Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 4

Vulnerabilities 3

• Medium 6.1
  CVE-2025-14104

  Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames

  A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

  Red Hat util-linux Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• Medium 4.7
  CVE-2026-27456

  util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup

  util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates …

  util-linux util-linux util-linux util-linux Linux Debian Ubuntu Azure Linux Alpine
  Apr 3, 2026
• Low 3.7
  CVE-2026-3184

  Util-linux: util-linux: access control bypass due to improper hostname canonicalization

  A flaw was found in util-linux. Improper hostname canonicalization in the `login(1)` utility, when invoked with the `-h` option, can modify the supplied remote hostname before setting `PAM_RHOST`. A remote attacker could exploit this by providing a specially …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Apr 3, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2026-27456
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2025-14104
• report
  https://access.redhat.com/security/cve/CVE-2026-3184
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7180.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419369
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14104
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442570
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-3184
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-3184
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2454956
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27456
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27456
• article
  https://github.com/util-linux/util-linux/commit/5e390467b26a3cf3fecc04e1a0d482dff3162fc4
• article
  https://github.com/util-linux/util-linux/releases/tag/v2.41.4
• article
  https://github.com/util-linux/util-linux/security/advisories/GHSA-qq4x-vfq4-9h9g