Red Hat has 2,798 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1490 in the last 90 days against 571 in the 90 before. The busiest recent month was October 2026 with 627. The median CVSS is 6.5 (medium), with 135 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (187) and CWE-787 (157). Most affected products: Red Hat Enterprise Linux 9 (275), Red Hat Enterprise Linux 10 (167), Linux (74).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1490 prev 571
Weakness classes
Products
- Red Hat Enterprise Linux 9 275
- Red Hat Enterprise Linux 10 167
- Linux 74
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2798 CVEsRSS
CVE-2026-89688Medium· 5.3⚖ disputedkernel: nfsd: drop the stateid, not the stateowner, on seqid_op replay retry (CVE-2026-89688)
A flaw was found in the Linux kernel's nfsd component. During a `seqid_op` replay retry, the system incorrectly handles reference counts for stateowners, leading to a reference count underflow and a use-after-free vulnerability. This issue…
CVE-2026-89678Medium· 4.3kernel: nfsd: fix partial-write detection in nfsd_direct_write (CVE-2026-89678)
A flaw was found in the Linux kernel's Network File System (NFS) daemon (nfsd) component. The `nfsd_direct_write()` function, responsible for handling direct writes, incorrectly detects partial writes. This issue occurs because the logic f…
CVE-2026-89670Medium· 4.7kernel: nfsd: hold rcu across localio cmpxchg retry (CVE-2026-89670)
A flaw was found in the Linux kernel's Network File System Daemon (nfsd) component. A race condition exists in the `nfsd_open_local_fh()` function where an `nfsd_file` object can be freed and its memory recycled while another process attem…
CVE-2026-89764High· 7.8⚖ disputedIn the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_re…
In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devres_re…
CVE-2026-89747Medium· 4.7kernel: tracing: Fix use-after-free in trace_pipe read on sub-buffer order change (CVE-2026-89747)
A flaw was found in the Linux kernel's tracing component. A local attacker could exploit a use-after-free vulnerability, a type of memory corruption, by manipulating the `trace_pipe` functionality. This occurs when the system attempts to r…
CVE-2026-80979Medium· 5.1kernel: net/smc: unregister the connection before draining the rx tasklet (CVE-2026-80979)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) component. During connection termination, the SMC component may fail to properly unregister a connection before draining its receive tasklet. This can lead to a use-…
CVE-2026-80973Low· 3.2kernel: ALSA: 6fire: bound the MIDI event length from the device (CVE-2026-80973)
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) subsystem, specifically within the 6fire driver. This vulnerability allows a malicious USB device to trigger an out-of-bounds read by sending a specially craft…
CVE-2026-80970Low· 3.3kernel: ALSA: FCP: do not copy out an uninitialised init response (CVE-2026-80970)
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) FireWire Control Protocol (FCP) subsystem. This vulnerability allows a local attacker to trigger the copying of uninitialized kernel memory to userspace. By se…
CVE-2026-80952Medium· 6.1kernel: i3c: master: Fix info leak and UAF in device unregister path (CVE-2026-80952)
A flaw was found in the Linux kernel's i3c master component. During device unregistration, a race condition can occur where the device descriptor is prematurely cleared. This can lead to an information leak, exposing kernel stack contents …
CVE-2026-80944Medium· 4.7kernel: wifi: mwifiex: Detach sync cmd buffer on interrupted wait (CVE-2026-80944)
A flaw was found in the Linux kernel's mwifiex Wi-Fi driver. When a synchronous command's wait operation is interrupted, the driver can attempt to write data to a memory location that has already been released. This memory corruption can l…
CVE-2026-81003High· 7.0kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CVE-2026-81003)
A flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The `afiucv_hs_rcv()` function, responsible for receiving frames, does not properly filter incoming frame…
CVE-2026-81001Medium· 4.7kernel: slip: fix use-after-free in sl_sync() (CVE-2026-81001)
A flaw was found in the Linux kernel's Serial Line Internet Protocol (SLIP) driver. A race condition in the `sl_sync()` function allows for a use-after-free vulnerability, where the driver attempts to access a network device pointer after …
CVE-2026-80982Medium· 4.7kernel: net/smc: fix use-after-free in smc_rx_pipe_buf_release() (CVE-2026-80982)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) network protocol. A race condition occurs when a network connection is closed while the system is still processing its receive buffer pages. This can lead to a use-a…
CVE-2026-80978Medium· 5.5kernel: net: cap advertised IP tunnel headroom (CVE-2026-80978)
A flaw was found in the Linux kernel, specifically within its IP tunnel devices. A local attacker could create a stack of user-controlled IP tunnel devices, causing the system to miscalculate the required memory for network packet headers.…
CVE-2026-89482High· 8.8⚖ disputedkernel: nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone (CVE-2026-89482)
A flaw was found in the nvme-tcp module of the Linux kernel. This vulnerability arises from improper handling of C2HData for REQ_OP_WRITE_ZEROES commands, where the system fails to adequately validate the data length. A remote attacker cou…
CVE-2026-89479High· 7.0⚖ disputedkernel: sctp: stop processing a packet once its association is deleted (CVE-2026-89479)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker could send a specially crafted series of SCTP packets, leading to a use-after-free vulnerability. This occurs when the ker…
CVE-2026-89458Low· 2.5kernel: s390/dasd: Do not complete a failed ESE read as successful (CVE-2026-89458)
A flaw was found in the Linux kernel's s390/dasd component. The `dasd_int_handler()` function incorrectly marks failed Extended Sense Data (ESE) read operations as successful when processing unallocated ESE tracks. This leads to the block …
CVE-2026-89541Medium· 6.5⚖ disputedkernel: SUNRPC: harden gss_unwrap_resp_priv length checks (CVE-2026-89541)
A flaw was found in the Linux kernel. Specifically, an integer overflow vulnerability exists in the `gss_unwrap_resp_priv()` function within the SUNRPC component. This flaw occurs when validating the length of RPCSEC_GSS opaque data. A mal…
CVE-2026-89540Medium· 4.7kernel: sunrpc: init gssp_lock before publishing proc entry (CVE-2026-89540)
A flaw was found in the Linux kernel's sunrpc component. A race condition exists where the `gssp_lock` mutex is not initialized before its associated `/proc/net/rpc/use-gss-proxy` entry is published. This allows a local attacker to trigger…
CVE-2026-89603High· 7.8Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-89575Medium· 5.5kernel: dm raid1: reserve space for NUL-terminator in build_constructor_string() (CVE-2026-89575)
A flaw was found in the Linux kernel's device mapper (dm-raid1) component. This vulnerability occurs in the `build_constructor_string()` function, where insufficient space is reserved for a NUL-terminator when formatting a string with `spr…
CVE-2026-89684Medium· 5.3kernel: nfsd: fix cpntf publish race in nfs4_init_cp_state (CVE-2026-89684)
A flaw was found in the Linux kernel's nfsd component. A remote attacker, by sending a specially crafted OFFLOAD_CANCEL request, could exploit a race condition during the initialization of copy state notifications. This could lead to a den…
CVE-2026-89741Medium· 4.7kernel: Revert "media: v4l2-dev: fix error handling in __video_register_device()" (CVE-2026-89741)
A flaw was found in the Linux kernel's media subsystem, specifically within the v4l2-dev component. This vulnerability arises from incorrect error handling in the `__video_register_device()` function. If a device registration fails, the sy…
CVE-2026-89706Medium· 5.5kernel: nfsd: Reset write verifier when async COPY writeback fails (CVE-2026-89706)
A flaw was found in the Linux kernel's nfsd component. When an asynchronous (async) copy writeback operation fails, the server's write verifier is not properly reset. This can lead to a client incorrectly assuming that data has been made d…
CVE-2026-89527Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svc_xprt_put to free listener on create failure svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. svc_xprt_init() has alread…
CVE-2026-89737Medium· 5.1kernel: usb: typec: thunderbolt: Disable work before freeing tbt on remove (CVE-2026-89737)
A flaw was found in the Linux kernel's USB Type-C Thunderbolt driver. The `tbt_altmode_remove()` function fails to properly disable and drain work items before freeing associated plug and cable references. This oversight can lead to a use-…
CVE-2026-89727Medium· 5.5kernel: KVM: arm64: GICv2: Don't WARN on out-of-range GICV_DIR INTID (CVE-2026-89727)
A flaw was found in the Kernel-based Virtual Machine (KVM) for ARM64 (arm64) architecture. A malicious guest operating system can provide an interrupt ID (INTID) that is outside the expected range to the GICv2 (Generic Interrupt Controller…
CVE-2026-89060High· 7.7A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources o…
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources o…
CVE-2026-78807High· 7.1An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the driver based PMKSA selection path in wpa.c
CVE-2026-89092Medium· 4.2glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092)
A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, ca…