Red Hat has 1,284 CVEs on record between 2020 and 2026. Disclosure cadence is accelerating: 1042 in the last 90 days against 120 in the 90 before. The busiest recent month was September 2026 with 637. The median CVSS is 7.0 (high), with 58 rated critical. 0% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-125 (97) and CWE-825 (89). Most affected products: Red Hat Enterprise Linux 9 (212), Red Hat OpenShift Container Platform 4 (95), Red Hat Enterprise Linux 10 (62).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.0
- Publish → KEV
- —(1)
- Last 90 days
- 1042 prev 120
Weakness classes
Products
- Red Hat Enterprise Linux 9 212
- Red Hat OpenShift Container Platform 4 95
- Red Hat Enterprise Linux 10 62
- Linux 57
- Red Hat OpenShift AI (RHOAI) 45
- Red Hat Enterprise Linux BaseOS (v. 10) 36
Worst active — by depth score
CVE-2026-64849High· 8.5mlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS …74CVE-2025-68664Critical· 9.3langchain-core: LangChain: Arbitrary code execution via serialization injection (CVE-2025-68664)72CVE-2026-40453Critical· 9.9The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'67CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA66CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …66
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
1284 CVEsRSS
CVE-2026-89441Medium· 5.5⚖ disputedkernel: mmc: via-sdmmc: cancel card-detect work on remove (CVE-2026-89441)
A flaw was found in the Linux kernel, specifically within the `mmc: via-sdmmc` driver responsible for managing SD and MultiMediaCard (MMC) devices. This vulnerability occurs during device removal, where a timing issue allows a process to a…
CVE-2026-89436Medium· 5.5⚖ disputedkernel: platform/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[] (CVE-2026-89436)
A flaw was found in the Linux kernel's `panasonic-laptop` driver. This vulnerability involves an out-of-bounds write when processing ACPI SINF packages, where a small amount of data is written beyond the intended memory buffer. This can le…
CVE-2026-81016Medium· 5.5⚖ disputedkernel: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address (CVE-2026-81016)
A flaw was found in the Linux kernel. Specifically, within the AMD Platform Management Controller (PMC) component, the `amd_stb_s2d_init()` function does not properly validate memory addresses returned by System Management Unit (SMU) comma…
CVE-2026-81015High· 7.0⚖ disputedkernel: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails (CVE-2026-81015)
A flaw was found in the Linux kernel's AMD PMC (Power Management Controller) driver. When the `amd_stb_s2d_init()` function fails during the driver's initialization process, it can lead to unreleased resources, specifically the LPS0 s2idle…
CVE-2026-81006Medium· 5.5⚖ disputedkernel: ipmi: Remove all sysfs files on registration failure (CVE-2026-81006)
A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) component. During the registration of an IPMI system management interface, an error in the cleanup process can leave a system file (sysfs attribute) re…
CVE-2026-89635Medium· 5.5⚖ disputedkernel: ksmbd: only rebind the reopened file's own oplock on durable reconnect (CVE-2026-89635)
A flaw was found in ksmbd, a component of the Linux kernel. An authenticated attacker could exploit a use-after-free vulnerability by manipulating durable handles and oplocks during session reconnection. When two sessions hold durable hand…
CVE-2026-89633High· 7.0⚖ disputedkernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (CVE-2026-89633)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. The `coalesce_t2()` function processes server-supplied `DataOffset` fields without proper validation against buffer boundaries. A remote attacker could exploit this …
CVE-2026-89631High· 8.1⚖ disputedkernel: smb: client: reject a tree connect response whose byte count is too small (CVE-2026-89631)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an intege…
CVE-2026-89630High· 7.0⚖ disputedkernel: smb: client: restore the data_offset bound in is_valid_oplock_break() (CVE-2026-89630)
A flaw was found in the Linux kernel's Server Message Block (SMB) client. An incorrect calculation of the `data_offset` bound in the `is_valid_oplock_break()` function can lead to a read overflow. This vulnerability allows a malicious SMB …
CVE-2026-89620High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: validate report size before copy (CVE-2026-89620)
A flaw was found in the Linux kernel's HID Intel QuickSPI driver. A local attacker can exploit a heap buffer overflow by providing a specially crafted report through a `hidraw SET_REPORT/SET_FEATURE ioctl`. This allows the attacker to over…
CVE-2026-89619High· 7.0kernel: HID: intel-thc-hid: intel-quickspi: bound GET_REPORT response to the caller buffer (CVE-2026-89619)
A flaw was found in the Linux kernel, specifically within the `intel-quickspi` driver. This vulnerability allows a malicious Human Interface Device (HID) to send an oversized report, which is then copied into a buffer without proper size v…
CVE-2026-89614Medium· 5.5⚖ disputedkernel: ntfs: bound the free-cluster bitmap scan to the volume (CVE-2026-89614)
A flaw was found in the Linux kernel's NTFS file system driver. This vulnerability occurs because the free-cluster bitmap scan is not properly bounded to the volume size. A specially crafted NTFS image, where the bitmap covers more cluster…
CVE-2026-89613Medium· 5.5⚖ disputedkernel: ntfs: reject invalid empty mapping pairs (CVE-2026-89613)
A flaw was found in the Linux kernel's NTFS filesystem driver. This vulnerability occurs when the driver processes an attribute with empty mapping pairs that have inconsistent highest Virtual Cluster Number (VCN) and size. A local attacker…
CVE-2026-89612Medium· 5.5⚖ disputedkernel: ntfs: reject invalid MFT LCNs from boot sector (CVE-2026-89612)
A flaw was found in the Linux kernel's NTFS filesystem driver. A local attacker could provide a specially crafted NTFS boot sector containing an invalid Master File Table (MFT) Logical Cluster Number (LCN). Due to an integer overflow durin…
CVE-2026-89611Medium· 5.5⚖ disputedkernel: ntfs: validate non-resident attribute offsets (CVE-2026-89611)
A flaw was found in the Linux kernel. The NTFS file system driver does not properly validate non-resident attribute offsets when converting between sparse and non-sparse attributes. A local attacker could craft a malicious Master File Tabl…
CVE-2026-89610Medium· 5.5⚖ disputedkernel: ntfs: verify run length exceeding volume boundary (CVE-2026-89610)
A flaw was found in the Linux kernel's NTFS component. The mapping pairs decoder fails to verify if a run length extends beyond the volume boundary. A local attacker could exploit this by providing a malformed NTFS image with a crafted map…
CVE-2026-89601Medium· 5.5⚖ disputedkernel: ext2: Fix lost inode updates for IS_SYNC inodes (CVE-2026-89601)
A flaw was found in the Linux kernel's ext2 filesystem. This vulnerability occurs in the `ext2_setsize()` and `ext2_xattr_set2()` functions, where inode updates for `IS_SYNC` inodes may be lost. This happens because the `sync_inode_metadat…
CVE-2026-89600Medium· 5.5⚖ disputedkernel: fanotify: fix use-after-free of file range info (CVE-2026-89600)
A flaw was found in the Linux kernel's fanotify subsystem. This use-after-free vulnerability occurs when the system attempts to report file range information after the memory holding that information has been released. A local attacker cou…
CVE-2026-89588Medium· 5.5⚖ disputedkernel: ACPI: APEI: GHES: fix ARM section length accounting after header (CVE-2026-89588)
A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) APEI Generic Hardware Error Source (GHES) component. Incorrect length accounting in the `ghes_handle_arm_hw_error()` function can lead to the parser r…
CVE-2026-89584High· 7.0⚖ disputedkernel: block: validate user space vectors during extraction (CVE-2026-89584)
A flaw was found in the Linux kernel's block layer. This vulnerability arises from insufficient validation of user-space data structures (vectors) against the device's Direct Memory Access (DMA) alignment requirements. A local attacker cou…
CVE-2026-89581High· 7.0⚖ disputedkernel: bpf, x86: Fix per-CPU address resolution into an extended register (CVE-2026-89581)
A flaw was found in the Linux kernel's handling of Berkeley Packet Filter (BPF) programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker co…
CVE-2026-89580High· 7.0kernel: bpf: Disable preemption in __bpf_get_stack (CVE-2026-89580)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. A local attacker could exploit a timing issue in the `__bpf_get_stack` function. This occurs when a preemptible BPF program is scheduled out, allowing another t…
CVE-2026-89574Medium· 5.5⚖ disputedkernel: dm array: validate array block headers on read (CVE-2026-89574)
A flaw was found in the Linux kernel's device mapper (dm) array component. Insufficient validation of array block headers during read operations allows a local attacker to craft a malicious on-disk `nr_entries` value. This can lead to an o…
CVE-2026-89571Medium· 5.5⚖ disputedkernel: cxl/features: bound fwctl command payload to the input buffer (CVE-2026-89571)
A flaw was found in the Linux kernel's CXL (Compute Express Link) features. A local attacker could exploit an out-of-bounds read vulnerability in the `fwctl_cmd_rpc()` and `cxlctl_set_feature()` functions. This occurs when the system attem…
CVE-2026-89570High· 7.0⚖ disputedkernel: cxl/mce: Make the MCE notifier per-region (CVE-2026-89570)
A flaw was found in the Linux kernel's Compute Express Link (CXL) subsystem. Lifetime issues with the CXL Machine Check Exception (MCE) notifier can lead to NULL dereferences and use-after-free vulnerabilities in the MCE handler. This coul…
CVE-2026-89558High· 7.0⚖ disputedkernel: md/raid10: fix still_degraded being inverted in raid10_sync_request() (CVE-2026-89558)
A flaw was found in the Linux kernel's md/raid10 (RAID10) driver. This vulnerability occurs when a RAID10 array is in a degraded state and a device is being recovered while another mirror is still missing. Due to an inverted boolean value,…
CVE-2026-89546Medium· 5.3⚖ disputedkernel: Linux Kernel: Resource management flaw in SUNRPC NFS callback service (CVE-2026-89546)
A flaw was found in the Linux kernel's SUNRPC (Sun Remote Procedure Call) Network File System (NFS) callback service. A race condition during the service teardown can lead to system resources not being properly released, causing a resource…
CVE-2026-89537High· 7.0⚖ disputedkernel: SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2 (CVE-2026-89537)
A flaw was found in the Linux kernel's SUNRPC implementation, specifically within the `gss_krb5_verify_mic_v2` function. A remote malicious Network File System (NFS) server could provide a specially crafted, short Kerberos Message Integrit…
CVE-2026-89530High· 7.0⚖ disputedkernel: svcrdma: Reject inline replies that overflow the pull-up buffer (CVE-2026-89530)
A flaw was found in the Linux kernel's svcrdma component, which handles network communication using Remote Direct Memory Access (RDMA). A remote attacker can send a specially crafted network reply that is larger than expected. This can cau…
CVE-2026-89692Medium· 5.5⚖ disputedkernel: nfsd: clear CALLBACK_RUNNING on failed delegation recall queue (CVE-2026-89692)
A flaw was found in the Linux kernel's Network File System (NFS) daemon, `nfsd`. This vulnerability occurs when a delegation recall operation fails, leaving a critical internal flag uncleared. This prevents subsequent attempts to break the…