Linux · Security advisory · July 7, 2026

ELSA-2026-35833: Security update for 32 packages

ELSA-2026-35833, released July 7, 2026, fixes 4 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0691
94th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
aardvark-dnsol 82:1.10.1-2.module+el8.10.0+90948+3b47585b
buildahol 82:1.33.14-4.module+el8.10.0+90948+3b47585b
buildah-testsol 82:1.33.14-4.module+el8.10.0+90948+3b47585b
cockpit-podmanol 80:84.1-1.module+el8.10.0+90948+3b47585b
conmonol 83:2.1.10-1.module+el8.10.0+90948+3b47585b
container-selinuxol 82:2.229.0-3.module+el8.10.0+90948+3b47585b
containernetworking-pluginsol 81:1.4.0-8.module+el8.10.0+90948+3b47585b
containers-commonol 82:1-82.0.1.module+el8.10.0+90948+3b47585b
critol 80:3.18-5.module+el8.10.0+90948+3b47585b
criuol 80:3.18-5.module+el8.10.0+90948+3b47585b
criu-develol 80:3.18-5.module+el8.10.0+90948+3b47585b
criu-libsol 80:3.18-5.module+el8.10.0+90948+3b47585b
crunol 80:1.14.3-2.module+el8.10.0+90948+3b47585b
fuse-overlayfsol 80:1.13-1.module+el8.10.0+90948+3b47585b
libslirpol 80:4.4.0-2.module+el8.10.0+90948+3b47585b
libslirp-develol 80:4.4.0-2.module+el8.10.0+90948+3b47585b
netavarkol 82:1.10.3-1.module+el8.10.0+90948+3b47585b
oci-seccomp-bpf-hookol 80:1.2.10-1.module+el8.10.0+90948+3b47585b
podmanol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-catatonitol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-dockerol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-gvproxyol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-pluginsol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-remoteol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
podman-testsol 84:4.9.4-32.0.1.module+el8.10.0+90948+3b47585b
python3-criuol 80:3.18-5.module+el8.10.0+90948+3b47585b
python3-podmanol 80:4.9.0-3.module+el8.10.0+90948+3b47585b
runcol 84:1.2.9-4.module+el8.10.0+90948+3b47585b
skopeool 82:1.14.6-2.module+el8.10.0+90948+3b47585b
skopeo-testsol 82:1.14.6-2.module+el8.10.0+90948+3b47585b
slirp4netnsol 80:1.2.3-1.module+el8.10.0+90948+3b47585b
udicaol 80:0.2.6-21.module+el8.10.0+90948+3b47585b

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-42508 Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts 9.1 0.0691 None reported
High CVE-2026-39830 Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh 9.1 0.0068 None reported
High CVE-2026-39832 Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent 9.1 0.0068 None reported
High CVE-2026-39829 Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh 8.7 0.0047 None reported
Showing 1 to 4 of 4 1