Red Hat has 2,677 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1491 in the last 90 days against 554 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1491 prev 554
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2682 CVEsRSS
CVE-2026-98501Medium· 5.1⚖ disputedkernel: HID: alps: fix use-after-free on input2 registration failure (CVE-2026-98501)
A flaw was found in the Linux kernel's Alps Human Interface Device (HID) driver. If registration of an input device fails during configuration, the driver frees the device memory while communication channels are already active, leaving a d…
CVE-2026-98512Medium· 5.5kernel: drm/nouveau: RCU-free the scheduler-containing nouveau_sched (CVE-2026-98512)
A flaw was found in the Linux kernel's Nouveau graphics driver. When destroying a GPU scheduler object, the driver frees memory prematurely while user-space synchronization objects still hold references to it. A local, unprivileged user co…
CVE-2026-98510Medium· 4.7⚖ disputedkernel: drm/xe/vm: nuke PTs only after unlinking contested VMAs (CVE-2026-98510)
A flaw was found in the Linux kernel's Intel Xe graphics driver. When closing a GPU virtual memory space, page tables were destroyed before contested virtual memory areas were properly unlinked from shared buffer objects. A concurrent thre…
CVE-2026-98517Medium· 5.5⚖ disputedkernel: drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM (CVE-2026-98517)
A flaw was found in the Linux kernel's Nouveau graphics driver. When handling buffer objects in system memory, the driver improperly accesses memory past the allocated resource boundary. A local attacker could exploit this flaw to cause a …
CVE-2026-98515Medium· 4.7⚖ disputedkernel: drm/nouveau: fix double-free in nvif_vmm_dtor (CVE-2026-98515)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges. During device initialization failures,…
CVE-2026-98520Medium· 4.7⚖ disputedkernel: drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping (CVE-2026-98520)
A flaw was found in the Linux kernel's AMD GPU driver (amdkfd). In multi-container environments, terminating an initial container session that accessed the GPU interface leaves behind an invalid internal memory reference. When a subsequent…
CVE-2026-98518Medium· 5.5kernel: drm/nouveau/dmem: pin VRAM for the whole registered range (CVE-2026-98518)
A flaw was found in the Linux kernel's Nouveau graphics driver. This vulnerability allows a local user to cause a denial of service (DoS) or system instability through an out-of-bounds memory access in video random-access memory (VRAM). Th…
CVE-2026-98524High· 7.8kernel: rds: ib: Clear the sg list when mapping an MR fails (CVE-2026-98524)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A l…
CVE-2026-98532High· 7.5kernel: ipv6: do not let ipv6_find_hdr() return an offset past the packet end (CVE-2026-98532)
A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service (DoS) or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the decl…
CVE-2026-98542Low· 2.3kernel: cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict (CVE-2026-98542)
A flaw was found in the Linux kernel's cpuset subsystem, which can lead to a denial of service (DoS) or compromised resource isolation. A local user with permissions to configure control groups (cgroups) can trigger this flaw by creating a…
CVE-2026-98545Medium· 6.2kernel: ata: libata-scsi: bound the ATA passthru sense descriptor writes (CVE-2026-98545)
A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A mal…
CVE-2026-98547Medium· 5.5kernel: af_packet: fix integer overflow in prb_calc_retire_blk_tmo() (CVE-2026-98547)
A flaw was found in the Linux kernel's af_packet network socket implementation. An integer overflow occurs during timeout calculations when configuring packet receive rings with large block sizes. A local user with raw network privileges c…
CVE-2026-98546Medium· 4.7kernel: arm64/boot: Disable trapping of PMZR_EL0 writes to EL2 (CVE-2026-98546)
A flaw was found in the Linux kernel's ARM64 architecture support. When user-space access to performance monitoring counters is enabled, write traps for a write-only performance register are improperly configured during hypervisor initiali…
CVE-2026-98543Medium· 4.1⚖ disputedkernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir (CVE-2026-98543)
A flaw was found in the Linux kernel. A local privileged user could cause a Denial of Service (DoS) or file system corruption due to improper locking in the BPF (Berkeley Packet Filter) subsystem. When attaching sleepable BPF programs to c…
CVE-2026-98551Low· 3.3kernel: perf/core: Fill branch entries with a single assignment (CVE-2026-98551)
A flaw was found in the Linux kernel's Performance Events (perf) subsystem on ARM64 architectures. This flaw allows a local user to cause an information disclosure of sensitive kernel memory. The issue occurs because certain branch trackin…
CVE-2026-98548High· 7.5⚖ disputedkernel: sctp: discard the rest of the packet on a stale-cookie error (CVE-2026-98548)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted pa…
CVE-2026-98554Medium· 5.5kernel: vlan: ensure sufficient headroom in vlan_dev_hard_header() (CVE-2026-98554)
A flaw was found in the Linux kernel's virtual local area network (VLAN) driver. When processing network packets that lack sufficient reserved buffer space (headroom) before network headers are appended, the system triggers a panic conditi…
CVE-2026-98552Low· 2.5kernel: perf/core: Fix a refcount leak in attach_perf_ctx_data() (CVE-2026-98552)
A flaw was found in the Linux kernel's Performance Counters for Linux (perf) subsystem. A race condition during the attachment of performance monitoring context data can cause the kernel to fail to update tracking flags, resulting in a ref…
CVE-2026-98550High· 7.5kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (CVE-2026-98550)
A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to …
CVE-2026-98556Medium· 5.5kernel: gve: DQO: reject TSO packets with an out of range MSS (CVE-2026-98556)
A flaw was found in the Linux kernel's Google Virtual NIC (gve) driver. A local user with raw packet access or an adjacent guest system can trigger a Denial of Service (DoS) by sending network packets with an excessively large segment size…
CVE-2026-98555Medium· 4.7⚖ disputedkernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (CVE-2026-98555)
A flaw was found in the Linux kernel's Logical Link Control (LLC) subsystem. When an error occurs during network packet header initialization, the kernel mistakenly frees the incorrect memory buffer, resulting in a use-after-free condition…
CVE-2026-98553Low· 2.3kernel: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (CVE-2026-98553)
A flaw was found in the Linux kernel's automount file system (autofs). A local user can trigger this issue by initiating an autofs mount operation that fails during initialization, causing the kernel to fail to release associated pipe file…
CVE-2026-98559Medium· 4.7kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err() (CVE-2026-98559)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free…
CVE-2026-98557Medium· 5.5kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO (CVE-2026-98557)
A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Gener…
CVE-2026-98565Medium· 4.4kernel: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (CVE-2026-98565)
A flaw was found in the Linux kernel's MediaTek MT7530 network switch driver. This flaw allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel crash. The issue occurs during driver unbinding …
CVE-2026-98558Medium· 4.1kernel: net: flush skb_defer_nodes in dev_cpu_dead() (CVE-2026-98558)
A flaw was found in the Linux kernel's networking subsystem. When a central processing unit (CPU) is taken offline, pending network packet buffers held in deferred processing queues are not properly flushed. A privileged local user or admi…
CVE-2026-98563Medium· 4.1kernel: net: phylink: record the PHY only once bringup cannot fail (CVE-2026-98563)
A flaw was found in the Linux kernel's phylink component. When an error occurs during Ethernet physical layer (PHY) device initialization, the kernel prematurely stores a reference to the device before setup finishes. If the bringup operat…
CVE-2026-98561Medium· 5.9kernel: nfp: hold IPsec RX state under the XArray lock (CVE-2026-98561)
A flaw was found in the Linux kernel's Netronome Flow Processor (nfp) network driver. A race condition occurs when incoming Internet Protocol Security (IPsec) network packets are processed concurrently with the removal of security associat…
CVE-2026-98560Low· 3.3kernel: net/rds: size a connection's path set by the transport it ends up with (CVE-2026-98560)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When handling local connections, the system miscalculates the required communication paths, allocating internal work queues that are not properly freed durin…
CVE-2026-98567Medium· 5.5kernel: net: xps: reject an out of range traffic class (CVE-2026-98567)
A flaw was found in the Linux kernel. A local privileged user could trigger a Denial of Service (DoS) or kernel memory corruption by causing an out-of-bounds memory write. This issue occurs in the Transmit Packet Steering (XPS) networking …