Red Hat ABRT Fixes Expand to RHEL 7 ELS
Tech GuruQuick Answer
Red Hat updated Automatic Bug Reporting Tool (ABRT) packages in RHEL 7 ELS and specific RHEL 8.6/8.8 support streams. All three advisories address symlink-following file overwrites (CVE-2026-54230); the two RHEL 8 advisories also address journal-content injection (CVE-2026-54231). RHSA-2026:69115 is the 8.6 notice, not the RHEL 7 advisory.
Confirm Scope And Apply The Supported Fix
What to do now: Match ABRT's installed package and support stream to the appropriate RHSA, preserve relevant crash reports and journal evidence, update the corresponding build, and validate approved crash-report collection.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 7 ELS and RHEL 8.6/8.8 extended-support ABRT packages |
|---|---|
| Advisory | RHSA-2026:69115 / RHSA-2026:69117 / RHSA-2026:69121 |
| CVEs | CVE-2026-54230, CVE-2026-54231 |
| Authoritative release date | 2026-09-21 04:04:51 UTC |
| Authority revision date | 2026-09-21 05:48:53 UTC |
| Affected versions | The exact entitled RHEL 7 ELS and RHEL 8.6/8.8 extended-support ABRT packages streams before their advisory-listed builds. |
| Fixed version | abrt 2.1.11-62.el7_9 / 2.10.9-25.el8_6.2 / 2.10.9-25.el8_8.2 |
| CVSS base score | 5.5 / 7.0 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
ABRT collects application crash information. CVE-2026-54230 concerns root-run event scripts following a substituted symbolic link while writing output, allowing arbitrary file overwrites. CVE-2026-54231 concerns a local user's journal content reaching dump-directory files without control-character sanitization. The latter is listed in the RHEL 8.6 and 8.8 advisories, not RHSA-2026:69121 for RHEL 7.
What To Validate Now
- Inventory. Locate RHEL 7 ELS and RHEL 8.6/8.8 extended-support ABRT packages deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Map RHEL 7 ELS to RHSA-2026:69121; 8.6 AUS/EUS Extension to 69115; and 8.8 SAP E4S/TUS to 69117. Record the installed ABRT build and whether its post-create crash-report handlers run.
- Remediate. Use
2.1.11-62.el7_9for the RHEL 7 ELS branch,2.10.9-25.el8_6.2for the listed 8.6 streams, or2.10.9-25.el8_8.2for the listed 8.8 streams, through the corresponding Red Hat repository. - Validate. Confirm the package and supported activation steps, then check approved crash-report collection and event-handler output. Preserve original dump files and journal records if unexpected writes are suspected; a successful update does not restore overwritten content.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
