Description
storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor
limit
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Confidential Compute Attestation | — | — |
| Red Hat | DPU kit for NVIDIA | — | — |
| Red Hat | Exploit Intelligence | — | — |
| Red Hat | Multicluster Engine for Kubernetes | — | — |
| Red Hat | NVIDIA JetPack 6 for RHEL | — | — |
| Red Hat | OpenShift Lightspeed | — | — |
| Red Hat | OpenShift Source-to-Image (S2I) | — | — |
| Red Hat | Red Hat Advanced Cluster Security 4 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — |
| Red Hat | Red Hat Build of Podman Desktop | — | — |
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Developer Hub 1 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Hardened Images | — | — |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
| Red Hat | Red Hat OpenShift Dev Spaces | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
| Red Hat | Red Hat Quay 3 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | podman +2 | No fix yet | — |
References
- https://access.redhat.com/security/cve/CVE-2026-114236 vdb-entry
- RHBZ#2558105 issue-tracking