redhat has 2,682 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1491 in the last 90 days against 554 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1491 prev 554
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2682 CVEsRSS
CVE-2026-98564Medium· 4.1kernel: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (CVE-2026-98564)
A flaw was found in the Linux kernel's MediaTek MT7530 DSA (Distributed Switch Architecture) driver. During device removal or driver unbinding, interrupt mappings are prematurely disposed while the parent interrupt is still active. A local…
CVE-2026-98562Medium· 4.7kernel: net: libwx: fix races in Tx timestamp handling (CVE-2026-98562)
A flaw was found in the Linux kernel's Wangxun network driver library (libwx). This vulnerability allows a local user to cause a Denial of Service (DoS) through memory corruption. A race condition in the Precision Time Protocol (PTP) trans…
CVE-2026-98570Medium· 5.9kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() (CVE-2026-98570)
A flaw was found in the Linux kernel's IPv6 networking subsystem. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending network traffic through an affected IPv6 tunnel interface. Due to insufficient buffer alloc…
CVE-2026-98569Medium· 4.4kernel: ip_gre: Reject enabling collect metadata through changelink (CVE-2026-98569)
A flaw was found in the Linux kernel's Generic Routing Encapsulation (GRE) subsystem. A local user with network administration privileges could cause a Denial of Service (DoS) by enabling metadata collection on an existing GRE network devi…
CVE-2026-98566Medium· 5.5kernel: drm/imagination: clamp freelist reconstruction requests (CVE-2026-98566)
A flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests…
CVE-2026-98573High· 7.5kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (CVE-2026-98573)
A flaw was found in the Linux kernel. An integer underflow in the networking subsystem allows an attacker to trigger an out-of-bounds memory copy by sending specially crafted Internet Protocol version 6 (IPv6) packets with extension header…
CVE-2026-98572Medium· 4.4kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS32 (CVE-2026-98572)
A flaw was found in the Linux kernel's extended Berkeley Packet Filter (eBPF) Just-In-Time (JIT) compiler on 32-bit MIPS systems. An instruction generation error during 64-bit jump comparisons causes negative numeric constants to be incorr…
CVE-2026-98571Medium· 5.9kernel: net: stmmac: clear stale buf->page after recycling on skb build failure (CVE-2026-98571)
A flaw was found in the Linux kernel's stmmac network driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing incoming network traffic under resource constraints. When the driver fails to alloc…
CVE-2026-98577Medium· 5.3kernel: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (CVE-2026-98577)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. In the Logical Link Control Protocol (LLCP) implementation, the kernel validates service names using only the length of the provided name instead of verifying…
CVE-2026-98574Medium· 4.1kernel: net: bcmgenet: stop Tx NAPI before disabling the queues (CVE-2026-98574)
A flaw was found in the Linux kernel's Broadcom GENET network driver. Improper synchronization between disabling transmission queues and stopping completion polling during interface shutdown or suspend operations can prematurely re-enable …
CVE-2026-98579Low· 3.3kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (CVE-2026-98579)
A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A …
CVE-2026-98576Medium· 5.3kernel: nfc: llcp: fix slab-out-of-bounds reads when logging service names (CVE-2026-98576)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. When processing certain service names and requests, the kernel attempts to log strings that lack null-termination using an unbounded format specifier. A local…
CVE-2026-98575Medium· 6.2kernel: nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() (CVE-2026-98575)
A flaw was found in the Linux kernel's PN533 NFC (Near Field Communication) driver. An attacker capable of connecting a malicious or malfunctioning USB device can supply a crafted response frame with an arbitrary data length value. Because…
CVE-2026-98580Medium· 5.5kernel: nfc: llcp: Fix race condition in accept_queue lifecycle (CVE-2026-98580)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synch…
CVE-2026-98578Medium· 6.5kernel: nfc: st21nfca: validate ISO15693 inventory length (CVE-2026-98578)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. This vulnerability allows a Denial of Service (DoS) when the system encounters malformed wireless NFC responses. A nearby attacker with a crafted NFC de…
CVE-2026-98584Low· 3.3kernel: net/sched: fix potential stack infoleak in em_text_dump() (CVE-2026-98584)
A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails…
CVE-2026-98582Medium· 6.5kernel: nfc: st21nfca: validate received frame size (CVE-2026-98582)
A flaw was found in the Linux kernel's ST21NFCA Near Field Communication (NFC) driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames …
CVE-2026-98581Medium· 4.7kernel: nfc: llcp: Fix list corruption / refcount desync in nfc_llcp_recv_dm() (CVE-2026-98581)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Logical Link Control Protocol (LLCP) implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating t…
CVE-2026-98588Medium· 4.1kernel: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc (CVE-2026-98588)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. When allocating a socket map with an excessively large entry count, a signed integer overflow occurs during cleanup when the map is released. A local user with …
CVE-2026-98586Medium· 5.9kernel: sctp: hold asoc or transport before mod_timer() in timer handlers (CVE-2026-98586)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) subsystem. This vulnerability can lead to a Denial of Service (DoS) through a kernel crash. A race condition occurs between timer rearming and cleanup opera…
CVE-2026-98583Medium· 4.4kernel: nfc: nfcmrvl: validate helper command length before pull (CVE-2026-98583)
A flaw was found in the Linux kernel's Marvell NFC (Near Field Communication) driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. …
CVE-2026-98587Medium· 4.7kernel: firewire: cdev: fix back-transition for iso_resource_auto client resource (CVE-2026-98587)
A flaw was found in the Linux kernel's FireWire subsystem. A local user can trigger a race condition by concurrently releasing a device file descriptor while an asynchronous resource management task is running. This flaw allows a resource …
CVE-2026-98585Medium· 4.4kernel: eth: fbnic: Avoid rounding zero ring sizes (CVE-2026-98585)
A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a denial of service (DoS) and crash the system by configuring a network ring buffer size of zero. Because the driver fai…
CVE-2026-98591Medium· 6.7kernel: bpf: Fix bounds check for skb-backed dynptrs (CVE-2026-98591)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of runni…
CVE-2026-98590Medium· 6.7kernel: bpf: Fix bpf_sock context code generation (CVE-2026-98590)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed bound…
CVE-2026-98589Medium· 6.7kernel: bpf: Reject pkt arguments in mutating subprogs (CVE-2026-98589)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, fail…
CVE-2026-98592Medium· 4.7kernel: net: spacemit: clear TX descriptor on fragment mapping failure (CVE-2026-98592)
A flaw was found in the Linux kernel's SpacemiT Ethernet driver. During network packet transmission, a failure to map packet fragments causes the driver to release memory buffers without properly clearing the corresponding hardware descrip…
CVE-2026-98600Medium· 6.5kernel: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() (CVE-2026-98600)
A flaw was found in the Linux kernel's Bluetooth RFCOMM (Radio Frequency Communication) subsystem. This vulnerability allows an adjacent attacker within Bluetooth range to cause a Denial of Service (DoS) by transmitting a specially crafted…
CVE-2026-98594Low· 1.9kernel: tg3: clean up PHYLIB resources on probe failure (CVE-2026-98594)
A flaw was found in the Linux kernel's Broadcom Tigon3 (tg3) ethernet driver. When the driver encounters an error during device initialization, it fails to properly release and unregister associated networking hardware resources. A local u…
CVE-2026-98593Medium· 4.1kernel: s390/debug: Fix NULL pointer dereference in debug_info_copy() (CVE-2026-98593)
A flaw was found in the Linux kernel's s390 debug subsystem. This vulnerability allows a local user to cause a Denial of Service (DoS) through a kernel crash. When static debug registration encounters an error, internal memory pointers are…