Red Hat has 2,677 CVEs on record between 2010 and 2026. Disclosure cadence is accelerating: 1489 in the last 90 days against 551 in the 90 before. The busiest recent month was October 2026 with 628. The median CVSS is 6.6 (medium), with 132 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 2722 days (6 cases). The dominant weakness classes are CWE-125 (173) and CWE-787 (152). Most affected products: Red Hat Enterprise Linux 9 (281), Red Hat Enterprise Linux 10 (167), Linux (72).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.6
- Publish → KEV
- 2722 d median(6)
- Last 90 days
- 1489 prev 551
Weakness classes
Products
- Red Hat Enterprise Linux 9 281
- Red Hat Enterprise Linux 10 167
- Linux 72
- Red Hat Enterprise Linux BaseOS (v. 10) 55
- Red Hat OpenShift AI (RHOAI) 50
- build_of_keycloak 49
Worst active — by depth score
CVE-2017-12149Critical· 9.8In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserializatio…100CVE-2021-40438Critical· 9.0A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user99CVE-2026-31431High· 7.8In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in op…88CVE-2024-3094Critical· 10.0Xz: malicious code in distributed source85CVE-2010-1428High· 7.5The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allow…82
redhat vulnerabilities
CVEs affecting redhat, newest first. Open any entry for full detail, references, and exploit status.
2677 CVEsRSS
CVE-2026-98435Medium· 4.4kernel: EDAC/altera: Use parent device for devres in altr_portb_setup() (CVE-2026-98435)
A flaw was found in the Linux kernel's Altera EDAC (Error Detection and Correction) driver. Device-managed interrupt requests and resource groups in the altr_portb_setup() function were improperly associated with a temporary per-port devic…
CVE-2026-98434Medium· 5.5kernel: sysctl: Check range in proc_dointvec_ms_jiffies_minmax (CVE-2026-98434)
A flaw was found in the Linux kernel. Due to a missing range validation check in the sysctl subsystem, configured minimum and maximum limits were not enforced during specific millisecond-to-jiffies conversions. A local user with permission…
CVE-2026-98433Low· 2.5kernel: KVM: PPC: Book3S HV: fix secure device page leak on uv_page_in() failure (CVE-2026-98433)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for PowerPC architectures. When handling secure virtual machines, a failure during secure memory paging fails to release allocated device memory and intern…
CVE-2026-98441Medium· 4.7⚖ disputedkernel: net/sched: act_ct: avoid modifying shared unconfirmed ct entry (CVE-2026-98441)
A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. Th…
CVE-2026-98442High· 7.5kernel: net/sched: act_ct: fix helper UAF due to extensions realloc (CVE-2026-98442)
A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption throu…
CVE-2026-98440Medium· 5.6kernel: KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction (CVE-2026-98440)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem on ARM64 architectures. In nested virtualization configurations, shadow memory management structures are prematurely freed during shadow page flushes while…
CVE-2026-98462Medium· 4.7kernel: Bluetooth: hci_conn: fix CIS hold ownership on reuse (CVE-2026-98462)
A flaw was found in the Linux kernel's Bluetooth subsystem. Improper reference count management during the reuse and binding of Connected Isochronous Stream (CIS) connections can result in an unbalanced connection hold count. A local attac…
CVE-2026-98466High· 8.2kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-…
CVE-2026-98465Medium· 5.3kernel: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration (CVE-2026-98465)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU (vCPU) execution, a local user w…
CVE-2026-98464Medium· 5.6⚖ disputedkernel: RISC-V: KVM: Synchronize hrtimer callback during teardown (CVE-2026-98464)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service (DoS) or host system crash due to a use-after-free memory issue during…
CVE-2026-98472Low· 3.3kernel: KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV (CVE-2026-98472)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) AMD SEV (Secure Encrypted Virtualization) implementation. This flaw allows a local user with permissions to manage virtual machines to cause a denial of service (DoS…
CVE-2026-98471Medium· 5.3kernel: KVM: SEV: Do cache maintenance on the source VM during intra-host migration (CVE-2026-98471)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for AMD SEV (Secure Encrypted Virtualization). During intra-host migration of an encrypted virtual machine, the source virtual machine's CPU caches are not…
CVE-2026-98469Medium· 5.5kernel: KVM: arm64: Fix AArch32 DBGBXVR<n> handling (CVE-2026-98469)
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) subsystem for ARM64 architectures. Improper handling of specific debug register accesses in 32-bit ARM (AArch32) mode causes the hypervisor to encounter an internal …
CVE-2026-98476Medium· 4.7kernel: s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str() (CVE-2026-98476)
A flaw was found in the Linux kernel's s390 channel I/O (CIO) subsystem. When querying device utility strings, the kernel fails to verify that an associated channel path remains valid after its removal from the registry. A local user could…
CVE-2026-98474Medium· 4.1kernel: s390/pci: Fix missing device lock in zpci_report_status() (CVE-2026-98474)
A flaw was found in the Linux kernel's s390 PCI subsystem. This flaw can lead to a Denial of Service (DoS) due to a missing device lock during PCI (Peripheral Component Interconnect) error recovery. When error recovery status is reported w…
CVE-2026-98468Low· 2.5kernel: KVM: arm64: Fix spurious warning for benign stage 2 teardown race (CVE-2026-98468)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This flaw may allow a local user to cause a Denial of Service (DoS) or kernel instability. A race condition occurs when virtual machine stage 2 …
CVE-2026-98480Low· 1.9kernel: nfc: trf7970a: power down on startup RX gain failure (CVE-2026-98480)
A flaw was found in the Linux kernel's Near Field Communication (NFC) TRF7970A driver. This vulnerability can lead to a denial of service (DoS) or improper hardware state due to unreleased power resources. If a communication error occurs w…
CVE-2026-98478Medium· 4.7kernel: scsi: ufs: core: Keep internal commands dispatchable during error handling (CVE-2026-98478)
A flaw was found in the Linux kernel's Universal Flash Storage (UFS) driver. During device error recovery, the driver pauses all command queues, which inadvertently prevents internal recovery commands from being dispatched. This condition …
CVE-2026-98470Medium· 4.7kernel: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode (CVE-2026-98470)
A flaw was found in the Linux kernel's KVM (Kernel-based Virtual Machine) subsystem for ARM64. This vulnerability allows a local attacker to cause a Denial of Service (DoS). When running in protected mode, the kernel issues an internal war…
CVE-2026-98481Medium· 6.2kernel: nfc: port100: reject frames whose declared length exceeds the received data (CVE-2026-98481)
A flaw was found in the Linux kernel's Near Field Communication (NFC) Port-100 driver. An attacker connecting a malicious USB device can provide a response frame whose declared length exceeds the actual received data size. This flaw causes…
CVE-2026-98475Medium· 5.1kernel: s390/cmf: Fix virtual vs physical address confusion (CVE-2026-98475)
A flaw was found in the Linux kernel's s390 Channel Measurement Facility (CMF). This vulnerability can allow a local user to cause memory corruption or a Denial of Service (DoS) due to confusion between virtual and physical memory addresse…
CVE-2026-98473Low· 1.9kernel: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config (CVE-2026-98473)
A flaw was found in the Linux kernel's s390 Virtual Function I/O Adjunct Processor (VFIO-AP) device driver. A local user with administrative privileges can trigger this issue by removing an AP queue from the host configuration while it rem…
CVE-2026-98483Medium· 5.5kernel: nfc: fix use-after-free in nfc_get_local_general_bytes (CVE-2026-98483)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. A reference counting error in the nfc_get_local_general_bytes() function causes memory to be freed prematurely while callers still access the returned pointer…
CVE-2026-98482Medium· 6.5kernel: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() (CVE-2026-98482)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. The Logical Link Control Protocol (LLCP) implementation does not verify the length of incoming network packets before reading sequence information. An attacke…
CVE-2026-98479Medium· 6.5kernel: scsi: libiscsi_tcp: Check the data direction of a Data-In PDU (CVE-2026-98479)
A flaw was found in the Linux kernel's iSCSI TCP subsystem. A malicious or compromised iSCSI storage server can cause memory corruption and data integrity loss on a connected client by sending an unexpected Data-In Protocol Data Unit (PDU)…
CVE-2026-98485Medium· 5.9kernel: netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read (CVE-2026-98485)
A flaw was found in the Linux kernel's netfilter subsystem. This flaw allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted IPv6 packets to an affected system. The issue occurs when an IPv6 routing header…
CVE-2026-98491Medium· 5.9kernel: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry (CVE-2026-98491)
A flaw was found in the Linux kernel's Open vSwitch subsystem. When cloned network packet buffers share an unconfirmed connection tracking entry, committing the entry with conflicting extensions can trigger a use-after-free memory issue du…
CVE-2026-98487Medium· 5.5⚖ disputedkernel: net: bridge: mdb: restart port group walk after deletion (CVE-2026-98487)
A flaw was found in the Linux kernel's network bridge subsystem. When deleting multicast database (MDB) port groups, the kernel can maintain a stale reference to memory that has already been freed during recursive group removal, resulting …
CVE-2026-98499Medium· 6.8kernel: HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce() (CVE-2026-98499)
A flaw was found in the Linux kernel's Wacom Human Interface Device (HID) driver. When processing a device report descriptor with mismatched usage and count configurations, the driver can calculate an invalid memory offset and perform an o…
CVE-2026-98497Medium· 5.6kernel: net/mlx5e: fix swapped IPv6 IPsec policy masks (CVE-2026-98497)
A flaw was found in the Linux kernel's mlx5 network driver. When configuring IPv6 IPsec (Internet Protocol Security) rules with differing source and destination prefix lengths, the driver inadvertently swaps the source and destination addr…