Red Hat has 1,284 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1042 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 637. The median CVSS is 7.0 (high), with 58 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1042 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1284 CVEsRSS
CVE-2026-80951High· 7.0kernel: i3c: master: svc: bound IBI payload to the requested max_payload_len (CVE-2026-80951)
A flaw was found in the Linux kernel's I3C master driver. A malicious I3C device could exploit this by sending an In-Band Interrupt (IBI) payload that exceeds the allocated slot size. This can lead to an out-of-bounds write into the IBI po…
CVE-2026-80949Medium· 5.5kernel: wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control() (CVE-2026-80949)
A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. The memory allocated for a buffer is not properly released in certain error handling paths within the `brcmf_sdio_read_control()` function. This improper memory management can l…
CVE-2026-80944High· 7.0kernel: wifi: mwifiex: Detach sync cmd buffer on interrupted wait (CVE-2026-80944)
A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can l…
CVE-2026-80941Medium· 5.5kernel: wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb() (CVE-2026-80941)
A flaw was found in the rtw88 Wi-Fi driver of the Linux kernel. This issue occurs because the rtw_txq_push_skb() function fails to free a socket buffer (skb) when an error occurs during transmission. This oversight can lead to a memory lea…
CVE-2026-80939Medium· 5.5kernel: wifi: rtw89: pci: add .shutdown callback to stop rfkill polling on reboot (CVE-2026-80939)
A flaw was found in the Linux kernel's rtw89 PCI driver. During a warm reboot on ARM64 platforms, the driver's missing shutdown callback fails to stop radio frequency kill (rfkill) polling. This leads to attempts to read from a non-respond…
CVE-2026-80938Medium· 5.5kernel: wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex (CVE-2026-80938)
A flaw was found in the Linux kernel, specifically within the `mt7615` Wi-Fi driver. A deadlock can occur during system suspend operations when the suspend process attempts to acquire a mutex (a locking mechanism) while simultaneously wait…
CVE-2026-80935Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy (CVE-2026-80935)
A flaw was found in the Linux kernel's Wi-Fi driver for MediaTek MT7996 devices. A malicious or malfunctioning Wi-Fi device can exploit improper validation of an EEPROM (Electrically Erasable Programmable Read-Only Memory) address during a…
CVE-2026-80933Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7996: validate default EEPROM firmware size (CVE-2026-80933)
A flaw was found in the Linux kernel's mt76: mt7996 Wi-Fi driver. This vulnerability occurs because the driver does not properly validate the size of the default EEPROM (Electrically Erasable Programmable Read-Only Memory) firmware. A spec…
CVE-2026-80931Medium· 5.5⚖ disputedkernel: w1: ds28e17: reject an oversize length on an I2C block read (CVE-2026-80931)
A flaw was found in the Linux kernel's w1: ds28e17 1-Wire to I2C bridge driver. A malicious I2C slave device can provide an oversized length during an I2C block read operation. This causes the driver to read beyond the allocated buffer, le…
CVE-2026-80930Medium· 5.5kernel: tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout (CVE-2026-80930)
A flaw was found in the Linux kernel's TPM I2C Nuvoton driver. The `i2c_nuvoton_wait_for_stat()` function enables an interrupt (IRQ) but fails to disable it if the wait operation times out or is interrupted. This oversight can lead to an u…
CVE-2026-80928Medium· 5.5⚖ disputedkernel: smack: fix cred UAF in smack_file_send_sigiotask() (CVE-2026-80928)
A flaw was found in the Linux kernel's SMACK (Simplified Mandatory Access Control Kernel) security module. Incorrect handling of task credentials within the smack_file_send_sigiotask() function can lead to a Use-After-Free (UAF) vulnerabil…
CVE-2026-89440High· 7.0kernel: mmc: via-sdmmc: stop card-detect handling on probe failure (CVE-2026-89440)
A flaw was found in the Linux kernel's mmc: via-sdmmc component. During the probe process, if the `mmc_add_host()` function fails, the SD card-detect interrupt handler continues to operate on memory that has already been released. This can…
CVE-2026-89438Medium· 5.5kernel: platform/x86: ISST: Validate logical CPU id and clos id (CVE-2026-89438)
A flaw was found in the Linux kernel, specifically within the Intel Speed Select Technology (ISST) component. This vulnerability arises from insufficient validation of input values, such as logical CPU ID and CLOS ID, used in the core powe…
CVE-2026-89437Medium· 5.5kernel: platform/x86: int1092: Fix potential memory leak in sar_probe() (CVE-2026-89437)
A flaw was found in the Linux kernel. The `sar_probe()` function, specifically in its error handling paths, fails to free memory allocated for `device_mode_info` by the `parse_package()` function, which is called by `sar_get_data()`. This …
CVE-2026-81017Medium· 5.5⚖ disputedkernel: platform/chrome: sensorhub: Bound the EC-reported sensor number (CVE-2026-81017)
A flaw was found in the Linux kernel's `sensorhub` component. A local attacker could provide a maliciously crafted sensor number in an EC FIFO event. This unchecked sensor number could lead to an out-of-bounds read and write in the `batch_…
CVE-2026-81014Medium· 5.5kernel: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() (CVE-2026-81014)
A flaw was found in the Linux kernel's `hp-bioscfg` module. A local attacker with write access to the `sysfs` entry for `hp-bioscfg` could exploit a heap out-of-bounds read vulnerability. This occurs because the `sk_store()` and `kek_store…
CVE-2026-81013Medium· 5.5kernel: platform/x86: hp-bioscfg: fix heap OOB read on empty password write (CVE-2026-81013)
A flaw was found in the hp-bioscfg component of the Linux kernel. A local user could trigger a heap out-of-bounds read by writing an empty string to the current_password or new_password fields. This occurs because the validate_password_inp…
CVE-2026-81011Medium· 5.5kernel: platform/x86: hp-bioscfg: pass validated element count to package parsers (CVE-2026-81011)
A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently p…
CVE-2026-81008High· 7.0kernel: interconnect: Fix use after free in icc_get() and of_icc_get_by_index() (CVE-2026-81008)
A flaw was found in the Linux kernel's interconnect subsystem. When a dynamic memory allocation fails during path initialization, an object is prematurely freed while still being referenced in internal lists. This creates dangling pointers…
CVE-2026-81005Medium· 4.1kernel: ipmi: si: Fix NULL pointer dereference after failed registration (CVE-2026-81005)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. During the registration of an IPMI message handler, if the Baseboard Management Controller (BMC) device information cannot be fetched, a NUL…
CVE-2026-81002High· 7.0⚖ disputedkernel: xdp: fix zero-copy frame layout (CVE-2026-81002)
A flaw was found in the Linux kernel's XDP (eXpress Data Path) component. Incorrect handling of zero-copy frame layout in the `xdp_convert_zc_to_xdp_frame()` function can allow an AF_XDP zero-copy packet, when redirected through `cpumap`, …
CVE-2026-81001High· 7.0kernel: slip: fix use-after-free in sl_sync() (CVE-2026-81001)
A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. A race condition in the `sl_sync()` function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after …
CVE-2026-81000High· 7.8PoCkernel: net: tun: bound receive headroom (CVE-2026-81000)
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tun_get_user() function when processing oversized headroom requests. This can occur if Open vSwitch (OVS) propagates an excessively lar…
CVE-2026-80994High· 7.0kernel: net: openvswitch: fix flow mask use-after-free on flow deletion (CVE-2026-80994)
A flaw was found in the Open vSwitch component of the Linux kernel. A local attacker could exploit a use-after-free vulnerability during flow deletion. This occurs due to a race condition where the flow mask is freed prematurely, allowing …
CVE-2026-80992Medium· 5.5⚖ disputedkernel: net: ravb: avoid dereferencing an invalid PTP clock (CVE-2026-80992)
A flaw was found in the `net: ravb` component of the Linux kernel. This vulnerability allows for a NULL pointer dereference when the Precision Time Protocol (PTP) clock's index is queried before it is properly initialized or if its registr…
CVE-2026-80990Medium· 5.5kernel: net: thunderbolt: Release the Rx HopID that was handed out on mismatch (CVE-2026-80990)
A flaw was found in the Linux kernel's Thunderbolt networking driver. An issue in the `tbnet_connected_work()` function can lead to a resource leak. When an unexpected HopID is allocated during an XDomain connection, the ID is not properly…
CVE-2026-80989High· 7.0kernel: net: thunderbolt: Mark the connection down when bringing it up fails (CVE-2026-80989)
A flaw was found in the Linux kernel's Thunderbolt networking subsystem. When a Thunderbolt connection fails to establish, the system may not correctly update its state, leading to repeated attempts to tear down an already inactive connect…
CVE-2026-80988Medium· 5.5kernel: NTB: ntb_transport: Fail TX enqueue when the QP link is down (CVE-2026-80988)
A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) transport module. When the NTB transport attempts to transmit packets while the Queue Pair (QP) link is down, the system incorrectly reports a successful transmission with…
CVE-2026-80987Medium· 5.5⚖ disputedkernel: NTB: ntb_transport: Reject oversized TX buffers (CVE-2026-80987)
A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) transport module. When processing oversized transmit (TX) buffers, the system fails to properly free the allocated memory, leading to a memory leak. This continuous leakag…
CVE-2026-80984Medium· 5.5kernel: net/smc: do not dereference an unset send buffer on the SMC-D teardown path (CVE-2026-80984)
A flaw was found in the `net/smc` component of the Linux kernel. When a link group terminates while a socket is waiting in `smc_close_stream_wait()`, a NULL pointer dereference can occur during the SMC-D teardown path. This can lead to a s…