Red Hat has released a security update for OpenShift that patches a critical Linux kernel vulnerability alongside a Brotli compression flaw already known to have been exploited in attacks.

The advisory, dated 9 November, carries a Critical rating and covers CVE-2026-98432 and CVE-2026-111497. The relevant release is OpenShift Container Platform 4.21.42, covering OpenShift 4.21 variants across x86_64, ARM64, Power and IBM Z architectures, including its RHEL 8 and RHEL 9 product entries.

Kernel flaw CVE-2026-98432

CVE-2026-98432 is a use-after-free race in the Linux kernel's IPv4 TCP connection handling, present in kernels since version 4.4. It is scored 9.8 Critical, and a remote attacker needs no authentication and no user interaction to trigger it, needing only correctly timed TCP connection requests.

Red Hat rates the flaw Critical and warns that disabling Multipath TCP does not completely address the problem, and that its default RHEL configuration remains vulnerable despite having MPTCP disabled. Upstream fixes landed in stable kernels in mid-October, but Red Hat had not shipped patched packages for RHEL until this OpenShift release. No active exploitation of the kernel vulnerability itself has been established.

Exploited Brotli flaw CVE-2026-111497

The second flaw, CVE-2026-111497, is an out-of-bounds write in the Brotli compression library, triggered by a specially crafted compressed stream. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October, establishing that it has been used in attacks, with a patch deadline for US federal agencies.

Applications must decompress attacker-controlled data to reach the affected code, with possible consequences including information disclosure, crashes or arbitrary code execution. OpenShift administrators should apply the 4.21.42 update promptly and remove any temporary mitigations, such as nftables rules filtering IPv4 TCP packets carrying IP options, once the fixed kernel is installed.