Red Hat has 1,284 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1042 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 637. The median CVSS is 7.0 (high), with 58 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1042 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1284 CVEsRSS
CVE-2026-89691High· 7.0kernel: nfsd: clear opcnt on compound arg release to prevent OOB read (CVE-2026-89691)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. The nfsd4_release_compoundargs() function does not properly clear an internal counter (opcnt) when releasing a buffer. This oversight can lead to an out-of…
CVE-2026-89690High· 7.0kernel: nfsd: defer vfree of compound ops to fix rpc_status UAF (CVE-2026-89690)
A flaw was found in the `nfsd` component of the Linux kernel. This vulnerability, a use-after-free, occurs when a specific memory buffer is prematurely released while another process is still trying to access it. This timing issue can lead…
CVE-2026-89689High· 7.0⚖ disputedkernel: nfsd: don't free session slots that are still in use (CVE-2026-89689)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. A remote attacker could exploit a use-after-free vulnerability in the `nfsd4_sequence()` function. This occurs when the system attempts to reduce the number o…
CVE-2026-89688High· 7.0⚖ disputedkernel: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (CVE-2026-89688)
A flaw was found in the Linux kernel's nfsd component. During a `seqid_op` replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue…
CVE-2026-89686High· 7.0⚖ disputedkernel: nfsd: fix BUG_ON in nfsd4_alloc_layout_stateid on racing delegation revoke (CVE-2026-89686)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) for NFSv4 layouts. A race condition allows a remote attacker to trigger a kernel panic, leading to a Denial of Service (DoS). This occurs when the `nfsd4_alloc_layout…
CVE-2026-89682High· 7.0kernel: nfsd: fix fcache_disposal UAF by inlining dispose state into nfsd_net (CVE-2026-89682)
A flaw was found in the Linux kernel's NFS daemon (nfsd) component. The nfsd_file_dispose_list_delayed() function, responsible for deferring file disposal, uses a separately allocated structure for its freeme queue. During network namespac…
CVE-2026-89681High· 7.0⚖ disputedkernel: nfsd: fix layout fence worker double-reference race (CVE-2026-89681)
A flaw was found in the Linux kernel's nfsd component. A race condition in the layout fence worker can cause a double-reference to a layout stateid. This occurs because the workqueue core clears a pending flag prematurely, allowing a new w…
CVE-2026-89680High· 7.0⚖ disputedkernel: nfsd: fix nfsd_file leak on inter-server COPY setup failure (CVE-2026-89680)
A flaw was found in the Linux kernel's nfsd component. This vulnerability occurs when an inter-server COPY operation fails during its setup phase, leading to improper resource cleanup. Consequently, each failed operation results in a memor…
CVE-2026-89679Medium· 5.5kernel: nfsd: fix null dereference in nfsd4_setattr for deleg timestamp attrs (CVE-2026-89679)
A flaw was found in the Linux kernel's nfsd component. A remote attacker can exploit this by sending a specially crafted SETATTR request that includes specific delegation timestamp attributes and a special NFSv4 state ID. This triggers a n…
CVE-2026-89678High· 7.0kernel: nfsd: fix partial-write detection in nfsd_direct_write (CVE-2026-89678)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The `nfsd_direct_write()` function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic f…
CVE-2026-89677High· 7.0⚖ disputedkernel: nfsd: fix possible fh_compose of wrong dentry in nfsd4_create_file() (CVE-2026-89677)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When creating files, the `dentry_create()` function could return an unexpected directory entry (dentry). This could lead to a previously stored dentry being prematur…
CVE-2026-89675High· 7.0⚖ disputedkernel: nfsd: fix UAF in async copy cancel and shutdown (CVE-2026-89675)
A flaw was found in the Linux kernel's nfsd component. A race condition exists during asynchronous copy cancellation and shutdown operations, which can lead to a Use-After-Free (UAF) vulnerability. This allows an async copy object to be fr…
CVE-2026-89670High· 7.0kernel: nfsd: hold rcu across localio cmpxchg retry (CVE-2026-89670)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. A race condition exists in the `nfsd_open_local_fh()` function where an `nfsd_file` object can be freed and its memory recycled while another process attem…
CVE-2026-89668High· 7.0⚖ disputedkernel: nfsd: move nfsd_debugfs_init() after nfsd4_init_slabs() in init_nfsd() (CVE-2026-89668)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd_debugfs_init()` function is called before `nfsd4_init_slabs()`. If the slab allocation fails, the `nfsd_debugfs_exit()` cleanup function is bypassed, leaving orphaned …
CVE-2026-89664High· 7.0kernel: nfsd: release OPEN-decoded posix ACLs via op_release (CVE-2026-89664)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing malformed NFSv4 OPEN compound operations that include valid Portable Operating System Interface (POSIX) Access Control List (ACL) attributes, the ker…
CVE-2026-89658High· 7.0⚖ disputedkernel: NFSD: Prevent client use-after-free during NFSv4.0 revoked-state cleanup (CVE-2026-89658)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During NFSv4.0 revoked-state cleanup, a race condition can occur where a client's state identifier (stateid) reference does not properly prevent the client from bein…
CVE-2026-89654High· 7.0⚖ disputedkernel: ceph: fix UAF in check_new_map() on session freed during unlock (CVE-2026-89654)
A flaw was found in the Ceph file system component of the Linux kernel. A race condition exists in the `check_new_map()` function during session handling. This allows a local attacker to exploit a use-after-free vulnerability by freeing a …
CVE-2026-89651High· 7.0⚖ disputedkernel: ceph: bound MDSCapAuth path and fs_name decode in handle_session() (CVE-2026-89651)
A flaw was found in the Linux kernel's Ceph client. An out-of-bounds read vulnerability exists in the `handle_session()` function when decoding `MDSCapAuth` records. A malicious or compromised Metadata Server (MDS) can trigger this during …
CVE-2026-89648High· 7.0kernel: ceph: cap delegated inode count in ceph_parse_deleg_inos() (CVE-2026-89648)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph Metadata Server (MDS) could send a specially crafted reply with an unbounded number of delegated inode intervals. This could cause the client to enter an i…
CVE-2026-89647Medium· 5.5⚖ disputedkernel: ceph: do not repeat ceph_trim_dentries() if no progress possible (CVE-2026-89647)
A flaw was found in the Linux kernel's Ceph file system. The `ceph_trim_dentries()` function, when invoked by `ceph_cap_reclaim_work()`, can enter an infinite loop under specific conditions where no leases need to be reclaimed. This busy l…
CVE-2026-89646Medium· 5.5⚖ disputedkernel: ceph: fix leaked inode reference on writeback abort at umount (CVE-2026-89646)
A flaw was found in the Ceph filesystem component of the Linux kernel. When a writeback operation is aborted during an unmount process, a reference to an inode (a data structure describing a filesystem object) is not properly released. Thi…
CVE-2026-89641High· 7.0⚖ disputedkernel: cifs: clear tcon after cifsFileInfo_put() in cifs_file_set_size() (CVE-2026-89641)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) module. This vulnerability, a use-after-free, occurs in the `cifs_file_set_size()` function. When a file's size is being modified, a critical system resource (tcon o…
CVE-2026-89639Medium· 5.5⚖ disputedkernel: cifs: use cifs_invalidate_cache() in cifs_do_truncate() for O_TRUNC (CVE-2026-89639)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When a file is truncated, the `cifs_do_truncate()` function does not properly invalidate the file system cache (fscache). This oversight can lead to …
CVE-2026-89638High· 7.8kernel: smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions (CVE-2026-89638)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When a file with the setuid or setgid bit is written to on certain Common Internet File System (CIFS) mounts (specifically those using 'cifsacl', 'modefromsid' optio…
CVE-2026-89632High· 7.0kernel: smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr() (CVE-2026-89632)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A malicious server could exploit this vulnerability by sending specially crafted data, leading to an out-of-bounds read. This occurs because the `reparse_buf_ptr()` …
CVE-2026-89771Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring buffer readers (CVE-2026-89771)
A flaw was found in the Linux kernel. A race condition exists in the ring buffer resizing mechanism, where `trace_buffer subbuf_size` can be read without proper locking while it is being simultaneously resized. This could allow a local att…
CVE-2026-89769Medium· 5.5kernel: clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (CVE-2026-89769)
A flaw was found in the Linux kernel's NXP PIT (Programmable Interrupt Timer) clocksource driver. When the CPU hotplug setup fails after an interrupt request (IRQ) has been successfully registered, the error handling does not properly free…
CVE-2026-89767Medium· 5.5⚖ disputedkernel: ovl: fix double end_creating() on the casefold-mismatch path (CVE-2026-89767)
A flaw was found in the Linux kernel's overlay file system (overlayfs). An unprivileged local user can trigger a specific error condition during the creation of a new directory. This error causes the system to incorrectly release a lock on…
CVE-2026-89764Medium· 5.5⚖ disputedkernel: rust: devres: fix race between concurrent revokers (CVE-2026-89764)
A flaw was found in the Linux kernel's `rust: devres` component. A race condition exists when two processes attempt to revoke a `Devres` resource concurrently. This can lead to a use-after-free vulnerability, where one process might free r…
CVE-2026-89762Medium· 5.5⚖ disputedkernel: apparmor: fix cred UAF caused by begin_current_label_crit_section() (CVE-2026-89762)
A flaw was found in the Linux kernel's AppArmor security module. The begin_current_label_crit_section() function, used in various Linux Security Module (LSM) hooks, attempts to replace user credentials when a security label becomes stale. …