Install update from vendor's website.