CVE-2026-16460

Fixes and workarounds

Workaround

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to revalidate container image signatures against active container signature policy before finalizing or booting staged ostree deployments in bootc and ostree: upgrade to the fixed Bootc/Ostree/Rpm Ostree/Rust Zincati builds, which revalidates container image signatures against the active container signature policy in /etc/containers/policy.json before finalizing or booting already-staged ostree deployments, closing all 2 injection vectors (host reboot into pending staged deployment, bootc upgrade --from-downloaded deployment application). Until patched, this is only a concern on Linux systems using bootc or ostree, including RHEL image-mode hosts — Non-Linux platforms are unaffected — so Clear all existing staged ostree deployments immediately after hardening /etc/containers/policy.json and ensure unsigned container images are never staged. As a compensating measure, Run SELinux in enforcing mode to confine processes running from finalized deployments to defined domains and Deploy IMA/EVM appraisal to verify executable file signatures at runtime and block untrusted binaries. These controls limit blast radius and contain exploitation, but they do not fix the underlying missing signature revalidation defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-712 Container Image Signing and Provenance Verification (Cosign/Sigstore) (high)