RLSA-2026:98457: Moderate: tftp security update
The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.
Security Fix(es):
tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/tftpto a version that resolves this vulnerability.Fixed in 0:5.2-41.el9_9 - Upgrade
Upgrade
rocky-linux/tftp-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.2-41.el9_9 - Upgrade
Upgrade
rocky-linux/tftp-debugsourceto a version that resolves this vulnerability.Fixed in 0:5.2-41.el9_9 - Upgrade
Upgrade
rocky-linux/tftp-serverto a version that resolves this vulnerability.Fixed in 0:5.2-41.el9_9 - Upgrade
Upgrade
rocky-linux/tftp-server-debuginfoto a version that resolves this vulnerability.Fixed in 0:5.2-41.el9_9
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed over the network with low attack complexity. It does not require privileges or user interaction.
What is the expected impact of successful exploitation?
The issue is a denial of service caused by an out-of-bounds read/write in the tftp-hpa remap engine. The supplied CVSS vector indicates high availability impact, with no confidentiality or integrity impact.
Which installed packages should be checked for advisory applicability?
Check for rocky-linux/tftp, rocky-linux/tftp-server, and their debuginfo and debugsource packages listed in the advisory. The tftp-server subpackage provides the TFTP server, while the tftp subpackage provides the TFTP user interface.