Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS

Red Hat has marked a Linux kernel memory-corruption flaw affecting OpenShift’s RHEL CoreOS images as an active-exploit case. That exploitation statement—not the vendor’s Important severity rating—is what moves CVE-2026-99999 above this desk’s normal advisory threshold.

The Red Hat CVE record, last modified October 18, lists both openshift/ose-rhel-coreos-8 and openshift/ose-rhel-coreos-9 as affected. It currently lists no errata for either component and says no mitigation is available that meets Red Hat Product Security’s criteria.

What the flaw does

Red Hat says malformed checksum metadata can reach the Linux IPv4 networking subsystem without adequate validation. During checksum completion, that metadata can drive an out-of-bounds write and corrupt kernel memory.

The attack path is local rather than internet-remote: Red Hat describes a local attacker or an untrusted guest virtual machine transmitting crafted packets into an affected host. The documented outcomes include a host crash, disclosure of kernel memory and potential arbitrary code execution on the host.

Red Hat scores the issue 8.8, Important, with low attack complexity and low privileges required. The vendor also notes that the upstream CVE record scores it 9.3, Critical, based on a different assessment of whether privileges are required. For OpenShift operators, the more consequential line is Red Hat’s statement that it tracks the flaw as a KEV active-exploit case.

Who should pay attention

The affected-product table names OpenShift Container Platform 4 but does not narrow exposure to particular OpenShift minor versions. It also marks multiple RHEL kernel streams and Red Hat Enterprise Linux for NVIDIA as affected.

That leaves OpenShift teams without a source-backed patch command today. The practical step is to inventory clusters that run the listed CoreOS components, identify environments where untrusted guests or local workloads can transmit traffic into the host network path, and monitor the Red Hat record for issued errata. Those are prioritization and exposure-review steps, not substitutes for a vendor fix.

What changes next

Red Hat says fixes are being pursued under delegated resolution. Until errata appear, operators should treat claims that a specific OpenShift build is fixed—or that a generic network workaround fully mitigates the issue—as unverified. This desk will update the wire when Red Hat publishes affected-version boundaries or remediation packages.