Red Hat has released an OpenShift security update that deserves a place near the top of the maintenance list. OpenShift Container Platform 4.21.42 addresses a remotely reachable Linux kernel vulnerability alongside a Brotli flaw that CISA has already identified as exploited.
The security advisory, dated November 9, carries a Critical rating and covers CVE-2026-98432 and CVE-2026-111497. These are existing vulnerabilities receiving fixes in this OpenShift release, rather than two newly discovered problems.
The kernel issue, CVE-2026-98432, involves IPv4 TCP connection handling. According to Red Hat’s technical assessment, concurrent operations can continue accessing socket options after the associated memory has been freed.
An unauthenticated attacker could use carefully timed network requests to trigger the flaw. Potential consequences include a crash or remote code execution, making this considerably more concerning than a bug that requires somebody to already have an account on the machine.
Systems accepting incoming TCP connections are especially exposed. Red Hat also warns that disabling Multipath TCP does not completely address the problem, and that its default RHEL configuration remains vulnerable despite having MPTCP disabled.
That does not mean every exposed server is about to be taken over. Timing matters, and the sources reviewed for this article do not establish active exploitation of the kernel vulnerability.
The Brotli issue has a different exploitation history. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, establishing that this vulnerability has been used in attacks.
That listing should not be stretched into a claim that attackers are targeting OpenShift clusters through Brotli. It does, however, give administrators a concrete reason to take the fix seriously beyond the severity label attached to an advisory.
Brotli is a compression technology, and Red Hat describes the vulnerability as an out-of-bounds write triggered by a specially crafted compressed stream. Applications must decompress attacker-controlled data to reach the affected code, with possible consequences including information disclosure, crashes, or arbitrary code execution.
Red Hat says its compiler and runtime protections make reliable code execution harder, but they do not eliminate the impact. A vulnerable decompressor still needs fixing even when other defenses make an attack less convenient.
For OpenShift administrators, the relevant release is 4.21.42. The advisory lists OpenShift 4.21 variants across x86_64, ARM64, Power, and IBM Z architectures, including its RHEL 8 and RHEL 9 product entries.
Red Hat recommends checking the OpenShift web console or oc command-line tool and upgrading when the update appears in the appropriate release channel. Administrators should follow the supported cluster upgrade procedure and verify that it completes successfully.
There is a wider Linux patching lesson here, too. A fix arriving in one product does not mean every distribution has shipped its own update, even when the underlying CVE is identical.
At the time of writing, Ubuntu’s tracker lists its standard Ubuntu 26.10 linux package as fixed at 7.3.0-10.10. The standard packages for Ubuntu 26.04 LTS, 24.04 LTS, and 22.04 LTS remain marked vulnerable with work in progress.
Those entries are specific to the listed kernel packages. Cloud and hardware enablement variants have separate assessments, so users need to check the package they actually run rather than assume a release name answers the question.
For me, the takeaway is practical. Container platforms can make application deployment easier, but the operating system underneath still needs attention, and a tidy application update process cannot replace checking the platform itself.
OpenShift administrators now have a specific release to look for. With a remotely reachable kernel flaw and a separately confirmed exploited compression bug involved, this is an update worth prioritizing.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz
