Red Hat Patches Important curl Use After Free Flaw in Enterprise Linux 10
Red Hat issued security advisory RHSA-2026:96092 on 9 November 2026, delivering an updated curl package for Red Hat Enterprise Linux 10 and rating the fix as Important under its own severity classification. The update addresses a single tracked issue, CVE-2026-92392, described by Red Hat as a use-after-free condition in curl's HTTP/2 upload handling and tracked internally as Bugzilla 2548642. The affected software is not a niche component: the curl packages provide both the libcurl library and the curl command line utility used to transfer files over HTTP, FTP, LDAP and other protocols, so the exposure extends to any application on the host that links against libcurl rather than only to interactive use of the curl binary. The advisory covers an unusually broad product matrix, including Red Hat Enterprise Linux 10 for x86_64, IBM z Systems (s390x), Power little endian (ppc64le) and ARM 64 (aarch64), together with the 10.2 Extended Update Support, four years of updates and Extended Life Cycle streams on each of those architectures. Fixed binaries are published as curl-8.12.1-4.el10_2.8, with matching builds for libcurl, libcurl-minimal and libcurl-devel.
Red Hat has not published exploitation details for this flaw in the errata itself, and no proof-of-concept, attack chain or observed attacker tradecraft is described in the advisory. What the advisory does state is the vulnerability class and the code path involved: a use-after-free, a memory-safety defect in which a program continues to reference memory it has already released, occurring in the HTTP/2 upload path. Defects of this class are generally associated with instability and memory corruption rather than with a single predictable outcome, and the practical severity depends on how the freed allocation is subsequently reused. The advisory directs readers to the linked CVE page for the CVSS base score, acknowledgements and impact statement rather than reproducing them, so the detailed scoring is not carried in the errata text. Based on the component named, exposure tracks to systems whose outbound transfers negotiate HTTP/2 and perform uploads through curl or libcurl, including the minimal libcurl build commonly pulled into container images.
The strategic concern with a libcurl defect is reach rather than novelty. libcurl is one of the most widely embedded transfer libraries in a Linux estate, sitting beneath package tooling, monitoring and backup agents, CI runners, application runtimes and container base layers, which means a single advisory typically touches far more running processes than a server inventory suggests. The inclusion of Extended Update Support, four-years-of-updates and Extended Life Cycle channels in the affected list indicates that long-lived, change-controlled systems in regulated environments are equally in scope, and those are precisely the hosts where update windows are scarcest. Because the vulnerable code is loaded as a shared library, hosts can remain exposed through long-running daemons that keep the pre-update library mapped in memory even after the package has been replaced on disk. On current exploitation status, FIRST EPSS places CVE-2026-92392 at a 1.3% probability of exploitation in the next 30 days, and neither the vendor advisory nor the verified evidence available to us records confirmed exploitation in the wild. That places this in the routine-but-real category: a vendor-found, vendor-fixed memory-safety bug in a ubiquitous library, where the risk comes from the breadth of installed base and the lag before patched packages reach every architecture and lifecycle stream.
Attack Surface
Server OS, Endpoint OS, Infrastructure
Tactics
Execution, Impact
Techniques
- T1203 – Exploitation for Client Execution
- T1499.004 – Endpoint Denial of Service: Application or System Exploitation
SuperPRO's Threat Countermeasures Procedures
- Update curl, libcurl, libcurl-minimal and libcurl-devel to 8.12.1-4.el10_2.8 on Red Hat Enterprise Linux 10 and 10.2 EUS/ELS systems (dnf update curl libcurl libcurl-minimal), which is the build Red Hat ships to fix CVE-2026-92392 under RHSA-2026:96092.
- Inventory exposure with rpm -qa 'curl*' 'libcurl*' across x86_64, s390x, ppc64le and aarch64 hosts and flag anything below version-release 8.12.1-4.el10_2.8, including Extended Update Support, four-years-of-updates and Extended Life Cycle 10.2 systems listed in the advisory.
- Run the Red Hat Lightspeed patch analysis against advisory RHSA-2026:96092 to enumerate registered systems still reporting the vulnerable curl package rather than relying on a manual server list.
- Rebuild and redeploy container images based on RHEL 10 or UBI 10 layers that bundle libcurl or libcurl-minimal, and add a registry scan rule that fails images carrying libcurl earlier than 8.12.1-4.el10_2.8.
- After patching, identify daemons still mapping the old shared object with needs-restarting -r or lsof | grep libcurl.so and restart affected services, since long-running processes keep the pre-update libcurl in memory.
- Where the update must be scheduled later, force upload jobs away from the affected HTTP/2 path by passing –http1.1 to curl invocations or setting CURLOPT_HTTP_VERSION to CURL_HTTP_VERSION_1_1 in libcurl-based code, and record the exception for rollback once patched.
- Validate downloaded packages against the SHA-256 digests published in the errata, for example curl-8.12.1-4.el10_2.8.x86_64.rpm 2cc5b80a655ed04d2363a9c44f83fddc2d4c21fdc84faaff044bba148f7a51ea and the source RPM 1828c02634b9e867d1f7429304d884f22063163dbcd352e4b6f3a509cd59c1f2, before pushing them to internal mirrors.
