Red Hat has 2,674 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1489 in the last 90 days against 551 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1489 prev 551
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
Red Hat vulnerabilities
CVEs affecting Red Hat, newest first. Open any entry for full detail, references, and exploit status.
2677 CVEsRSS
CVE-2026-98744Medium· 5.5kernel: ASoC: codecs: max98363: fix uninitialized stream_config->type (CVE-2026-98744)
A flaw was found in the Linux kernel's MAX98363 audio codec driver. A local user could trigger this vulnerability during audio stream configuration because internal stream parameters are left uninitialized in memory. This issue allows unin…
CVE-2026-98759Medium· 6.8kernel: usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work() (CVE-2026-98759)
A flaw was found in the Linux kernel's USB Type-C TI Power Delivery (tipd) driver. The driver fails to initialize memory for descriptor structures when handling partner device connections. An attacker connecting a USB device can cause the …
CVE-2026-98758Medium· 4.1kernel: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove (CVE-2026-98758)
A flaw was found in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) GLINK driver. A local attacker with administrative privileges could trigger this flaw during device removal, leading to a Denial of Service (DoS) …
CVE-2026-98770Medium· 4.4kernel: usb: gadget: midi2: Fix the jack descriptor array sizes (CVE-2026-98770)
A flaw was found in the Linux kernel's USB gadget MIDI 2.0 driver. Under-sized descriptor arrays allow a local user to trigger an out-of-bounds memory access when setting up a large number of MIDI jacks through the configuration filesystem…
CVE-2026-98774Low· 3.3kernel: rust_binder: cancel deferred work items in thread exit (CVE-2026-98774)
A flaw was found in the Linux kernel's Rust Binder driver. When a thread terminates while handling an active outgoing transaction, deferred work items on the thread's task list are not properly cleaned up during thread release. A local att…
CVE-2026-98776Medium· 4.7kernel: kernel: Privilege escalation via binderfs use-after-free (CVE-2026-98776)
A flaw was found in the Linux kernel's Android Binder filesystem (binderfs). A local user can exploit a race condition during concurrent device creation and deletion to trigger a use-after-free (UAF) condition, which occurs when freed memo…
CVE-2026-98782Low· 2.3kernel: drm/mediatek: Fix ovl adaptor platform device leak (CVE-2026-98782)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When device initialization fails or during driver removal, the driver fails to unregister an allocated overlay adaptor platform device. A local user cou…
CVE-2026-98781Low· 2.3kernel: drm/mediatek: Fix pdev reference leak in mtk_drm_bind() (CVE-2026-98781)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. When binding non-master display devices, the driver fails to release a device reference acquired during initialization. A local user could exploit this …
CVE-2026-98783Medium· 4.1kernel: drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device (CVE-2026-98783)
A flaw was found in the Linux kernel's MediaTek DRM (Direct Rendering Manager) driver. The driver fails to verify whether the display overlay adaptor platform device is successfully registered during initialization. If the registration fai…
CVE-2026-98789Medium· 4.4kernel: bpf: Fix objects stuck in free_by_rcu_ttrace (CVE-2026-98789)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) memory allocator. When releasing memory, objects queued while a delayed cleanup cycle is already in progress can fail to be reclaimed. A local user can exploit this vulner…
CVE-2026-98786Medium· 4.7kernel: drm/amd/display: guard dc_sink dereferences in MST mode validation (CVE-2026-98786)
A flaw was found in the Linux kernel's AMD GPU display driver. During DisplayPort Multi-Stream Transport (MST) display disconnection, a race condition can cause the driver to access display data structures without verifying that they remai…
CVE-2026-98787Medium· 4.1kernel: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() (CVE-2026-98787)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. Missing CPU migration protection during batch lookup and delete operations on hash tables allows a task to migrate between processors while freeing memory. A lo…
CVE-2026-98792Medium· 5.9kernel: netfilter: flowtable: generalize pending status bit (CVE-2026-98792)
A flaw was found in the Linux kernel's netfilter flowtable component. This flaw allows an attacker to cause a denial of service (DoS) by crashing the operating system. A race condition exists between the connection cleanup worker and hardw…
CVE-2026-98791Medium· 4.4kernel: net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference (CVE-2026-98791)
A flaw was found in the Linux kernel's Mellanox network driver (mlx5e). A local user can exploit this vulnerability to cause a denial of service (DoS) through a system crash. During the teardown of an AF_XDP (eXpress Data Path) transmit qu…
CVE-2026-98796Medium· 4.1kernel: net: ethernet: mtk_eth_soc: allocate dummy netdev sooner (CVE-2026-98796)
A flaw was found in the Linux kernel's MediaTek Ethernet driver. This vulnerability allows a local user with network administration privileges to cause a Denial of Service (DoS) through a kernel crash. Due to an ordering issue during devic…
CVE-2026-98795Medium· 4.4kernel: net: sparx5: skip ptp deinit if init was skipped (CVE-2026-98795)
A flaw was found in the Linux kernel's Microchip Sparx5 network driver. When operating on devices where Precision Time Protocol (PTP) initialization is skipped, the driver does not check if PTP was initialized before executing its deinitia…
CVE-2026-98799Medium· 4.4kernel: bpf: Skip detached progs in trampoline images that are still in use (CVE-2026-98799)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached while another task is paused in an active routine, the kernel can prematurely release the detached progr…
CVE-2026-98797Medium· 5.5kernel: net: cap skb->queue_mapping when the tx queue is picked (CVE-2026-98797)
A flaw was found in the Linux kernel. A local user with network administration privileges in a network namespace can cause a Denial of Service (DoS) by triggering an out-of-bounds memory read. When redirecting packets between network inter…
CVE-2026-98802Low· 3.7kernel: seg6: ensure packet data is writable before modifying SRH and IPv6 DA (CVE-2026-98802)
A flaw was found in the Linux kernel. When processing IPv6 segment routing (seg6) headers, the kernel modifies routing and destination address fields without first ensuring that the network packet buffer is writable. If the packet buffer i…
CVE-2026-98800Medium· 4.7kernel: kernel: Denial of Service via use-after-free in BPF trampoline (CVE-2026-98800)
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When a BPF program attached to a trampoline is detached, the kernel may release the program's memory prematurely before preempted tasks have safely completed ex…
CVE-2026-98804Medium· 4.7kernel: net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk() (CVE-2026-98804)
A flaw was found in the Linux kernel's networking subsystem. When page pool statistics are enabled, a race condition in the bulk recycling mechanism can allow a memory pool to be freed before statistical updates finish processing. An attac…
CVE-2026-98803Medium· 6.5kernel: net: stmmac: fix rx Scatter-Gather support (CVE-2026-98803)
A flaw was found in the Linux kernel's stmmac ethernet driver. When receiving network frames larger than the primary buffer size, the Direct Memory Access (DMA) engine attempts to write excess data into a secondary receive buffer that is n…
CVE-2026-98801Medium· 5.5kernel: kernel: Denial of Service via improper socket memory reservation handling (CVE-2026-98801)
A flaw was found in the Linux kernel. A local user can cause a Denial of Service (DoS) or kernel memory corruption by manipulating socket memory reservation settings. Due to a lack of upper-bound validation and missing locking mechanisms w…
CVE-2026-98807Medium· 4.4kernel: net/mlx5: Fix slab-out-of-bounds when handling team device events (CVE-2026-98807)
A flaw was found in the Linux kernel's Mellanox ConnectX (mlx5) network driver. It allows a privileged local user to cause a Denial of Service (DoS) via an out-of-bounds memory read. When processing Link Aggregation (LAG) events, the drive…
CVE-2026-98806Medium· 4.4kernel: octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled (CVE-2026-98806)
A flaw was found in the Linux kernel's octeontx2-pf network driver. When Data Center Bridging (DCB) is enabled, the driver assumes traffic queue mapping structures are always initialized, which is not the case for System Data Path (SDP) vi…
CVE-2026-98810Medium· 6.1kernel: wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue() (CVE-2026-98810)
A flaw was found in the Linux kernel's mac80211 wireless subsystem. A local attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory by transmitting specially crafted network packets. This issue occurs because …
CVE-2026-98808Medium· 6.7kernel: net: systemport: Fix buffer overflow in bcm_sysport_get_stats() (CVE-2026-98808)
A flaw was found in the Linux kernel's Broadcom SYSTEMPORT driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when a local user queries network device statistics on systems with SYSTEMPORT Lite hardware. …
CVE-2026-98814Medium· 4.4kernel: nvme: fix command effects log lifetime for multipath heads (CVE-2026-98814)
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. A local attacker can cause a denial of service (DoS) or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/…
CVE-2026-98813Medium· 4.4kernel: bpf: Hold map BTF for the memory allocator destructor record (CVE-2026-98813)
A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) subsystem. During the teardown of certain BPF hash maps, the memory allocator destructor failed to retain a reference to the map's BPF Type Format (BTF) metadata, allowing…
CVE-2026-98818Medium· 4.7kernel: mm/slab: do not wake up kswapd in __kfree_rcu_sheaf() (CVE-2026-98818)
A flaw was found in the Linux kernel. When freeing memory through the slab allocator, the system may attempt to wake the kernel swap daemon while an internal scheduler lock is already held. This unsafe sequence can trigger a circular locki…