RLSA-2026:98115: Moderate: gcc security update
The gcc packages provide compilers for C, C++, Java, Fortran, Objective C, and Ada 95 GNU, as well as related support libraries.
Security Fix(es):
gcc: Integer wrap in std (CVE-2026-114691)
gcc: Confirmed out-of-bounds read/write in libstdc++ parallel std (CVE-2026-114690)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/gccto a version that resolves this vulnerability.Fixed in 0:8.5.0-31.el8_10
Event History
Frequently Asked Questions
What level of access would an attacker need?
The advisory rates the attack vector as local, so exploitation requires local access to the affected system. The CVSS vector indicates no privileges or user interaction are required once local access is available.
What is the expected security impact?
The CVSS vector indicates a high availability impact, with no confidentiality or integrity impact. The listed fixes address an integer wrap and a confirmed out-of-bounds read/write in libstdc++ parallel std functionality.