Red Hat patches Critical kernel and brotli flaws across OpenShift 4.19-4.21

Red Hat has published Critical security advisories for OpenShift Container Platform 4.19, 4.20 and 4.21, shipping new release images for all three branches. The fixed releases are 4.19.55, 4.20.46 and 4.21.42.

All three advisories address the same pair of vulnerabilities: CVE-2026-98432, described by Red Hat as an IPv4 kernel issue involving the freeing of inet_opt and ireq_opt after an RCU grace period, and CVE-2026-111497, an out-of-bounds write in the Google Brotli decoder. Red Hat rates each advisory Critical.

What shipped

Each advisory provides updated OpenShift release images for x86_64, IBM Z and LinuxONE, Power and Arm 64. Red Hat also points to separate RPM advisories where applicable and says the corresponding release notes will be updated with full details.

The releases are asynchronous updates rather than a new OpenShift feature line. Their immediate significance is the security impact: administrators running any of the three affected branches now have a vendor-rated Critical update to schedule and validate.

What administrators should do

Red Hat advises all OpenShift 4.19, 4.20 and 4.21 users to upgrade to the updated packages and images when they become available in the appropriate release channel. Administrators can check availability through the OpenShift web console or the oc command-line tool.

Before rollout, platform teams should confirm that the target release is offered in their channel, review the branch-specific release notes when they are populated, and follow their normal staged update process. The advisories publish architecture-specific image digests, providing an additional verification point for controlled deployments.

The three advisories were issued on Nov. 9, 2026. This desk has not found a Red Hat statement in the advisories that either vulnerability is known to be exploited in the wild; the reason this development clears the story threshold is Red Hat’s own Critical severity rating.