Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 3

Vulnerabilities 2

• Medium 5.6
  CVE-2026-88264

  Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

  A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29…

  Red Hat containers Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Sep 10, 2026
• Medium 5.6
  CVE-2026-88265

  Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

  A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fre…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine
  Sep 10, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-88264
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-88265
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71668.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531223
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-88264
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-88264
• article
  https://github.com/containers/crun/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2531224
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-88265
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-88265