Red Hat has released OpenShift Container Platform 4.21.42, a security update that fixes two serious vulnerabilities in one package: a remotely reachable flaw in the Linux kernel's network code and a compression bug that attackers have already exploited. The advisory, RHSA-2026:95408, was issued on 9 November 2026 and carries Red Hat's highest severity rating, Critical. All users of OpenShift 4.21 are advised to upgrade.

The kernel flaw, tracked as CVE-2026-98432, sits in the IPv4 TCP code that handles incoming network connections. When a server accepts a connection, the kernel passes the request's IP options to the new socket without copying them. If the client retransmits the request while another processor is still reading those options, the kernel can read memory that has already been freed. An unauthenticated attacker on the network can trigger the flaw with carefully timed requests, and the possible consequences include a crash or remote code execution. The flaw carries a severity rating of 9.8 out of 10.

Red Hat warns that the usual workaround does not fully close the hole. Disabling Multipath TCP is not enough, because the bug is in IPv4 TCP itself, and the company's default enterprise Linux configuration remains vulnerable even with Multipath TCP switched off. Systems that accept incoming TCP connections are the most exposed. There is no evidence so far that the kernel flaw itself has been exploited in attacks, and timing plays a large part in whether an attempt succeeds, but the flaw needs no login and no account on the target machine, which is what makes it dangerous.

An exploited Brotli flaw with a deadline of 10 November

The second vulnerability in the release has a very different history. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, the compression library used to shrink web traffic and other data. A specially crafted compressed stream can corrupt the decoder's memory, with possible consequences including information disclosure, crashes and arbitrary code execution. The flaw affects any application that decompresses attacker-controlled data, and it has spread across the software stack, touching Node.js, Python, .NET, Java, Bun, Envoy and Istio.

America's cybersecurity agency, CISA, added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue on 27 October 2026, confirming that the flaw has been used in real attacks. United States federal agencies must patch it by 10 November 2026, which makes the OpenShift release the day before the deadline a timely one for organisations running the platform. Fixed versions of the Brotli library are 1.0.10, 1.1.1 and 1.2.1, and Node.js shipped its own patches on 21 October 2026. NVD rates the Brotli flaw at 9.8.

What administrators should do now

The OpenShift 4.21.42 release covers the platform across x86_64, ARM64, Power and IBM Z architectures, including its enterprise Linux 8 and 9 product entries. Administrators should check the OpenShift web console or the oc command-line tool for the update in their release channel and follow the supported cluster upgrade procedure, verifying that the upgrade completes successfully.

The wider lesson is that a fix in one product does not mean every system is covered. Ubuntu's standard kernel packages for its three newest long-term-support releases, 22.04, 24.04 and 26.04, were still marked vulnerable with fixes in progress at the time of writing, while only the standard 26.10 package was listed as fixed. Container platforms make deploying applications easier, but the operating system underneath still needs its own attention, and a tidy application update process is no substitute for checking the platform itself. With a remotely reachable kernel flaw and a separately confirmed exploited compression bug in the same release, this is an update worth prioritising.