Red Hat has 1,286 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1044 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 639. The median CVSS is 7.0 (high), with 57 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1044 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1286 CVEsRSS
CVE-2026-89663High· 7.0kernel: nfsd: revoke copy-notify stateids before dropping their reference (CVE-2026-89663)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). This vulnerability arises from improper handling of "copy-notify stateids" during their revocation. When a stateid's reference is dropped without unlinking it, the m…
CVE-2026-89662High· 7.0⚖ disputedkernel: NFSD: Prevent lock owner use-after-free during client teardown (CVE-2026-89662)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). During client teardown, a race condition can occur where a lock owner is freed while still being referenced, leading to a use-after-free vulnerability. This can resu…
CVE-2026-89657High· 7.0kernel: libceph: validate OSD extent maps before cursor advance (CVE-2026-89657)
A flaw was found in libceph in the Linux kernel. A malicious or compromised authenticated Ceph Object Storage Device (OSD) peer could send a specially crafted sparse-read reply that lacks proper validation of extent maps. This could cause …
CVE-2026-89656High· 7.0⚖ disputedkernel: libceph: reject buckets with mismatched CRUSH ids (CVE-2026-89656)
A flaw was found in libceph within the Linux kernel. This vulnerability allows a local attacker to craft a malformed CRUSH map, which is used for data placement. By doing so, one data bucket can be made to reuse another bucket's memory wor…
CVE-2026-89655High· 7.0⚖ disputedkernel: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock (CVE-2026-89655)
A flaw was found in the Linux kernel's Ceph file system component. A race condition exists in the `__kick_flushing_caps()` function during the handling of capability messages. This allows a separate process to free a data structure (`cf en…
CVE-2026-89653High· 8.1⚖ disputedkernel: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode (CVE-2026-89653)
A flaw was found in the Linux kernel's Ceph filesystem. This vulnerability occurs when a malicious or malformed MDSMap export_targets entry, controlled by a monitor, contains a rank value that exceeds the maximum allowed (CEPH_MAX_MDS) dur…
CVE-2026-89652High· 7.0⚖ disputedkernel: ceph: bound copied dentry name length in NFS export get_name (CVE-2026-89652)
A flaw was found in the Linux kernel's Ceph file system. A malicious or compromised Ceph Metadata Server (MDS) can send a specially crafted `LOOKUPNAME` reply that causes a buffer overflow when copying dentry names during an NFS export ope…
CVE-2026-89650High· 7.0⚖ disputedkernel: ceph: bound num_export_targets array for mds info v2/v3 (CVE-2026-89650)
A flaw was found in the Linux kernel's Ceph client. A malicious or compromised Ceph monitor, or an on-path attacker, can send a specially crafted Metadata Server (MDS) map. This map, with an oversized num_export_targets field and a per-MDS…
CVE-2026-89649High· 7.0⚖ disputedkernel: ceph: bound xattr value length in __build_xattrs() (CVE-2026-89649)
A flaw was found in the Linux kernel's Ceph file system (CephFS) component. A malicious or compromised metadata server can manipulate the length of an extended attribute (xattr) value, causing the system to read beyond the intended memory …
CVE-2026-89640Medium· 5.5kernel: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 (CVE-2026-89640)
A flaw was found in the Linux kernel's Common Internet File System (CIFS) implementation. When performing a file range remapping operation with a zero length, an integer underflow can occur if the offset exceeds the file size. This can lea…
CVE-2026-89636High· 7.0⚖ disputedkernel: smb: client: clear ce->tgthint in free_tgts() (CVE-2026-89636)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. When the `free_tgts()` function frees data structures, a pointer (`ce->tgthint`) is not properly reset, leaving it pointing to a memory location that has already bee…
CVE-2026-89634High· 7.0⚖ disputedkernel: smb: client: fix ALIGN() overflow in symlink_data() error context loop (CVE-2026-89634)
A flaw was found in the Server Message Block (SMB) client within the Linux kernel. An integer overflow in the ALIGN() function, specifically within the symlink_data() error context loop, can lead to an out-of-bounds read. This issue allows…
CVE-2026-89628Medium· 5.5kernel: HID: picolcd: clamp eeprom debugfs read to bytes actually received (CVE-2026-89628)
A flaw was found in the Human Interface Device (HID) picolcd driver in the Linux kernel. A local attacker with root privileges, by using a specially crafted or spoofed picoLCD device, could exploit an out-of-bounds read vulnerability in th…
CVE-2026-89627Medium· 5.5kernel: HID: roccat: free buffered reports when destroying device (CVE-2026-89627)
A flaw was found in the Linux kernel's HID (Human Interface Device) roccat driver. When a roccat device is destroyed, the driver fails to properly free buffered reports, leading to a memory leak. A local attacker could potentially exploit …
CVE-2026-89626High· 7.0kernel: HID: sensor: custom: Fix field sysfs group cleanup on failure (CVE-2026-89626)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor custom driver. When creating sysfs groups for custom sensor fields, the `hid_sensor_custom_add_attributes()` function fails to properly clean up previously created …
CVE-2026-89623Medium· 5.5kernel: HID: mcp2221: stop device IO before hid_hw_stop (CVE-2026-89623)
A flaw was found in the Linux kernel's HID (Human Interface Device) mcp2221 driver. This vulnerability occurs when the device's input/output (IO) operations are not properly stopped before hardware teardown during device removal or probe f…
CVE-2026-89621Medium· 5.5kernel: HID: mcp2221: validate report size in mcp2221_raw_event() (CVE-2026-89621)
A flaw was found in the Linux kernel's HID (Human Interface Device) mcp2221 driver. A malicious USB device can exploit this vulnerability by sending a specially crafted, short HID report with an invalid size. This can cause the system to r…
CVE-2026-89618Medium· 5.5kernel: eventfs: Initialize ei->children and ei->list in init_ei() (CVE-2026-89618)
A flaw was found in the Linux kernel's eventfs component. When the `eventfs_create_dir()` function fails due to memory pressure, an uninitialized internal data structure can cause the system to issue a misleading warning during the cleanup…
CVE-2026-89617Medium· 5.5⚖ disputedkernel: fs/ntfs3: validate dirty page table on log replay (CVE-2026-89617)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. An attacker with local access could craft a malicious NTFS log file. During log replay, insufficient validation of the `lcns_follow` field in a `DIR_PAGE_ENTRY` could lead to …
CVE-2026-89616Medium· 5.5⚖ disputedkernel: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() (CVE-2026-89616)
A flaw was found in the Linux kernel's NTFS3 filesystem driver. When decompressing LZNT data, the `ni_read_frame()` function may not fully zero out memory after a partial decompression. This can lead to the disclosure of previously used ke…
CVE-2026-89615Medium· 5.5⚖ disputedkernel: fs/ntfs3: bound page_lcns[] index by the log record (CVE-2026-89615)
A flaw was found in the Linux kernel's NTFS3 file system driver. A local attacker could exploit this by providing a specially crafted log record. This crafted record causes a buffer overflow in the page_lcns[] array, leading to memory corr…
CVE-2026-89609High· 7.0kernel: ecryptfs: hold msg ctx list lock when cleaning daemon queue (CVE-2026-89609)
A flaw was found in the eCryptfs component of the Linux kernel. A race condition occurs during the cleanup of the daemon message queue because a required lock is not held. This can lead to unpredictable system behavior or instability due t…
CVE-2026-89608Medium· 5.5kernel: ecryptfs: pass packet set buffer size to parser (CVE-2026-89608)
A flaw was found in the `ecryptfs` component of the Linux kernel. The `ecryptfs_parse_packet_set()` function incorrectly calculates the available buffer size when processing version 1 headers, leading to an overstatement of the buffer's ac…
CVE-2026-89746High· 7.0kernel: tracing: Fix use-after-free with same-name named triggers (CVE-2026-89746)
A flaw was found in the Linux kernel's tracing component. A local user can exploit a use-after-free vulnerability by registering multiple histogram triggers with the same name. This action causes the kernel to attempt to access freed memor…
CVE-2026-89744Medium· 5.5⚖ disputedkernel: device property: fix infinite loop in fwnode_for_each_child_node() (CVE-2026-89744)
A flaw was found in the Linux kernel's device property handling. When the kernel iterates over child nodes of a firmware node (fwnode) that also has a secondary fwnode, the `fwnode_get_next_child_node()` function can enter an endless loop.…
CVE-2026-89742Medium· 5.5⚖ disputedkernel: rapidio: mport_cdev: fix use-after-free in dma_req_free() (CVE-2026-89742)
A flaw was found in the Linux kernel. A local user could exploit a use-after-free vulnerability in the `dma_req_free()` function within the RapidIO mport character device interface. This flaw occurs when the `dma_req_free()` function attem…
CVE-2026-89741High· 7.0kernel: Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the `__video_register_device()` function. If a device registration fails, the sy…
CVE-2026-89736Medium· 5.5⚖ disputedkernel: usb: gadget: u_audio: Fix use-after-free on sound card disconnect (CVE-2026-89736)
A flaw was found in the Linux kernel's USB audio gadget driver (u_audio). This vulnerability occurs during sound card disconnection when Asynchronous Linux Sound Architecture (ALSA) control elements (kctls) remain open in userspace. A loca…
CVE-2026-89735Medium· 5.5kernel: usb: gadget: midi2: remove default configfs groups on teardown (CVE-2026-89735)
A flaw was found in the Linux kernel's USB gadget MIDI2 driver. The driver fails to properly remove default configuration file system (configfs) groups during teardown, leading to a resource leak. A local attacker could exploit this vulner…
CVE-2026-89733Medium· 5.5⚖ disputedkernel: usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() (CVE-2026-89733)
A flaw was found in the Linux kernel's USB Video Class (UVC) gadget driver. This vulnerability occurs in the `uvc_function_bind()` and `uvc_function_unbind()` functions, where pointers to freed memory are not properly cleared. This can lea…