RHSA-2026:94537: Critical: OpenShift Container Platform 5.0.1 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.This advisory contains the container images for Red Hat OpenShift Container Platform 5.0.1. See the following advisory for the RPM packages for this release:https://access.redhat.com/errata/RHBA-2026:94536 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:https://docs.redhat.com/en/documentation/openshiftcontainerplatform/5.0/html/releasenotes/ Security Fix(es): kernel: ipv4: free inetopt and ireqopt after an RCU grace period (CVE-2026-98432) qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080) openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) kernel: sctp: fix authhmacs array size in struct sctpcookie (CVE-2026-68376) expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer (CVE-2026-77214) kernel: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease() (CVE-2026-80824) kernel: vfio/pci: clear vdev->msiperm after freeing it on init failure (CVE-2026-89777) libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) kernel: KEYS: encrypted: fix integer overflow of databloblen (CVE-2026-98222) kernel: microcodectl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936) openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226) libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003) kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.All OpenShift Container Platform 5.0 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshiftcontainerplatform/5.0/html-single/updatingclusters/index#updating-cluster-cli.

— Red Hat