Security Update 4.0 1002

Critical Photon OS Security Update

Summary

Advisory Id : PHSA-2026-4.0-1002

Type : Security

Severity : ['Critical', 'Important', 'Moderate', 'Low']

Issue date : 2026-04-23

Affected Release: 4.0

Details

Updates of ['expat', 'nghttp2', 'protobuf', 'sudo', 'ImageMagick', 'linux', 'openssh'] packages of Photon OS have been released.

Affected Packages

Critical

linux - ['CVE-2026-43011', 'CVE-2026-31682', 'CVE-2026-43383', 'CVE-2026-43038', 'CVE-2026-31668', 'CVE-2026-43037', 'CVE-2026-31649', 'CVE-2026-31659', 'CVE-2026-43407', 'CVE-2026-23455', 'CVE-2026-31402']

Important

nghttp2 - ['CVE-2026-27135']

protobuf - ['CVE-2026-0994']

sudo - ['CVE-2026-35535']

ImageMagick - ['CVE-2026-33908', 'CVE-2026-33901', 'CVE-2026-33900', 'CVE-2026-33905']

linux - ['CVE-2026-31473', 'CVE-2026-23406', 'CVE-2026-43450', 'CVE-2026-31720', 'CVE-2026-43040', 'CVE-2026-43060', 'CVE-2026-23269', 'CVE-2026-45920', 'CVE-2026-43426', 'CVE-2026-43062', 'CVE-2026-31788', 'CVE-2026-31450', 'CVE-2026-23397', 'CVE-2026-31761', 'CVE-2026-43027', 'CVE-2026-23253', 'CVE-2026-31780', 'CVE-2026-31570', 'CVE-2026-31665', 'CVE-2026-23395', 'CVE-2026-23336', 'CVE-2026-31662', 'CVE-2026-43050', 'CVE-2026-45958', 'CVE-2026-23281', 'CVE-2026-31683', 'CVE-2026-31667', 'CVE-2026-31747', 'CVE-2026-31748', 'CVE-2026-43015', 'CVE-2026-31494', 'CVE-2026-43466', 'CVE-2026-31504', 'CVE-2026-31417', 'CVE-2026-31464', 'CVE-2026-23457', 'CVE-2026-43458', 'CVE-2026-43373', 'CVE-2026-23462', 'CVE-2026-43339', 'CVE-2026-43459', 'CVE-2026-43386', 'CVE-2026-43427', 'CVE-2026-23372', 'CVE-2026-23318', 'CVE-2026-23351', 'CVE-2026-23458', 'CVE-2026-31485', 'CVE-2026-31399', 'CVE-2025-68206', 'CVE-2026-23456', 'CVE-2026-31778', 'CVE-2026-43051', 'CVE-2026-31776', 'CVE-2026-43437', 'CVE-2026-43020', 'CVE-2026-31674', 'CVE-2026-31680', 'CVE-2026-31773', 'CVE-2026-43370', 'CVE-2026-31758', 'CVE-2026-23274', 'CVE-2026-31507', 'CVE-2026-43336', 'CVE-2026-43452', 'CVE-2026-31403', 'CVE-2026-23391', 'CVE-2026-45956', 'CVE-2026-31452', 'CVE-2026-43047', 'CVE-2026-31447', 'CVE-2026-43028', 'CVE-2026-31469', 'CVE-2026-43449', 'CVE-2026-43453', 'CVE-2026-31455', 'CVE-2026-31454', 'CVE-2026-31679', 'CVE-2026-23388', 'CVE-2026-31759']

openssh - ['CVE-2026-35385', 'CVE-2026-35414', 'CVE-2026-35386']

Moderate

expat - ['CVE-2026-32776', 'CVE-2026-32777', 'CVE-2026-32778']

ImageMagick - ['BDSA-2026-5621', 'CVE-2026-33899', 'CVE-2026-34238', 'CVE-2026-40183', 'CVE-2026-40312', 'CVE-2026-33536', 'BDSA-2026-7145', 'CVE-2026-40311', 'CVE-2026-40169', 'CVE-2026-33535', 'CVE-2026-33902', 'CVE-2026-40310']

linux - ['CVE-2026-43425', 'CVE-2026-31770', 'CVE-2026-43043', 'CVE-2026-23362', 'CVE-2026-23352', 'CVE-2026-43159', 'CVE-2026-23291', 'CVE-2026-23404', 'CVE-2026-31546', 'CVE-2026-31421', 'CVE-2025-39748', 'CVE-2026-31418', 'CVE-2026-23356', 'CVE-2026-23446', 'CVE-2026-31515', 'CVE-2026-31762', 'CVE-2026-43342', 'CVE-2026-23398', 'CVE-2026-31428', 'CVE-2026-43363', 'CVE-2026-23420', 'CVE-2026-23442', 'CVE-2026-43381', 'CVE-2026-31510', 'CVE-2026-43068', 'CVE-2026-43343', 'CVE-2026-23279', 'CVE-2026-31545', 'CVE-2026-43014', 'CVE-2026-31738', 'CVE-2026-31555', 'CVE-2026-31651', 'CVE-2026-31728', 'CVE-2026-31523', 'CVE-2026-43451', 'CVE-2026-31751', 'CVE-2026-43428', 'CVE-2026-23286', 'CVE-2026-31509', 'CVE-2026-31749', 'CVE-2026-43340', 'CVE-2026-43475', 'CVE-2026-23460', 'CVE-2026-31423', 'CVE-2026-23365', 'CVE-2026-43411', 'CVE-2026-23463', 'CVE-2026-31495', 'CVE-2026-43429', 'CVE-2026-31422', 'CVE-2026-31415', 'CVE-2026-31425', 'CVE-2026-43041', 'CVE-2026-23405', 'CVE-2026-45985', 'CVE-2026-23379', 'CVE-2026-31497', 'CVE-2026-23290', 'CVE-2026-23368', 'CVE-2026-43445', 'CVE-2026-31628', 'CVE-2026-31498', 'CVE-2026-23452', 'CVE-2026-43357', 'CVE-2026-23113', 'CVE-2026-43355', 'CVE-2026-43387', 'CVE-2026-23434', 'CVE-2026-31512', 'CVE-2026-23357', 'CVE-2026-31416', 'CVE-2026-43424', 'CVE-2026-23444', 'CVE-2026-23100', 'CVE-2026-31670', 'CVE-2026-23381', 'CVE-2026-23303', 'CVE-2026-31661', 'CVE-2026-31424', 'CVE-2026-45899', 'CVE-2026-31671', 'CVE-2026-43066', 'CVE-2026-43439', 'CVE-2026-31721', 'CVE-2026-23396', 'CVE-2026-43035', 'CVE-2026-23298', 'CVE-2026-31427', 'CVE-2026-43432', 'CVE-2026-43069', 'CVE-2026-31660', 'CVE-2026-23339', 'CVE-2026-43472', 'CVE-2026-31752', 'CVE-2026-23293', 'CVE-2026-31763', 'CVE-2026-23367', 'CVE-2026-43420', 'CVE-2026-31400', 'CVE-2026-23304', 'CVE-2026-23403', 'CVE-2026-23474', 'CVE-2026-23300', 'CVE-2026-23409', 'CVE-2026-23289', 'CVE-2026-31672', 'CVE-2026-23312', 'CVE-2026-43430', 'CVE-2026-31550', 'CVE-2024-56584', 'CVE-2026-31466', 'CVE-2026-31658', 'CVE-2026-23307', 'CVE-2026-43480', 'CVE-2026-31781', 'CVE-2026-43032', 'CVE-2026-43026', 'CVE-2026-31391', 'CVE-2026-31518', 'CVE-2026-23382', 'CVE-2025-39764', 'CVE-2026-31524', 'CVE-2026-23439', 'CVE-2026-31737']

openssh - ['CVE-2026-35387']

Low

openssh - ['CVE-2026-35388']

Solution

Update the affected packages (tdnf update package)

Note: For packages ['linux'] after updating, a reboot is required for taking effect.

Updated Packages Information

expat-2.7.5-1.ph4.x86_64.rpm | size : 28K , sha256 : c24a27611af9335a25d75e829cc8929ab7b7c6859ddafc8ed8a80a30c2ff8392 , build time : Thu, 23 Apr 2026 18:05:04 UTC

expat-devel-2.7.5-1.ph4.x86_64.rpm | size : 28K , sha256 : 77200c3c518c1c2b957b6d9c73023701d942919893a6f70e24f47daf7584ed7a , build time : Thu, 23 Apr 2026 18:05:04 UTC

expat-docs-2.7.5-1.ph4.x86_64.rpm | size : 40K , sha256 : f8c185bfb6b7992512115108005d320d255f580015e04969fa829dfba5022c30 , build time : Thu, 23 Apr 2026 18:05:04 UTC

expat-libs-2.7.5-1.ph4.x86_64.rpm | size : 84K , sha256 : 986031f79753f54871e98d64d5b27e3ac631dba5a0059d14cea56fea7f23ec69 , build time : Thu, 23 Apr 2026 18:05:04 UTC

nghttp2-1.57.0-3.ph4.x86_64.rpm | size : 100K , sha256 : 5e3fa3e70f345c109cd95232da91c5a09d14d2669f47e5e3f2a4c265247f7817 , build time : Thu, 23 Apr 2026 18:05:34 UTC

nghttp2-devel-1.57.0-3.ph4.x86_64.rpm | size : 80K , sha256 : f3bdfe8e7b3d7fd1e9b5add99fb0708e5a9576bf321294a4801eba3d888b9063 , build time : Thu, 23 Apr 2026 18:05:34 UTC

protobuf-3.23.3-5.ph4.x86_64.rpm | size : 2.1M , sha256 : bd80f8d04f779399859b753254178ae32bfb7e9239e3a405934a999437ddbe27 , build time : Thu, 23 Apr 2026 18:05:38 UTC

protobuf-devel-3.23.3-5.ph4.x86_64.rpm | size : 452K , sha256 : aa9bc3cc8d0fb1019f423a2fb266602baa4029973c080454aa156bbc22a84283 , build time : Thu, 23 Apr 2026 18:05:38 UTC

protobuf-java-3.23.3-5.ph4.x86_64.rpm | size : 2.2M , sha256 : 5fe5ecf599135296f5563de0535f49090a7ad866570b08c65d71cc67a4c4ebf3 , build time : Thu, 23 Apr 2026 18:05:38 UTC

protobuf-python3-3.23.3-5.ph4.x86_64.rpm | size : 240K , sha256 : 2ae996d24df91190294a9871f17bff38088b51e93c1899f8b4fef3b9770eb4d6 , build time : Thu, 23 Apr 2026 18:05:38 UTC

protobuf-static-3.23.3-5.ph4.x86_64.rpm | size : 12K , sha256 : d5d507b801d26e735efa1e7a2daa88b766102ae7364babd5452452b761f06cf4 , build time : Thu, 23 Apr 2026 18:05:38 UTC

sudo-1.9.15p5-4.ph4.x86_64.rpm | size : 2.0M , sha256 : fab250b8a4b411afab22a503afefc6fa72beac49d5380a1bc0939cf8bf27056a , build time : Thu, 23 Apr 2026 18:05:35 UTC

ImageMagick-7.1.2.19-1.ph4.x86_64.rpm | size : 64K , sha256 : face54376353e236567be2f03bf715e1d48d349e1144d56963bb0a39c88a096a , build time : Thu, 23 Apr 2026 18:05:30 UTC

ImageMagick-c++-7.1.2.19-1.ph4.x86_64.rpm | size : 188K , sha256 : 6abcf1e25789cc233012800bd7e93696cc4543ff1f2742ab453ea6deb20e1ece , build time : Thu, 23 Apr 2026 18:05:30 UTC

ImageMagick-c++-devel-7.1.2.19-1.ph4.x86_64.rpm | size : 64K , sha256 : e762febe97e90ca0bb5e3873583a3db8941371bd93201ff09ff4349ddd0358cf , build time : Thu, 23 Apr 2026 18:05:30 UTC

ImageMagick-devel-7.1.2.19-1.ph4.x86_64.rpm | size : 92K , sha256 : 3b4aba28b17ff0341ce9e3067f5fbab99d83a296ac16791504ff39dbbd9ef40c , build time : Thu, 23 Apr 2026 18:05:30 UTC

ImageMagick-doc-7.1.2.19-1.ph4.x86_64.rpm | size : 5.9M , sha256 : bc5c2af7090302a79b8671323903beb169923fba10557014e2cb960e147b40d7 , build time : Thu, 23 Apr 2026 18:05:30 UTC

ImageMagick-libs-7.1.2.19-1.ph4.x86_64.rpm | size : 1.8M , sha256 : 0d52f61dac47c9239acf2cf153727129f62cc38fb5a04e975fb8bf54ebfd21d5 , build time : Thu, 23 Apr 2026 18:05:30 UTC

linux-5.10.253-1.ph4.x86_64.rpm | size : 32M , sha256 : 6b673dcb9d0b4033c8e4c22a0dc79ffe735f814e86571157f6bb318ec364a45a , build time : Thu, 23 Apr 2026 19:02:29 UTC

linux-devel-5.10.253-1.ph4.x86_64.rpm | size : 12M , sha256 : 12919764a41812bc564b8323c633e3dcfa4507cfe15f1f2d3e85eb07df62fe80 , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-docs-5.10.253-1.ph4.x86_64.rpm | size : 7.9M , sha256 : 955e195c65024ee50bd68718bb3d55c36b3021992079732a6374f302f0728281 , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-drivers-gpu-5.10.253-1.ph4.x86_64.rpm | size : 3.8M , sha256 : 687184cff0c10b1c066b442d8c5d206fbb502c1fddddff7f362682fc8841a513 , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-drivers-intel-sgx-5.10.253-1.ph4.x86_64.rpm | size : 76K , sha256 : b615091d6e15d9498c6031713b5c6c045d8eb049c868387e34bde2c30c08301a , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-drivers-sound-5.10.253-1.ph4.x86_64.rpm | size : 680K , sha256 : 3c64583b4b4d332f1e9cd62df8fdea67143742cff4f325f38e118f9bf706743d , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-esx-5.10.253-1.ph4.x86_64.rpm | size : 14M , sha256 : 78b307d4550c1b78744a589cf9d8b1391c705ae48336a4d9a85518d8c98ee73e , build time : Thu, 23 Apr 2026 19:02:54 UTC

linux-esx-devel-5.10.253-1.ph4.x86_64.rpm | size : 11M , sha256 : 328d4bf5860cdb6b2d9ec786d3bfc8a8f12b3fda5478d26b361a78f0c4004b90 , build time : Thu, 23 Apr 2026 18:05:37 UTC

linux-esx-docs-5.10.253-1.ph4.x86_64.rpm | size : 7.9M , sha256 : 9430f7cf0a927114bf84ead0934955019d1810e0f14078ff08fcd5b7a44d2fe0 , build time : Thu, 23 Apr 2026 18:05:37 UTC

linux-oprofile-5.10.253-1.ph4.x86_64.rpm | size : 84K , sha256 : 3fd51df639096775e522bd37dbc940d95ef115b5aa8b427096fa443ebea324e8 , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-python3-perf-5.10.253-1.ph4.x86_64.rpm | size : 192K , sha256 : c84f63dbc2b19f4c5b13124824766565b166a5655a2c19e23f964fe3e85de1dc , build time : Thu, 23 Apr 2026 18:05:38 UTC

linux-secure-5.10.253-1.ph4.x86_64.rpm | size : 26M , sha256 : ebdc9e0d202bc214d1b043b5f5b24d36cebed43db82b36727dacbe6021b94376 , build time : Thu, 23 Apr 2026 19:04:22 UTC

linux-secure-devel-5.10.253-1.ph4.x86_64.rpm | size : 12M , sha256 : 2a27e882e52d61504a9a6dd5305c895a9914994d246eedc177973dda8c890a02 , build time : Thu, 23 Apr 2026 18:05:37 UTC

linux-secure-docs-5.10.253-1.ph4.x86_64.rpm | size : 7.9M , sha256 : ffe2adf5c571e9a22610a279e815b773f9449cee32635601f80c29d03a3345bb , build time : Thu, 23 Apr 2026 18:05:37 UTC

linux-tools-5.10.253-1.ph4.x86_64.rpm | size : 1.7M , sha256 : b86a442ecc0d37a4bc402e53c9af300848026ea9f0d1a498da226113e315c6ae , build time : Thu, 23 Apr 2026 18:05:38 UTC

openssh-8.9p1-15.ph4.x86_64.rpm | size : 16K , sha256 : 110b00efb35971149db2df44884c0fad3e2f3f711ec0f669ae612d38ba2e7036 , build time : Thu, 23 Apr 2026 18:05:36 UTC

openssh-clients-8.9p1-15.ph4.x86_64.rpm | size : 892K , sha256 : f08e9bf0907a5a49762d69e246a6d9983c5cb14866b6675627e44c7df693363e , build time : Thu, 23 Apr 2026 18:05:36 UTC

openssh-server-8.9p1-15.ph4.x86_64.rpm | size : 476K , sha256 : 0224472cda2c65e3184202ce9a5899cd59999be8b91cdda2d91fdcc1a4bc3707 , build time : Thu, 23 Apr 2026 18:05:36 UTC

openssh-socket-8.9p1-15.ph4.x86_64.rpm | size : 16K , sha256 : aa1095169e653b662e1b0612f887320111e19a7fab256b040f19dddd8b56c488 , build time : Thu, 23 Apr 2026 18:05:36 UTC