Red Hat Linux Security Advisories & CVEs
5814 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-38347] Heap overflow vulnerability leads to Denial of Service
A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input. A flaw was found in FFmpeg. Successful exploitation could lead to the application becoming unresponsive or crashing. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. This is a heap overflow rather than a simple denial of service, which could potentially have higher impact if the overflow is controllable by an attacker. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-38348] Denial of Service via crafted image file due to integer overflow
An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file. This could lead to the application becoming unresponsive or crashing. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-38343] Denial of Service via integer overflow in video scaling
An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. A flaw was found in FFmpeg. This can lead to the application becoming unresponsive or crashing. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libavfilter, which is compiled and shipped in all FFmpeg builds across these products. This vulnerability has low practical impact as FFmpeg already rejects the invalid output size with an error; the integer overflow is undefined behavior detected by sanitizers but does not result in memory corruption. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-38345] Denial of Service via division-by-zero vulnerability in `ff_sws_init_single_context` function.
A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input. A flaw was found in FFmpeg. This can lead to the application becoming unresponsive or crashing. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-369. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-38346] Denial of Service via crafted video file due to integer overflow
An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. A flaw was found in FFmpeg. This can lead to the application becoming unresponsive or crashing, impacting system availability. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-38344] Denial of Service via crafted video file
A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. A flaw was found in FFmpeg. An attacker could exploit this by providing a malicious video file, leading to a Denial of Service (DoS). A Denial of Service attack prevents legitimate users from accessing a service or resource. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-47863] Denial of Service in bufferTimeout operator
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang and making the application unresponsive. This impact is considered Moderate because exploitation requires a specific, non-default application configuration or usage pattern. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat build of Quarkus 3.27.5.SP2; Red Hat build of Quarkus 3.33.3.SP2; Exploit Intelligence; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Debezium 3; Red Hat Data Grid 8; Red Hat Fuse 7. Will not fix / out of support: Exploit Intelligence; Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2026:69470, RHSA-2026:69440.
Medium [CVE-2026-47857] Denial of Service via Flux.windowTimeout operator with fairBackpressure
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier This could cause applications to become unresponsive or crash. The impact is confined to service availability and requires the specific operator and backpressure setting to be actively deployed within the application. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat build of Quarkus 3.27.5.SP2; Red Hat build of Quarkus 3.33.3.SP2; Exploit Intelligence; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Debezium 3; Red Hat Data Grid 8; Red Hat Fuse 7. Will not fix / out of support: Exploit Intelligence; Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2026:69470, RHSA-2026:69440.
Medium [CVE-2026-80183] Information disclosure via improper handling of domain IDs in role assignment listings
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in list_role_assignments_for_tree. This leads to the disclosure of names and home-domain IDs for users, groups, projects, and roles throughout the cloud infrastructure. This vulnerability was introduced in OpenStack Train 16.0.0 and affects all Red Hat OpenStack Platform versions shipping Keystone versions before the fixes (27.1.0, 28.1.0, 29.1.0). Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-80158] ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the IPA bind password in logs and process listings
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw ), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-214. Affected Red Hat products: Red Hat Ceph Storage 5; Red Hat Ceph Storage 9; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-47842] org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25 This deterministic encryption allows an attacker to analyze encrypted data and potentially deduce patterns, leading to the disclosure of sensitive information. Because the IV is deterministic, identical plaintexts always produce identical ciphertext for a given password and salt. An attacker with read access to the encrypted data store can exploit this to determine when two records share the same plaintext value, correlate encrypted values across rows or users, and mount dictionary attacks by pre-encrypting candidate values and comparing results. This is a continuation of CVE-2020-5408. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1204. Affected Red Hat products: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7. Will not fix / out of support: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat Single Sign-On 7.
Medium [CVE-2026-73549] scoped IPv6 handling crash for HTTP/3 clients in original DST clusters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. An attacker could cause a Denial of Service (DoS) by sending network requests using scoped Internet Protocol version 6 (IPv6) client addresses. Due to improper parsing when copying network addresses in original destination routing configurations and HTTP/3 connections, the application terminates unexpectedly, interrupting service availability. This vulnerability is rated as Moderate severity because it results in denial of service through an Envoy proxy crash without compromising system confidentiality or integrity.
Medium [CVE-2026-50572] ext_authz use-after-free after rejecting an HTTP request
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. In the external authorization (ext_authz) HTTP client, completing an authorization request can send a rejection response and destroy the client while its completion handler is still executing. A remote attacker could exploit this timing condition to trigger a use-after-free flaw, crashing the proxy and causing a Denial of Service (DoS). This vulnerability is evaluated as having a Moderate impact for Red Hat products because triggering the crash requires non-default configurations and specific timing conditions, limiting the impact to denial of service without compromising system confidentiality or integrity.
Medium [CVE-2026-48521] HTTP/3 null transport socket options dereference during connection-pool selection
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. A remote attacker can cause a Denial of Service (DoS) when HTTP/3 and automatic protocol selection are enabled. The proxy attempts to access transport socket options during connection pool selection without verifying that they exist, causing an unexpected process crash when processing certain request flows. This flaw is rated as having a Moderate severity because exploitation requires an uncommon upstream configuration where HTTP/3 is enabled alongside ALPN connection pooling.
Medium [CVE-2026-73551] path normalization bypass via dot/dot-dot segments with parameters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. This vulnerability allows a remote attacker to bypass path-based access controls by sending requests with parameters inside dot and dot-dot URL path segments. Because Envoy fails to properly normalize these path segments, backend applications and access-control filters may interpret the requested path differently, potentially granting unauthorized access to protected resources.
Medium [CVE-2026-73511] path matching bypass via per-segment parameters not stripped by router
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. A remote attacker can exploit this vulnerability by submitting an HTTP request containing per-segment path parameters separated by semicolons. Due to differences in how Envoy and backend servers process these parameters, path matching rules can become misaligned, potentially allowing an attacker to bypass path-based access controls or authentication mechanisms.
Medium [CVE-2026-80206] Denial of Service vulnerability in tgrep module
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process. A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions. When processed, these expressions can cause indefinite CPU saturation, leading to a complete denial of service for the Python process utilizing the NLTK library. When processing user-supplied regular expressions inside /regex/ pattern nodes via functions such as tgrep_positions() or tgrep_compile(), NLTK executes re.search without input validation or execution timeouts. If an application exposes these interfaces to unauthenticated or low-privileged attackers, supplying a specially crafted regular expression triggers catastrophic backtracking, resulting in CPU saturation and process-level denial of service.
Medium [CVE-2026-79654] Katello Content View History API Cross-Organization Authorization Bypass
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps. Because the exposure is limited to unauthorized disclosure of Content View lifecycle information, and does not grant access to repository contents, credentials, modification rights, or administrative privileges, Red Hat Product Security has assessed this vulnerability as having a Moderate impact. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; Red Hat Satellite 6. Red Hat lists Red Hat Satellite 6 as not affected. Red Hat fixing advisory: RHSA-2026:74506, RHSA-2026:74504, RHSA-2026:74503.
Medium [CVE-2026-74749] Prevent hard lockup on granted time slice extension
In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space. Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep: WARNING:./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension(). [ tglx: Massaged change log ] A flaw was found in the Linux kernel's restartable sequences (rseq) mechanism. An inconsistency in the handling of lock states during time slice extensions can occur when interrupts are enabled. This can lead to a system livelock or hard lockup, effectively causing a Denial of Service (DoS) for the affected system. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-366.
Medium [CVE-2026-80529] don't swallow dquot recovery verification errors
In the Linux kernel, the following vulnerability has been resolved: xfs: don't swallow dquot recovery verification errors xlog_recover_dquot_commit_pass2() validates the recovered dquot with xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps to out_release. But out_release unconditionally returns 0, so the corruption error is discarded: the caller xlog_recover_items_pass2() sees success, log recovery proceeds as if the dquot were valid, and the corrupt quota buffer can be written back to disk. During dquot recovery, the `xlog_recover_dquot_commit_pass2()` function fails to correctly propagate verification errors. This allows a corrupt quota buffer to be written back to disk, potentially leading to data corruption within the XFS filesystem. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-252. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.