Red Hat has 1,284 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1042 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 637. The median CVSS is 7.0 (high), with 58 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1042 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1284 CVEsRSS
CVE-2026-89761Medium· 5.5⚖ disputedkernel: apparmor: fix out-of-bounds write when null terminating a label vec (CVE-2026-89761)
A flaw was found in the Linux kernel's AppArmor security module. An out-of-bounds write vulnerability exists when null terminating a label vector due to improper memory allocation. An unprivileged local attacker can exploit this by writing…
CVE-2026-89760High· 7.0⚖ disputedkernel: mm, swap: don't free a hibernation slot that is in the swap cache (CVE-2026-89760)
A flaw was found in the Linux kernel's memory management (mm) and swap subsystem. This vulnerability occurs when the swap_free_hibernation_slot() function incorrectly frees a hibernation slot while a memory page (folio) is still present in…
CVE-2026-89758High· 7.0⚖ disputedkernel: mm/mempolicy: skip non-present PMDs when queueing folios (CVE-2026-89758)
A flaw was found in the Linux kernel's memory management subsystem. When an HMM-based Graphics Processing Unit (GPU) driver migrates a Transparent Huge Page (THP) to device memory, it can leave a device-private Page Middle Directory (PMD) …
CVE-2026-89754High· 7.0kernel: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() (CVE-2026-89754)
A flaw was found in the Linux kernel's memory management (mm/pagewalk) component. An issue in the `walk_pmd_range()` function, where a stale `walk->action` state is not properly reset, can lead to duplicate walk callbacks. A local attacker…
CVE-2026-89748Medium· 5.5kernel: tracing: Fix retry exhaustion in simple ring buffer reader swap (CVE-2026-89748)
A flaw was found in the Linux kernel's tracing subsystem. An issue in the `simple_ring_buffer_swap_reader_page()` function, related to retry exhaustion during ring buffer reader page swaps, can lead to incorrect handling of successful or f…
CVE-2026-89747High· 7.0⚖ disputedkernel: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (CVE-2026-89747)
A flaw was found in the Linux kernel's tracing component. A local attacker could exploit a use-after-free vulnerability, a type of memory corruption, by manipulating the `trace_pipe` functionality. This occurs when the system attempts to r…
CVE-2026-89743Medium· 5.5kernel: misc: nsm: bound the device-reported response length (CVE-2026-89743)
A flaw was found in the Linux kernel's Network Shared Memory (NSM) component. A malicious or buggy backend can report a response length larger than the allocated buffer. This can lead to an out-of-bounds read, disclosing adjacent kernel me…
CVE-2026-89738Medium· 5.5⚖ disputedkernel: usb: gadget: at91_udc: drain polled-VBUS timer/work before udc is freed (CVE-2026-89738)
A flaw was found in the Linux kernel's `at91_udc` USB gadget driver. In polled-VBUS mode, a timing issue during driver unbinding or probe failure can lead to a use-after-free vulnerability. A local attacker could exploit this by triggering…
CVE-2026-89713High· 7.0⚖ disputedkernel: NFSD: check truncate permission under inode lock (CVE-2026-89713)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A remote attacker, by sending a crafted file attribute modification request (SETATTR) while a file is being concurrently appended, could exploit a time-of-check to t…
CVE-2026-89709High· 7.0⚖ disputedkernel: lockd, nfsd: RCU-protect nlmsvc_ops dispatch (CVE-2026-89709)
A flaw was found in the Linux kernel's lockd and nfsd components. An unguarded dereference of nlmsvc_ops after the nfsd module is removed can lead to a NULL pointer dereference or a use-after-free condition. This vulnerability could allow …
CVE-2026-89705High· 7.0kernel: nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths (CVE-2026-89705)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, nfsd. This vulnerability occurs due to a synchronization issue where a status counter (rq_status_counter) is not correctly reset on all exit paths within the nfsd_dis…
CVE-2026-89703High· 7.0⚖ disputedkernel: nfsd: set SC_STATUS_FREED in nfsd4_drop_revoked_stid for delegations (CVE-2026-89703)
A flaw was found in the `nfsd` component of the Linux kernel. The `nfsd4_drop_revoked_stid()` function, which handles admin-revoked delegations, fails to correctly set a status flag before releasing a lock. This oversight can lead to a use…
CVE-2026-89702High· 7.0⚖ disputedkernel: nfsd: size fh_verify server sockaddr slot by xpt_locallen (CVE-2026-89702)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When processing NFSv2/v3-over-UDP requests, the `nfsd_fh_verify` and `nfsd_fh_verify_err` tracepoints incorrectly size a memory buffer. This can lead to an out-of-bo…
CVE-2026-89695High· 7.0⚖ disputedkernel: nfsd: cap decoded POSIX ACL count to bound sort cost (CVE-2026-89695)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). The `nfsd4_decode_posixacl()` function, responsible for decoding POSIX Access Control Lists (ACLs), does not properly cap the entry count received from a client. A r…
CVE-2026-89687Medium· 5.5kernel: nfsd: ensure nfsd_file_do_acquire() does not use a non-opened file (CVE-2026-89687)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). The `nfsd_file_do_acquire()` function might attempt to use a file that has not been fully opened, as the `->atomic_open` operation could return success prematurely. …
CVE-2026-80932Medium· 5.5⚖ disputedkernel: vsock/virtio: flush works in dependency order (CVE-2026-80932)
A flaw was found in the Linux kernel, specifically within the `vsock/virtio` component. An incorrect order of flushing work items during the removal of a `virtio_vsock` object can lead to a use-after-free condition. This vulnerability allo…
CVE-2026-80979High· 7.0kernel: net/smc: unregister the connection before draining the rx tasklet (CVE-2026-80979)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) component. During connection termination, the SMC component may fail to properly unregister a connection before draining its receive tasklet. This can lead to a use-…
CVE-2026-80977High· 7.0kernel: net: skbuff: don't touch shared zerocopy state in skb_tx_error() (CVE-2026-80977)
A flaw was found in the Linux kernel's networking subsystem. The `skb_tx_error()` function improperly handles shared zerocopy state in socket buffers (skbs). When a cloned skb is processed, it can prematurely signal that its pages are free…
CVE-2026-80976High· 7.0⚖ disputedkernel: seg6: reset IP6CB after IPv6 decapsulation (CVE-2026-80976)
A flaw was found in the Linux kernel's IPv6 Segment Routing (seg6) implementation. An unprivileged user can exploit this vulnerability by injecting a specially crafted IPv6 packet. This can lead to an out-of-bounds read, potentially causin…
CVE-2026-80973High· 7.0kernel: ALSA: 6fire: bound the MIDI event length from the device (CVE-2026-80973)
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the 6fire driver. This vulnerability allows a malicious USB device to trigger an out-of-bounds read by sending a specially craft…
CVE-2026-80972Medium· 5.5kernel: ALSA: aloop: Check card index validity at probe (CVE-2026-80972)
A flaw was found in the ALSA (Advanced Linux Sound Architecture) aloop driver within the Linux kernel. This vulnerability arises from insufficient validation of the card index during device setup, specifically when a device is manually con…
CVE-2026-80971High· 7.0kernel: ALSA: bcd2000: clear the URB pointers on disconnect (CVE-2026-80971)
A flaw was found in the ALSA bcd2000 driver of the Linux kernel. When a USB device using this driver is disconnected while a rawmidi substream is still active, the driver fails to clear the Universal Serial Bus Request Block (URB) pointers…
CVE-2026-80970High· 7.0kernel: ALSA: FCP: do not copy out an uninitialised init response (CVE-2026-80970)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) subsystem. This vulnerability allows a local attacker to trigger the copying of uninitialized kernel memory to userspace. By se…
CVE-2026-80969Medium· 5.5kernel: ALSA: mpu401: Check card index validity at probe (CVE-2026-80969)
A flaw was found in the Linux kernel's ALSA mpu401 driver. The driver fails to validate the card index when a device is manually bound through the sysfs interface. This oversight can lead to an out-of-bounds memory access. A local attacker…
CVE-2026-80968Medium· 5.5kernel: ALSA: mts64: Check card index validity at probe (CVE-2026-80968)
A flaw was found in the ALSA mts64 driver within the Linux kernel. This driver does not properly validate the card index, specifically failing to check for negative ID values when bound via sysfs. A local attacker could exploit this vulner…
CVE-2026-80967Medium· 5.5⚖ disputedkernel: ALSA: pcxhr: initialize mutexes before requesting threaded IRQ (CVE-2026-80967)
A flaw was found in the ALSA pcxhr driver within the Linux kernel. The `pcxhr_probe()` function requests a threaded interrupt before properly initializing a critical mutex (`mgr->lock`). This oversight could allow an early interrupt to ope…
CVE-2026-80966Medium· 5.5kernel: ALSA: portman2x4: Check card index validity at probe (CVE-2026-80966)
A flaw was found in the ALSA portman2x4 driver of the Linux kernel. This vulnerability occurs because the driver does not properly validate the card index, specifically failing to check for negative ID values. A local attacker could exploi…
CVE-2026-80965Medium· 5.5kernel: ALSA: serial-u16550: Check card index validity at probe (CVE-2026-80965)
A flaw was found in the Linux kernel's ALSA serial-u16550 driver. This vulnerability occurs because the driver does not properly validate the card index when a device is manually bound via the sysfs interface. A local user could exploit th…
CVE-2026-80963Medium· 5.5kernel: dm-stats: fix a crash if allocation of per-cpu data fails (CVE-2026-80963)
A flaw was found in the Linux kernel's `dm-stats` module. This vulnerability occurs when the allocation of per-CPU data fails, which can lead to a null pointer dereference during the subsequent cleanup operation. This issue can cause the s…
CVE-2026-80952High· 7.0kernel: i3c: master: Fix info leak and UAF in device unregister path (CVE-2026-80952)
A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents …