Red Hat AI Base Images 3.5.2 Updates the Gaudi Variant
Tech GuruQuick Answer
RHSA-2026:74771 supplies the Red Hat AI Base Images 3.5.2 Gaudi update for OpenShift AI 3.5. Its 35-CVE scope and fixed image are distinct from the 3.4.3 Gaudi advisory even though both use the same repository name. Match the product stream and digest, not just the word Gaudi.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Red Hat OpenShift AI 3.5 Gaudi base image, match the exact affected release or feature, apply the authority-supported fixed build or service remediation, validate the dependent workflow, and preserve evidence.
Last verified: 2026-10-02 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Red Hat OpenShift AI 3.5 Gaudi base image |
|---|---|
| Advisory | RHSA-2026:74771 |
| CVEs | CVE-2025-6170, CVE-2026-11940, CVE-2026-15308, CVE-2026-15588, CVE-2026-16118, CVE-2026-47162, CVE-2026-47167, CVE-2026-52858, CVE-2026-54369, CVE-2026-55693, CVE-2026-56208, CVE-2026-56209, CVE-2026-56210, CVE-2026-56211, CVE-2026-57455, CVE-2026-57456, CVE-2026-58010, CVE-2026-58011, CVE-2026-58012, CVE-2026-58013, CVE-2026-58014, CVE-2026-58015, CVE-2026-58049, CVE-2026-59856, CVE-2026-59858, CVE-2026-60002, CVE-2026-64830, CVE-2026-64834, CVE-2026-66036, CVE-2026-66039, CVE-2026-73066, CVE-2026-73072, CVE-2026-73076, CVE-2026-73077, CVE-2026-73078 |
| Authoritative release date | 2026-10-01 21:29:24 UTC |
| Authority revision date | 2026-10-02 02:17:09 UTC |
| Affected versions | The advisory-listed OpenShift AI 3.5 Gaudi base image before the 3.5.2 digest. |
| Fixed version | Red Hat AI Base Images 3.5.2 Gaudi signed image digest |
| CVSS base score | 2.5–8.8 (official CVSS v3.1 range) |
| CVSS severity | Low to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The listed amd64 image is registry.redhat.io/rhai/base-image-gaudi-rhel9@sha256:b7687a7830f087ca8b1cc3b897e8ea4991d649bfa4492d552d0192be05056c97. This identifies the content in the advisory, not an independently verified signature or a guarantee that a site's accelerator stack is compatible.
What To Validate Now
- Inventory. Locate Red Hat OpenShift AI 3.5 Gaudi base image deployments, versions, enabled features, exposure paths, owners, and dependent services.
- Establish applicability. Match entitlement, product stream, architecture, source package or image repository, and each advisory's product status. Do not apply one branch's build or digest to another branch.
- Remediate. Select the supported 3.5.2 Gaudi base through Red Hat's registry and provenance policy, rebuild derived application images and deploy the resulting digest through the normal rollout. Retain approved model, driver and runtime requirements; do not substitute the 3.4 image because its tag looks newer.
- Validate. Confirm the actual running application digest and its base-image provenance. Check Gaudi device availability, model loading and a small authorized representative job, then review runtime errors and resource behavior. Preserve logs and prior deployment references for recovery without presenting a vulnerable rollback as a permanent fix.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Confirm entitlement and branch support, test package or image compatibility, drain and redeploy clustered workloads deliberately, preserve prior digests and rollback evidence, and do not infer exploitation from severity.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
