Red Hat coreutils Update Fixes an RHEL 8 sort Buffer Under-Read
Tech GuruQuick Answer
RHSA-2026:69964 fixes CVE-2025-5278 in RHEL 8 coreutils. The flaw is a heap buffer under-read in sort key handling, with limited confidentiality and availability impact in the published vector. Update the supported 8.30-21.el8_10 RPM build.
Confirm Scope And Apply The Supported Fix
What to do now: Identify the installed coreutils RPM and repository, update the matching RHEL 8 package set, and validate scripts that depend on sort output.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8 coreutils packages |
|---|---|
| Advisory | RHSA-2026:69964 |
| CVE | CVE-2025-5278 |
| Authoritative release date | RHSA-2026:69964: 2026-09-22T11:22:56+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69964: 2026-09-22T11:22:56+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled RHEL 8 coreutils packages builds before the branch-specific package, image, or digest listed by Red Hat. |
| Fixed version | coreutils 8.30-21.el8_10 |
| CVSS base score | 4.4 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | RHSA-2026:69964 does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
This is a local, user-interaction-dependent sort issue, not a source-confirmed unauthenticated network service exploit or arbitrary-code-execution claim. Review automation that invokes sort with externally influenced input or key specifications while applying the package update.
What To Validate Now
- Inventory. Record installed coreutils packages and owners of scripts or batch jobs using sort, especially where inputs or key specifications are externally supplied.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled RHEL 8 coreutils packages builds before the branch-specific package, image, or digest listed by Red Hat. Do not infer applicability from product family or severity alone.
- Remediate. Apply coreutils 8.30-21.el8_10 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Record the full RPM release and test representative sort keys, input encodings and dependent data-processing scripts. Confirm expected output and error handling without asserting that a routine test proves exploit resistance.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
