RHSA-2026:95346: Critical: OpenShift Container Platform 4.22.22 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.22. See the following advisory for the RPM packages for this release:https://access.redhat.com/errata/RHBA-2026:95345 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.22/html/releasenotes/ Security Fix(es): kernel: ipv4: free inetopt and ireqopt after an RCU grace period (CVE-2026-98432) curl: libcurl: Unauthorized connection reuse due to a logical error (CVE-2026-8458) qemu-kvm: qemu-guest-agent: Local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (CVE-2026-12080) openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server (CVE-2026-14456) bind: BIND: Denial of Service via unbounded processing of crafted DNS messages (CVE-2026-19630) cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves (CVE-2026-26007) kernel: smb: client: fix double-free in SMB2close() replay (CVE-2026-64597) kernel: sctp: fix authhmacs array size in struct sctpcookie (CVE-2026-68376) expat: expat: Information disclosure via heap buffer over-read in XMLParseBuffer (CVE-2026-77214) kernel: usb: usbfs: fix use-after-free of usbdevice in usbdevrelease() (CVE-2026-80824) openssl: compat-openssl: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (CVE-2026-84782) kernel: vfio/pci: clear vdev->msiperm after freeing it on init failure (CVE-2026-89777) kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay (CVE-2026-94300) libreswan: IKEv2 Use-After-Free bug when using IKE-over-TCP (CVE-2026-94453) bind: bind: Denial of Service via assertion failure during redirect processing (CVE-2026-96888) bind: bind: Denial of service via assertion failure in RPZ query processing (CVE-2026-97313) kernel: KEYS: encrypted: fix integer overflow of databloblen (CVE-2026-98222) kernel: xfrm: hold netdevice reference under RCU in bundle creation (CVE-2026-98364) kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466) kernel: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge() (CVE-2026-98725) brotli: Out-of-Bounds Write in Google Brotli Decoder (CVE-2026-111497) kernel: microcodectl: Intel Xeon 6 Processors: Privilege escalation via improper memory range handling in SMM (CVE-2025-31936) libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse (CVE-2026-8932) openssl: QUIC server may trigger double free when processing INITIAL packet (CVE-2026-18798) unbound: Unbound: DNS cache poisoning via UDP source port predictability (CVE-2026-50252) kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) openssl: heap buffer overflow in CMS key unwrapping (CVE-2026-63072) openssl: invalid pointer dereference in CMP server via crafted protectionAlg (CVE-2026-63076) libkcapi: Memory corruption via uncanceled AIO requests on error in libkcapi's one-shot AIO path (CVE-2026-71226) libreswan: IKEv2 pre-authentication Null Pointer deref in EAP code (CVE-2026-77206) libreswan: Null Pointer Dereference in PKCS#7 bundle with no CERTS (CVE-2026-77207) kernel: futex: Prevent rcuwait use-after-free during requeue PI (CVE-2026-90003) kernel: netfilter: flowtable: hold reference on ct until flow is released (CVE-2026-98320) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshiftcontainerplatform/4.22/html-single/updatingclusters/index#updating-cluster-cli.

— Red Hat