Red Hat Patches Moderate TFTP Flaw That Can Crash Enterprise Linux 8 Boot Servers
Red Hat has published errata RHSA-2026:78952, a Moderate-rated security update for the tftp packages shipped with Red Hat Enterprise Linux 8. The update addresses CVE-2026-85234, described by the vendor as a denial-of-service condition in tftp-hpa caused by an out-of-bounds read and write in the remap engine. The tftp packages provide both the client interface and the tftp-server daemon, which is most commonly deployed to serve boot images to diskless workstations, PXE clients, network appliances and switch firmware. The advisory lists the fix in build tftp-5.2-28.el8_10, covering Red Hat Enterprise Linux 8 on x86_64, IBM z Systems s390x, Power little endian ppc64le and ARM 64 aarch64, as well as the equivalent Extended Life Cycle 8.10 channels for all four architectures. Organisations running RHEL 8 provisioning, imaging or network-boot infrastructure are the population most likely to have the vulnerable packages installed and actively listening.
Red Hat has not published exploitation details for CVE-2026-85234 beyond the summary in the advisory and the associated tracking bug, BZ – 2460997, so no attack chain should be assumed. What the vendor does state is the component and the class of defect: the remap engine inside tftp-hpa, which is the subsystem that rewrites incoming filename requests according to administrator-defined rules, mishandles memory in a way that reads and writes outside the intended bounds and results in a denial of service. Because TFTP is a connectionless UDP protocol with no authentication built into the specification, any client able to reach the listening service can submit a request that passes through that processing path. The advisory assigns a security impact of Moderate and directs readers to the CVE page for the full CVSS base score, which is not reproduced in the errata text itself. Red Hat also makes Insights patch analysis available so administrators can identify which of their registered systems carry the affected packages.
The practical exposure here depends heavily on deployment. A tftp-server instance confined to an isolated provisioning VLAN and reachable only by managed hardware presents a very different risk profile from one left listening on UDP/69 across a flat corporate network or, worse, a perimeter-facing interface. Where the daemon underpins PXE boot or appliance firmware distribution, an availability failure is not merely a crashed service — it can stall imaging runs, break automated bare-metal provisioning and leave diskless endpoints unable to start, which is why this class of bug tends to surface as an operational outage rather than a security event. The Extended Life Cycle listings are a reminder that long-lived 8.10 estates, frequently the ones hosting legacy provisioning roles, fall within scope. On current exploitation status, FIRST EPSS places CVE-2026-85234 at a 0.8 percent probability of exploitation within the next 30 days, and there is no indication in the vendor advisory of in-the-wild activity, proof-of-concept code or targeted campaigns. The realistic reading is a routine, vendor-fixed memory-safety defect in a niche but widely bundled service, where the main risk comes from forgotten tftp-server instances that nobody has inventoried since the day they were stood up.
Attack Surface
File Transfer, Server OS, Infrastructure
Tactics
Impact, Discovery
Techniques
- T1499 – Endpoint Denial of Service
- T1499.004 – Application or System Exploitation
- T1046 – Network Service Discovery
SuperPRO's Threat Countermeasures Procedures
- Update the tftp and tftp-server packages on Red Hat Enterprise Linux 8 to build 5.2-28.el8_10 or later using dnf update tftp tftp-server, covering x86_64, aarch64, ppc64le and s390x hosts including the 8.10 Extended Life Cycle channels.
- Verify the installed build after patching with rpm -q tftp tftp-server and confirm the output shows 5.2-28.el8_10; the matching SRPM in RHSA-2026:78952 is tftp-5.2-28.el8_10.src.rpm with SHA-256 94da953c9a9bfe92fee96e10764c8637cef90cb043b9c93674b559bb03526140.
- Run the Red Hat Insights patch analysis for advisory RHSA-2026:78952 to enumerate every registered RHEL 8 system still carrying the vulnerable tftp or tftp-server packages, rather than relying on manual inventory.
- Stop and disable the service where network boot is not required, using systemctl disable –now tftp.socket tftp.service, and remove the tftp-server package from hosts that no longer perform PXE or diskless-boot duties.
- Restrict inbound UDP/69 with firewalld so that only the provisioning or PXE VLAN can reach tftp-server, for example firewall-cmd –permanent –zone=internal –add-service=tftp combined with removal of the tftp service from any internet-facing or general user zone.
- Review the tftpd invocation in the systemd unit or /etc/xinetd.d/tftp for -m remap rule file arguments and remove remap rule files that are no longer used, since Red Hat attributes CVE-2026-85234 to the remap engine; also keep the daemon constrained to a single served directory with the -s chroot option.
- Alert on repeated tftp.service restarts or segmentation faults by monitoring journalctl -u tftp.service and abrt reports, treating a crash loop on a boot server as a potential exploitation attempt against the patched defect.
