Red Hat has 1,284 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1042 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 637. The median CVSS is 7.0 (high), with 58 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1042 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1284 CVEsRSS
CVE-2026-80959Medium· 5.5⚖ disputedkernel: dm-pcache: bound the persisted tail-position offset (CVE-2026-80959)
A flaw was found in the Linux kernel's device-mapper persistent cache (dm-pcache) component. A local attacker with administrative privileges (CAP_SYS_ADMIN) could provide a specially crafted cache device, leading to an out-of-bounds read. …
CVE-2026-80958Medium· 5.5⚖ disputedkernel: dm-pcache: clamp the tail kset read to the segment data region (CVE-2026-80958)
A flaw was found in the dm-pcache component of the Linux kernel. The tail-kset read operations, used by cache_replay(), the writeback worker, and the garbage collection (GC) worker, incorrectly calculate the length of the data region. This…
CVE-2026-80955Medium· 5.5⚖ disputedkernel: dm-pcache: fix use-after-free and invalid seg operations in kset_replay() (CVE-2026-80955)
A flaw was found in the Linux kernel's dm-pcache component. This vulnerability, a use-after-free, occurs within the `kset_replay` function when a stale key's segment generation is accessed after it has been freed. This could allow a local …
CVE-2026-80954Medium· 5.5⚖ disputedkernel: i3c: Fix unlocked dereference of dev->desc in i3c_device_get_supported_xfer_mode() (CVE-2026-80954)
A flaw was found in the Linux kernel's i3c driver. The `i3c_device_get_supported_xfer_mode()` function attempts to access a device descriptor without holding the necessary lock. This unlocked dereference can lead to memory corruption, pote…
CVE-2026-80953Medium· 5.5⚖ disputedkernel: i3c: master: adi: initialize the lock before enabling interrupts (CVE-2026-80953)
A flaw was found in the Linux kernel's i3c master driver. A race condition exists where the `adi_i3c_master_probe()` function requests an interrupt and unmasks a register before a critical lock (`xferqueue.lock`) is properly initialized. T…
CVE-2026-80950Medium· 5.5⚖ disputedkernel: i3c: renesas: Check that the transfer is valid before accessing it (CVE-2026-80950)
A flaw was found in the Linux kernel's Renesas I3C driver. This driver uses an asynchronous model for data transfers. When a transfer times out, the associated memory is freed. However, if an interrupt occurs after the memory is freed but …
CVE-2026-80947High· 7.0⚖ disputedkernel: wifi: rtl8xxxu: fix use-after-free from rx_urb_wq on stop (CVE-2026-80947)
A flaw was found in the Linux kernel's `rtl8xxxu` Wi-Fi driver. A race condition exists during the driver's stop process, specifically when handling receive (RX) Universal Serial Bus (USB) Request Blocks (URBs). This allows a worker to acc…
CVE-2026-80943Medium· 5.5⚖ disputedkernel: wifi: rtlwifi: rtl8192du: check QoS TID before indexing tids (CVE-2026-80943)
A flaw was found in the Linux kernel's rtlwifi driver. This vulnerability occurs when the `rtl92du_tx_fill_desc()` function uses a Quality of Service (QoS) Traffic Identifier (TID) value greater than 8 as an index into an array that only h…
CVE-2026-80937Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy (CVE-2026-80937)
A flaw was found in the Linux kernel's Wi-Fi driver for mt7915 chipsets. This vulnerability allows a malicious or malfunctioning Wi-Fi device to provide an invalid memory address. This can cause the driver to write data beyond its allocate…
CVE-2026-80936Medium· 5.5⚖ disputedkernel: wifi: mt76: mt7925: cancel mlo_pm_work on stop (CVE-2026-80936)
A flaw was found in the Linux kernel's mt7925 Wi-Fi driver. During multi-link power-save setup, the `mlo_pm_work` is queued with a delay but not properly cancelled when the device is stopped. This can lead to the work item attempting to ac…
CVE-2026-80929High· 7.0kernel: sysctl: move the "cad_pid" entry from pid_table[] to kern_reboot_table[] (CVE-2026-80929)
A flaw was found in the Linux kernel. A non-root user can exploit a vulnerability in the `sysctl` mechanism, specifically related to the `cad_pid` entry. By unsharing process ID (PID) and user namespaces, a local attacker can modify this g…
CVE-2026-89534High· 7.0kernel: svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails (CVE-2026-89534)
A flaw was found in the Linux kernel's `svcrdma` module. This vulnerability occurs when the system attempts to handle an RDMA (Remote Direct Memory Access) address change, and a critical memory allocation fails. This can lead to a 'use-aft…
CVE-2026-89528High· 7.0kernel: svcrdma: Reject Read lists that exceed the page budget (CVE-2026-89528)
A flaw was found in the Linux kernel's svcrdma component. A remote attacker could send specially crafted Read lists that exceed the page budget. This can lead to a NULL pointer dereference during Direct Memory Access (DMA) mapping, potenti…
CVE-2026-89526High· 7.0kernel: svcrdma: Validate Read chunk positions before reconstruction (CVE-2026-89526)
A flaw was found in the `svcrdma` component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted `RPC/RDMA Read chunk position` field that is not properly validated against the received inline body l…
CVE-2026-89523High· 7.0⚖ disputedkernel: wifi: mt76: mt7925: cancel pending mlo_pm_work (CVE-2026-89523)
A flaw was found in the Linux kernel's MediaTek mt7925 Wi-Fi driver. When the device is reset, suspended, or unregistered, a pending work item (`mlo_pm_work`) can continue to execute. This can lead to the work item accessing memory that ha…
CVE-2026-89522Medium· 5.5⚖ disputedkernel: media: staging/ipu7: fix async notifier UAF on probe error path (CVE-2026-89522)
A flaw was found in the Linux kernel's media subsystem, specifically within the ipu7 driver. When an error occurs during the device's initial setup (probe error path), a V4L2 asynchronous notifier is not correctly removed from a global lis…
CVE-2026-89521Medium· 5.5kernel: sched/core: Handle pick_task() releasing the rq lock (CVE-2026-89521)
A flaw was found in the Linux kernel's core scheduling component. This issue occurs when the `pick_task()` function releases the run queue (rq) lock, allowing an interleaving selection to invalidate the scheduler's internal state. This inc…
CVE-2026-89520Medium· 5.5⚖ disputedkernel: sched/core: Make core-sched flips wait for in-flight selections (CVE-2026-89520)
A flaw was found in the Linux kernel's core scheduling component. A race condition can occur when core scheduling flips complete during task selection, leading to incorrect lock handling. This can result in a resource leak and system insta…
CVE-2026-89513Medium· 5.5kernel: RISC-V: KVM: Fix PMU event info array size overflow (CVE-2026-89513)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) component for RISC-V architectures. A malicious guest operating system could exploit an integer overflow vulnerability by providing a crafted number of Performance M…
CVE-2026-89507Medium· 5.5⚖ disputedkernel: RDMA/ucma: Lock the handler in ucma_write_cm_event() (CVE-2026-89507)
A flaw was found in the Linux kernel's RDMA/ucma component. A race condition exists in the `ucma_write_cm_event()` function where it re-reads a critical file pointer multiple times without proper locking. This allows another function, `ucm…
CVE-2026-89503Medium· 5.5⚖ disputedkernel: ring-buffer: Fix subbuf resize race with ring_buffer_alloc_read_page() (CVE-2026-89503)
A flaw was found in the Linux kernel's ring-buffer component. A race condition exists in the `ring_buffer_alloc_read_page()` function when it interacts with `ring_buffer_subbuf_order_set`. This can lead to an incorrect memory allocation wh…
CVE-2026-89501High· 7.0kernel: ring-buffer: Hold cpu_buffer::lock when resizing a subbuf (CVE-2026-89501)
A flaw was found in the Linux kernel's ring-buffer component. A race condition occurs when resizing a sub-buffer without properly holding the `cpu_buffer::lock`. This oversight can lead to concurrency issues with memory allocation and deal…
CVE-2026-89500High· 7.0⚖ disputedkernel: ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page (CVE-2026-89500)
A flaw was found in the Linux kernel's ring-buffer component. When a cached reader page is discarded after a concurrent ring buffer resize, the system may use an incorrect buffer size for memory deallocation. This mismatch can lead to a ke…
CVE-2026-89499Medium· 5.5⚖ disputedkernel: ring-buffer: Stop remote reader update when page swap fails (CVE-2026-89499)
A flaw was found in the Linux kernel's ring-buffer component. When a remote reader update fails during a page swap, the system incorrectly proceeds as if the swap succeeded. This can lead to log flooding, potentially causing a denial of se…
CVE-2026-89486Medium· 5.5⚖ disputedkernel: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() (CVE-2026-89486)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. Due to incorrect synchronization during the deallocation of command receiver objects, a use-after-free vulnerability can occur. This allows …
CVE-2026-89472Medium· 5.5⚖ disputedkernel: power: supply: charger-manager: register regulators before exposing sysfs (CVE-2026-89472)
A flaw was found in the Linux kernel's power supply charger-manager component. A race condition exists where the system frees charger regulators before their corresponding sysfs entries are unregistered. A local attacker can exploit this b…
CVE-2026-89459Medium· 5.5⚖ disputedkernel: s390/percpu: Fix MVIY_PERCPU() with older binutils (CVE-2026-89459)
A flaw was found in the Linux kernel's s390/percpu component. This vulnerability arises when the kernel is compiled with older versions of GNU as (prior to binutils 2.39). A parsing error prevents a crucial instruction from being correctly…
CVE-2026-89452Medium· 5.5⚖ disputedkernel: iommu/msm: Unwind probe state on registration failure (CVE-2026-89452)
A flaw was found in the `iommu/msm` component of the Linux kernel. This vulnerability occurs when `msm_iommu_probe()` fails to properly unwind its probe state during registration, leaving a dangling list entry. A local attacker could poten…
CVE-2026-89450High· 7.0kernel: iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field (CVE-2026-89450)
A flaw was found in the Linux kernel's iommu/tegra241-cmdqv module. A Virtual Machine Manager (VMM) can exploit this vulnerability by providing a virtual Stream ID (vSID) that exceeds the intended 20-bit width of the SID_MATCH field. This …
CVE-2026-89445High· 7.0kernel: iommufd: Fix UAF in selftest IOPF reporting (CVE-2026-89445)
A flaw was found in the Linux kernel's iommufd selftest component. This Use-After-Free (UAF) vulnerability occurs when the TRIGGER_IOPF function borrows an attach handle without proper synchronization during a PASID detach operation. A con…