Red Hat has 1,286 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1044 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 639. The median CVSS is 7.0 (high), with 57 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1044 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1286 CVEsRSS
CVE-2026-89732Medium· 5.5kernel: usb: gadget: f_fs: Prevent deadlock during ep0 read loop (CVE-2026-89732)
A flaw was found in the Linux kernel's USB FunctionFS (f_fs) module. A local attacker could exploit a deadlock vulnerability in the ffs_ep0_read() function. This occurs when a userspace daemon polls ep0 and the USB gadget is simultaneously…
CVE-2026-89730Medium· 5.5kernel: fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write (CVE-2026-89730)
A flaw was found in the `altera-cvp` FPGA driver within the Linux kernel. The `altera_cvp_send_block()` function can perform an out-of-bounds read when processing the trailing bytes of an input buffer. This occurs if the buffer ends at a p…
CVE-2026-89729High· 7.0kernel: HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature (CVE-2026-89729)
A flaw was found in the Linux kernel's Human Interface Device (HID) sensor-hub driver. A local attacker could exploit this vulnerability by providing a specially crafted HID descriptor. This malicious descriptor could cause the `sensor_hub…
CVE-2026-89726Medium· 5.5kernel: lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen() (CVE-2026-89726)
A flaw was found in the Linux kernel's `ucs2_strnlen()` function. This vulnerability occurs because the function checks the current character before verifying if the maximum allowed length has been reached. If the input string is not prope…
CVE-2026-89725Medium· 5.5⚖ disputedkernel: media: cec: stm32: prevent out-of-bounds write on RX overflow (CVE-2026-89725)
A flaw was found in the Linux kernel's `media: cec: stm32` driver. A remote attacker can exploit an out-of-bounds write vulnerability by sending an overlong Consumer Electronics Control (CEC) message without an end-of-message signal. This …
CVE-2026-89724Medium· 5.5⚖ disputedkernel: media: vicodec: fix out-of-bounds write in FWHT encoder (CVE-2026-89724)
A flaw was found in the Linux kernel's `media: vicodec` component. An out-of-bounds write vulnerability exists in the FWHT encoder due to incorrect buffer sizing during video output format handling. This issue allows an attacker to cause c…
CVE-2026-89723Medium· 5.5⚖ disputedkernel: nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation (CVE-2026-89723)
A flaw was found in the nilfs2 file system component of the Linux kernel. When a file is truncated, an intermediate node block is not properly deleted and remains in the B-tree node cache. This can lead to the log writer incorrectly proces…
CVE-2026-89720Medium· 5.5⚖ disputedkernel: ubifs: fix out-of-bounds read in signature length check (CVE-2026-89720)
A flaw was found in the Linux kernel's Unsorted Block Image File System (UBIFS). An incorrect bounds check in the ubifs_sb_verify_signature() function allows a crafted signed UBIFS image to declare a signature length larger than its actual…
CVE-2026-89712High· 7.0⚖ disputedkernel: NFSD: restart ssc_expire_umount walk after dropping nfsd_ssc_lock (CVE-2026-89712)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD) component. A race condition exists where, during the processing of unmounted source-server mounts, a thread may temporarily release a lock. During this window, anothe…
CVE-2026-89710High· 7.0kernel: NFSv4.1: fix layout segment leak on the pnfs_layout_process() forget path (CVE-2026-89710)
A flaw was found in the Linux kernel's NFSv4.1 implementation. When a server returns a new layout state identifier while an existing one is still active, the pnfs_layout_process() function fails to properly release memory associated with l…
CVE-2026-89707High· 7.0kernel: nfsd: release path refs on follow_down() error (CVE-2026-89707)
A flaw was found in the Linux kernel's nfsd component. An authenticated Network File System (NFS) client can exploit this vulnerability by triggering a failed cross-mount operation through `nfsd_lookup_dentry` or the NFSv4 READDIR encode p…
CVE-2026-89706High· 7.0kernel: nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
A flaw was found in the Linux kernel's nfsd component. When an asynchronous (async) copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made d…
CVE-2026-89704High· 7.0kernel: nfsd: sample writeback error cursor before async COPY loop (CVE-2026-89704)
A flaw was found in the Linux kernel's nfsd component. The _nfsd_copy_file_range() function incorrectly samples the writeback error cursor after the copy loop. This allows a concurrent write operation to advance the error cursor prematurel…
CVE-2026-89699Medium· 5.5⚖ disputedkernel: nfsd: validate symlink target length in NFSv4 CREATE (CVE-2026-89699)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) when handling NFSv4 CREATE operations. A remote attacker can exploit this by sending a crafted request with an oversized symbolic link (symlink) target length. This u…
CVE-2026-89697High· 7.0⚖ disputedkernel: nfsd: add fh_want_write() for early-verified SETATTR in nfsd_proc_setattr() (CVE-2026-89697)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). When setting file attributes using `nfsd_proc_setattr()`, a specific code path (`BOTH_TIME_SET` branch) prematurely verifies file handles. This bypasses a critical w…
CVE-2026-89696Medium· 5.5⚖ disputedkernel: nfsd: block non-SAVEFH ops after FOREIGN PUTFH to prevent NULL deref (CVE-2026-89696)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd). A remote client can exploit this by sending a specially crafted NFS COMPOUND request. This request, when processed, can lead to a NULL pointer dereference in t…
CVE-2026-89694High· 7.0kernel: nfsd: check client ownership when cancelling a copy-notify stateid (CVE-2026-89694)
A flaw was found in the Linux kernel's NFSv4.2 server (nfsd). An authenticated NFSv4.2 client could exploit a vulnerability in the `manage_cpntf_state()` function by guessing a state identifier. This improper ownership check allows the cli…
CVE-2026-89765Medium· 5.5kernel: timers/itimer: Zero-init old itimerval before copy to userspace (CVE-2026-89765)
A flaw was found in the Linux kernel's `timers/itimer` component. On native sparc64 systems, the `struct __kernel_old_timeval` contains uninitialized padding bytes. When `put_itimerval()` copies this structure to userspace, these padding b…
CVE-2026-89756Medium· 5.5kernel: mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch() (CVE-2026-89756)
A flaw was found in the Linux kernel. When performing memory migration on KVM (Kernel-based Virtual Machine) hosts, the `migrate_pages_batch()` function fails to report RCU (Read-Copy Update) tasks quiescent states during large batch unmap…
CVE-2026-89753Medium· 5.5kernel: mm/vmscan: report RCU-tasks quiescent states in shrink_lruvec() (CVE-2026-89753)
A flaw was found in the Linux kernel's memory management subsystem. The `shrink_lruvec()` function, responsible for memory reclaim, fails to properly report Read-Copy-Update (RCU) task quiescent states on systems with preemption enabled. T…
CVE-2026-89752Medium· 5.5kernel: mm: memcg: stop reclaim when a limit update is superseded (CVE-2026-89752)
A flaw was found in the Linux kernel's memory cgroup (memcg) component. When multiple file operations concurrently update `memory.high` or `memory.max` files in `kernfs`, a writer can continue reclaiming memory towards an outdated target. …
CVE-2026-89751Medium· 5.5kernel: x86/tdx: Fix off-by-one in port I/O handling (CVE-2026-89751)
A flaw was found in the Linux kernel's x86/tdx component. An off-by-one error in the `handle_in()` and `handle_out()` functions, specifically in the `GENMASK` calculation for port I/O operations, causes the mask to be one bit too wide. Thi…
CVE-2026-89750Medium· 5.5⚖ disputedkernel: tracing/user_events: Clear copied tracing state before fork duplication (CVE-2026-89750)
A flaw was found in the Linux kernel's tracing/user_events component. This vulnerability arises when a child process, created via `fork`, exits and frees memory that the parent process still references. This creates a Use-After-Free (UAF) …
CVE-2026-89749Medium· 5.5kernel: tracing: Fix crash passing ERR_PTR to kthread_stop() (CVE-2026-89749)
A flaw was found in the Linux kernel. Specifically, within the tracing subsystem, the `event_test_stuff()` function can pass an invalid error pointer to `kthread_stop()` if `kthread_run()` fails to create a kernel thread. This improper han…
CVE-2026-89518Medium· 5.5kernel: sched_ext: Fix this_rq() assumptions in dispatch kfuncs (CVE-2026-89518)
A flaw was found in the Linux kernel's `sched_ext` component. Under core scheduling, incorrect assumptions in dispatch kfuncs regarding `this_rq()` can lead to a deadlock. This occurs when an `rq` lock is acquired on a CPU different from t…
CVE-2026-89517Medium· 5.5kernel: sched_ext: Fix rq->core_pick corruption under core scheduling (CVE-2026-89517)
A flaw was found in the Linux kernel's `sched_ext` component, which handles core scheduling. When multiple selections on the same core interleave due to a dropped lock, they can corrupt the scheduling state. This corruption can lead to a N…
CVE-2026-89516Medium· 5.5kernel: sched_ext: Don't BUG_ON a destroyed DSQ in process_deferred_reenq_users (CVE-2026-89516)
A flaw was found in the Linux kernel's `sched_ext` component. When a Deferred Scheduling Queue (DSQ) is destroyed, a pending deferred re-enqueue (DRU) operation might still attempt to access the destroyed DSQ. This can lead to a `BUG_ON` c…
CVE-2026-89514Medium· 5.5kernel: scsi: fnic: Use GFP_ATOMIC for VLAN alloc under spinlock (CVE-2026-89514)
A flaw was found in the Linux kernel's Fibre Channel over Ethernet Network Interface Card (fnic) driver. The `fnic_fcoe_process_vlan_resp()` function attempts to allocate memory in a way that can cause the system to sleep while holding a s…
CVE-2026-89509Medium· 5.5kernel: RDMA/ionic: Embed counter driver data in rdma_counter allocation (CVE-2026-89509)
A flaw was found in the Linux kernel's RDMA/ionic driver. This vulnerability arises from the driver's incorrect handling of `rdma_counter` allocations, specifically by not embedding counter driver data as required. This oversight can lead …
CVE-2026-89505Medium· 5.5kernel: RDMA/uverbs: Guard legacy bundles without method_elm (CVE-2026-89505)
A flaw was found in the Linux kernel's RDMA/uverbs component. Malformed input from a provider in the legacy write path can cause the `uverbs_get_handler_fn()` function to dereference an uninitialized pointer. This can lead to a system cras…