[redhat] False positive on RHEL 9.7: installed version matches errata fix but reported as vulnerable due to cross-minor advisory max-picking

[wagde-orca]

IDs

CVE-2026-31431

Description

When scanning a RHEL 9.7 rootfs, Trivy reports a CVE as vulnerable even though the installed package version exactly matches the fixed version published by Red Hat in a 9.7-specific errata. The false positive occurs because Trivy's advisory deduplication logic picks the highest fixed version across all minor-version advisories for the
same CVE, crossing minor-version boundaries.

Reproduction Steps

Scan a RHEL 9.7 rootfs with the kernel package at 5.14.0-611.54.1.el9_7:

  trivy rootfs /path/to/rhel9.7/ --scanners vuln --pkg-types os

  Result:
  {
    "VulnerabilityID": "CVE-2026-31431",
    "PkgName": "kernel",
    "InstalledVersion": "5.14.0-611.54.1.el9_7",
    "FixedVersion": "5.14.0-687.5.3.el9_8",
    "Status": "fixed"
  }

  Expected result:

  CVE-2026-31431 should not be reported. The installed version 5.14.0-611.54.1.el9_7 is the exact fixed version published by Red Hat for RHEL 9.7 in RHSA-2026:13565 (https://access.redhat.com/errata/RHSA-2026:13565). The system is patched.

  Root cause

  In pkg/detector/ospkg/redhat/redhat.go, buildVulns deduplicates advisories per CVE by keeping the one with the highest fixed version:

  if version.NewVersion(a.FixedVersion).LessThan(version.NewVersion(adv.FixedVersion)) {
      uniqAdvisories[adv.VulnerabilityID] = adv
  }

  For CVE-2026-31431, the standard RHEL 9 content sets contain two advisories:
  - 5.14.0-611.54.1.el9_7 — from the 9.7 errata (RHSA-2026:13565)
  - 5.14.0-687.5.3.el9_8 — from a later 9.8 advisory

  buildVulns picks 5.14.0-687.5.3.el9_8 as the canonical fix. Then:

  5.14.0-611.54.1.el9_7 < 5.14.0-687.5.3.el9_8  →  reported as vulnerable

  But 5.14.0-611.54.1.el9_7 IS the fix for the 9.7 minor. The comparison crosses minor boundaries incorrectly.

Target

Filesystem

Scanner

Vulnerability

Target OS

RHEL 9.7

Debug Output

will provide if needed

Version

0.72.0

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[DmitriyLewen]

Hello @wagde-orca
Thanks for your report!

Created #11199

Regards, Dmitriy