Red Hat Enterprise Linux 10 CVE-2026-2436

The CVSS 3.1 score of 6.5 reflects moderate severity with a network attack vector (AV:N), high attack complexity (AC:H), no privilege requirements (PR:N), and no user interaction needed (UI:N). The impact assessment shows no confidentiality loss (C:N), limited integrity impact (I:L), and high availability impact (A:H) due to denial of service. The high attack complexity moderates the severity compared to a direct RCE, as the attacker must time the exploitation window precisely-the soup_server_disconnect() call must race with the completion of a TLS handshake, making reliable exploitation difficult but not impossible. No EPSS score, CISA KEV status, or proof-of-concept code is documented in the provided intelligence, indicating this is not a publicly leveraged vulnerability at present. The broad distribution across enterprise Linux variants (RHEL 6-10, Ubuntu, Debian) and tracking via multiple bug systems (Debian #1130498, Red Hat BZ #2442909) and ENISA EUVD-2026-16342 suggest this is a recognized, tracked issue in need of vendor coordination. The availability impact (denial of service) is the primary threat; this is not suitable for critical severity unless the affected service is mission-critical and single-instance.

An attacker sends multiple concurrent TLS connection requests to a libsoup-based server. When the server begins terminating one connection via soup_server_disconnect(), the function immediately frees the associated connection object without waiting for the TLS handshake to complete. If the peer's TLS handshake packet arrives milliseconds after the memory is freed, the server attempts to access the dangling pointer to process the handshake, triggering a segmentation fault and crashing the server. The high attack complexity requirement (AC:H) means the attacker must reliably time the race condition, typically by sending multiple overlapping connection attempts to increase the probability of hitting the vulnerable window. No public proof-of-concept code has been identified, and this does not appear to be actively exploited in the wild at the time of analysis.