RLSA-2026:38494

Synopsis

Important: buildah security update

Description

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 10 aarch64 Rocky Linux 10 ppc64le Rocky Linux 10 riscv64 Rocky Linux 10 s390x Rocky Linux 10 x86_64

Fixes

2498152

CVEs

CVE-2026-39822

Affected packages

Rocky Linux 10 x86_64 - AppStream

buildah-2:1.43.1-4.el10_2.src.rpm buildah-tests-2:1.43.1-4.el10_2.x86_64.rpm buildah-debugsource-2:1.43.1-4.el10_2.x86_64.rpm buildah-debuginfo-2:1.43.1-4.el10_2.x86_64.rpm buildah-tests-debuginfo-2:1.43.1-4.el10_2.x86_64.rpm buildah-2:1.43.1-4.el10_2.x86_64.rpm

Rocky Linux 10 aarch64 - AppStream

buildah-tests-2:1.43.1-4.el10_2.aarch64.rpm buildah-debuginfo-2:1.43.1-4.el10_2.aarch64.rpm buildah-debugsource-2:1.43.1-4.el10_2.aarch64.rpm buildah-2:1.43.1-4.el10_2.aarch64.rpm buildah-2:1.43.1-4.el10_2.src.rpm buildah-tests-debuginfo-2:1.43.1-4.el10_2.aarch64.rpm

Rocky Linux 10 s390x - AppStream

buildah-2:1.43.1-4.el10_2.s390x.rpm buildah-debugsource-2:1.43.1-4.el10_2.s390x.rpm buildah-tests-2:1.43.1-4.el10_2.s390x.rpm buildah-debuginfo-2:1.43.1-4.el10_2.s390x.rpm buildah-2:1.43.1-4.el10_2.src.rpm buildah-tests-debuginfo-2:1.43.1-4.el10_2.s390x.rpm

Rocky Linux 10 ppc64le - AppStream

buildah-tests-debuginfo-2:1.43.1-4.el10_2.ppc64le.rpm buildah-debuginfo-2:1.43.1-4.el10_2.ppc64le.rpm buildah-tests-2:1.43.1-4.el10_2.ppc64le.rpm buildah-2:1.43.1-4.el10_2.ppc64le.rpm buildah-2:1.43.1-4.el10_2.src.rpm buildah-debugsource-2:1.43.1-4.el10_2.ppc64le.rpm

Rocky Linux 10 riscv64 - AppStream

buildah-2:1.43.1-4.el10_2.src.rpm