Red Hat has 1,286 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1044 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 639. The median CVSS is 7.0 (high), with 57 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1044 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1286 CVEsRSS
CVE-2026-89502Medium· 5.5kernel: ring-buffer: Free cpu_buffer::free_page with subbuf_order (CVE-2026-89502)
A flaw was found in the Linux kernel's ring-buffer component. When sub-buffers are configured with a specific memory allocation order greater than zero, the system attempts to free a memory page using an incorrect size. This memory managem…
CVE-2026-89661Medium· 5.5kernel: NFSD: Prevent post-shutdown use-after-free in unlock_filesystem (CVE-2026-89661)
A flaw was found in the Linux kernel's Network File System Daemon (NFSD). A local administrator with CAP_SYS_ADMIN capabilities can trigger a use-after-free vulnerability by writing to /proc/fs/nfsd/unlock_filesystem after the NFSD server …
CVE-2026-89592Medium· 5.5kernel: accel/rocket: fix NULL dereference and integer overflow in rocket_job_push() (CVE-2026-89592)
A flaw was found in the `accel/rocket` component of the Linux kernel. This vulnerability arises from two issues: a missing null check after a memory allocation failure and an integer overflow when calculating memory requirements based on u…
CVE-2026-89591Medium· 5.5kernel: accel/rocket: initialize job domain before cleanup paths (CVE-2026-89591)
A flaw was found in the Linux kernel's `accel/rocket` module. During error handling in the `rocket_ioctl_submit_job()` function, a cleanup routine may attempt to free a `job->domain` pointer that has not yet been initialized, leading to a …
CVE-2026-89590Medium· 5.5kernel: accel/rocket: Fix error path handling in rocket_job_run() (CVE-2026-89590)
A flaw was found in the `accel/rocket` driver within the Linux kernel. Incorrect error handling in the `rocket_job_run()` function can lead to resource leaks. This occurs when the system fails to properly release references to Direct Memor…
CVE-2026-89578Medium· 5.5kernel: dm-io: clone the source bio instead of copying its biovec (CVE-2026-89578)
A flaw was found in the Linux kernel's device mapper I/O (dm-io) component. When handling DM_IO_BIO requests, incorrect sector-based accounting for misaligned direct I/O buffers could lead to an infinite loop. This issue can cause I/O oper…
CVE-2026-89568Medium· 5.5kernel: kho: fix size calculation in kho_preserved_memory_reserve() (CVE-2026-89568)
A flaw was found in the Linux kernel. The `kho_preserved_memory_reserve()` function, responsible for reserving memory, incorrectly calculates the size of these reservations. This issue arises because it uses a 32-bit integer for bit shifti…
CVE-2026-89567Medium· 5.5kernel: jbd2: bound shrinker scans by examined checkpoint buffers (CVE-2026-89567)
A flaw was found in the Linux kernel's jbd2 shrinker. This component, which manages journal buffers, does not correctly account for busy checkpoint buffers. This oversight can cause the shrinker to hold a critical system lock for an extend…
CVE-2026-89552Medium· 4.1kernel: Linux kernel: Denial of Service via NULL pointer dereference in parameter handling (CVE-2026-89552)
A flaw was found in the Linux kernel. When updating charp parameters, an allocation failure can cause the parameter to be set to NULL before the new value is successfully allocated. This can lead to a kernel NULL pointer dereference, which…
CVE-2026-89539Medium· 5.9kernel: Linux kernel: SUNRPC memory leak due to duplicate CREDS_VALUE options (CVE-2026-89539)
A flaw was found in the SUNRPC subsystem of the Linux kernel. The `gssx_dec_option_array()` function, responsible for decoding options, does not correctly handle replies containing duplicate `CREDS_VALUE` entries. This oversight causes the…
CVE-2026-89531High· 7.0kernel: svcrdma: Reject connection when transport allocation fails (CVE-2026-89531)
A flaw was found in the Linux kernel's svcrdma module. A remote attacker can exploit this vulnerability by repeatedly attempting connections when the system is under memory pressure. This can lead to a resource leak of `rdma_cm_id` objects…
CVE-2026-89529High· 7.0kernel: svcrdma: Reject oversized Read segments at decode time (CVE-2026-89529)
A flaw was found in the Linux kernel's svcrdma component, which handles Remote Procedure Call over Remote Direct Memory Access (RPC/RDMA) Read operations. This vulnerability occurs because the Read list decoder does not properly validate t…
CVE-2026-89527Medium· 5.5kernel: svcrdma: Use svc_xprt_put to free listener on create failure (CVE-2026-89527)
A flaw was found in the Linux kernel's svcrdma module. This vulnerability occurs when a listener creation fails, leading to an improper release of a network namespace reference. This resource leak can be exploited by a local attacker, pote…
CVE-2026-89519Medium· 5.5kernel: sched_ext: Replace SCX_RQ_BAL_KEEP with a dispatch verdict return (CVE-2026-89519)
A flaw was found in the Linux kernel's `sched_ext` component. Due to a logical error where a stale flag (`SCX_RQ_BAL_KEEP`) could be consumed, the scheduler might incorrectly keep a task running even after it has been dequeued. This could …
CVE-2026-89739High· 7.0kernel: usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition (CVE-2026-89739)
A flaw was found in the Linux kernel's USB dwc3 gadget driver. A race condition exists where a delayed operation might try to access memory that has already been freed. This can lead to a use-after-free vulnerability, which a local attacke…
CVE-2026-89737High· 7.0kernel: usb: typec: thunderbolt: Disable work before freeing tbt on remove (CVE-2026-89737)
A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The `tbt_altmode_remove()` function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-…
CVE-2026-89734Medium· 5.5kernel: usb: gadget: uvc: Fix null pointer dereference in uvcg_video_init() (CVE-2026-89734)
A flaw was found in the Linux kernel's USB Video Class (UVC) gadget driver. This vulnerability occurs in the `uvcg_video_init()` function when the `kthread_run_worker()` function fails. In such a scenario, an error logging mechanism attemp…
CVE-2026-89728Medium· 5.5kernel: i3c: renesas: Fix out-of-bounds access for newdevs mask (CVE-2026-89728)
A flaw was found in the Linux kernel's I3C Renesas driver. When the I3C bus is empty and software initiates Dynamic Address Assignment (DAA), an out-of-bounds access can occur. This is due to an incorrect calculation of the newly discovere…
CVE-2026-89727High· 7.0kernel: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID (CVE-2026-89727)
A flaw was found in the Kernel-based Virtual Machine (KVM) for ARM64 (arm64) architecture. A malicious guest operating system can provide an interrupt ID (INTID) that is outside the expected range to the GICv2 (Generic Interrupt Controller…
CVE-2026-89721Medium· 5.5kernel: phy: rockchip-samsung-dcphy: fix out-of-range max_register (CVE-2026-89721)
A flaw was found in the Linux kernel's `phy: rockchip-samsung-dcphy` component. A local attacker with access to the `regmap debugfs` interface could trigger an out-of-bounds read by attempting to dump registers. This occurs because the `ma…
CVE-2026-89716Medium· 5.5kernel: zram: validate deflate params (CVE-2026-89716)
A flaw was found in the zram component of the Linux kernel. This vulnerability occurs because the system does not properly validate user-supplied deflate parameters, specifically `winbits` values. An attacker could exploit this by providin…
CVE-2026-89714Medium· 5.5kernel: NFS: fix delegation_hash_table leak when nfs4_server_common_setup() fails (CVE-2026-89714)
A flaw was found in the Linux kernel's Network File System (NFS) component. When an NFSv4 mount attempt fails, the nfs4_server_common_setup() function does not properly free a memory allocation for the delegation hash table. A client that …
CVE-2026-89701Medium· 5.5kernel: nfsd: validate nseconds in TIME_DELEG decode paths (CVE-2026-89701)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd). The TIME_DELEG_ACCESS and TIME_DELEG_MODIFY decode paths do not properly validate the nanosecond (nseconds) value in timestamps. This allows a remote attacker to pro…
CVE-2026-89683High· 7.0kernel: nfsd: fix dentry ref leak on V4ROOT export filehandle lookup (CVE-2026-89683)
A flaw was found in the Linux kernel's nfsd (NFS daemon). A remote attacker could exploit this vulnerability by sending a specially crafted NFSv3 filehandle targeting a V4ROOT export's file system identifier (fsid). This action triggers a …
CVE-2026-89666High· 7.0kernel: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops (CVE-2026-89666)
A flaw was found in the kernel. A remote attacker, acting as an NFSv3 client, can send malformed time values during SETATTR or create operations. This can lead to the corruption of on-disk metadata, resulting in incorrect timestamps for fi…
CVE-2026-89645Medium· 5.5kernel: btrfs: drop recovered reloc root refs on recovery failure (CVE-2026-89645)
A flaw was found in the btrfs file system in the Linux kernel. During relocation recovery, if an error occurs, such as a memory allocation failure, the system may not properly drop references to relocation roots. This oversight can lead to…
CVE-2026-89629Medium· 5.5kernel: HID: corsair-void: Check size of status and firmware events before reading them (CVE-2026-89629)
A flaw was found in the Linux kernel, specifically within the `corsair-void` driver for Human Interface Devices (HID). This vulnerability allows an attacker to cause an out-of-bounds read by sending malformed status and firmware events. Th…
CVE-2026-89772High· 7.0kernel: btrfs: write-protect folios during data writeback (CVE-2026-89772)
A flaw was found in the Btrfs filesystem of the Linux kernel. This vulnerability allows a local attacker with write access to a memory-mapped file to modify data while it is being written to disk. This can lead to data corruption, where th…
CVE-2026-89770Medium· 5.5kernel: iomap: don't free integrity payload that doesn't exist (CVE-2026-89770)
A flaw was found in the `iomap` component of the Linux kernel. This vulnerability occurs when Protection Information (PI) verification is disabled on a block device, causing `fs_bio_integrity_alloc` to not allocate a bio integrity payload.…
CVE-2026-89768Medium· 5.5kernel: fs: fix user path of nested backing files (CVE-2026-89768)
A flaw was found in the Linux kernel's filesystem (fs) component. When using nested overlay filesystems (overlayfs), a local user could exploit an issue where the backing_file_open() function incorrectly derives the path for mapped files. …