Red Hat Linux Security Advisories & CVEs
5853 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-18710] Credential disclosure via cleartext logging during client initialization
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only. A flaw was found in org.mongodb/mongodb-driver. This allows them to reuse the credentials to authenticate to the associated network infrastructure, leading to information disclosure. This vulnerability has Moderate impact. A flaw in MongoDB driver components used by Red Hat products can lead to sensitive credential disclosure. An attacker with local access to these logs could recover and reuse the credentials, compromising confidentiality. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-312. Affected Red Hat products: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Debezium 3. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-73242] Out-of-bounds memory access in Kerberos decryption
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.30.0, FreeRDP's winpr/libwinpr/sspi/Kerberos/kerberos.c kerberos_DecryptMessage function fails to bound the peer-controlled GSS Wrap-token EC field before using it with RRC in IOV pointer offsets, allowing a malicious RDP peer to trigger out-of-bounds reads and in-place writes during CredSSP/NLA Kerberos decryption. This issue is fixed in version 3.30.0. This occurs during CredSSP/NLA decryption and can lead to a denial of service or information disclosure. An Important out-of-bounds memory vulnerability in FreeRDP's CredSSP/NLA Kerberos decryption allows a malicious RDP endpoint to execute arbitrary code or expose sensitive information on connected clients and servers. This flaw only affects FreeRDP 3.0.0 and newer, meaning RHEL 9 and older versions are not affected. Red Hat severity: Moderate — CVSS 6.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat lists Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:61378, RHSA-2026:68706. Affected products named by the advisory: Red Hat package: freerdp.
Medium [CVE-2026-71468] Cross-user bearer-token reuse via global federation-config cache
A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure. This Moderate impact flaw in Red Hat Advanced Cluster Management for Kubernetes allows for cross-user data access to remote managed hub search results. The vulnerability arises from the reuse of a bearer token across different user requests due to a shared cache. Exploitation requires the `FEATURE_FEDERATED_SEARCH` to be enabled, which is off by default and typically only configured in Global Hub deployments. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-266. Red Hat fixing advisory: RHSA-2026:60387, RHSA-2026:60390, RHSA-2026:60388, RHSA-2026:60389, RHSA-2026:60391, RHSA-2026:60386. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more.
Medium [CVE-2026-71475] Spoke-controlled ClusterID injected unencoded into Insights API URL path
A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is controlled by the spoke, is used directly in the request path without proper validation or URL encoding. This vulnerability allows a malicious spoke to redirect authenticated requests to unintended API endpoints, potentially leading to information disclosure or unauthorized access. This vulnerability is rated as Moderate impact because exploiting it requires an attacker to already possess high privileges or full control over an enrolled managed spoke cluster. Because manipulating the cluster identifier requires administrative tampering with spoke-side status claims, external unauthenticated actors cannot leverage this flaw directly against the hub or the Insights service. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; Red Hat Advanced Cluster Management for Kubernetes 2.16; Red Hat Advanced Cluster Management for Kubernetes 2.17.
Medium [CVE-2026-71845] CCX_TOKEN bearer credential logged in clear text at startup via setDefault
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API. This is a Moderate flaw in Red Hat Advanced Cluster Management for Kubernetes. This credential is used by disconnected cluster deployments as an alternative to cloud.redhat.com. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-532. Red Hat fixing advisory: RHSA-2026:60387, RHSA-2026:60390, RHSA-2026:60388, RHSA-2026:60389, RHSA-2026:60391, RHSA-2026:60386. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.11; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 2 more.
Medium [CVE-2026-73283] Tunnel forwarding restriction bypass
In sshd in OpenSSH before 10.5, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not. The `restrict` keyword, designed to limit tunnel forwarding within the `authorized_keys` file, was not correctly enforced for tunnel forwarding. This issue could allow a local attacker to bypass intended security restrictions, potentially leading to unauthorized network access or resource usage through tunnels. An authorization bypass flaw was found in OpenSSH's sshd daemon. When processing SSH public key authentication, sshd fails to enforce the restrict keyword in authorized_keys against TUN/TAP tunnel forwarding requests. An authenticated user holding a restricted key can still establish virtual network interface tunnels if tunnel forwarding is globally enabled on the server. This allows authorized users to bypass intended per-key restriction policies, posing a Moderate impact to confidentiality and integrity. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-305. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: openssh.
Medium [CVE-2026-73282] Information disclosure and data corruption via use-after-free in ssh client
In ssh in OpenSSH before 10.5, a use-after-free for realloc data can occur if a certain pair of remote-forwarding operations are concurrent. A flaw was found in OpenSSH. This can occur if a remote forwarding is added via the local session multiplexing socket while a remote forwarding open request is pending with the server. A remote attacker with high attack complexity could potentially exploit this to achieve low impact on confidentiality and integrity. Red Hat severity: Moderate — CVSS 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: openssh.
Medium [CVE-2026-73229] Django REST framework: Information disclosure via improper permission checks in AdminRenderer
Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to simulate GET and directly invokes view.get() without view.check_permissions() while rendering an invalid write request, allowing a 400 Bad Request HTML response to disclose data from a GET representation that the requester is not permitted to access. This issue is fixed in version 3.17.2. The AdminRenderer component, when processing an invalid write request, can improperly invoke a GET request without adequate permission checks. This oversight allows an unauthenticated attacker to access data that they are not authorized to view, leading to information disclosure. This vulnerability affects the confidentiality of sensitive information. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-425. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Discovery 2; Red Hat Satellite 6; Red Hat Update Infrastructure 4 for Cloud Providers; Red Hat Update Infrastructure 5. Will not fix / out of support: Red Hat Ansible Automation Platform 2; Red Hat Update Infrastructure 4 for Cloud Providers. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-73228] Django REST framework: Denial of Service via oversized request bodies
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive consumption of memory and CPU resources. This could result in a Denial of Service (DoS) for the affected application. This vulnerability is rated as having a Moderate impact because, while unauthenticated remote clients can submit large payloads to drive excessive processing and memory consumption, the flaw is confined to resource exhaustion without compromising system confidentiality or data integrity. In Red Hat environments, such as Ansible Automation Platform and Satellite, the vulnerable framework is embedded within backend services to handle API requests. The overall exposure is limited by standard deployment topologies, where services operate behind network boundaries or API gateways that restrict incoming traffic. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Medium [CVE-2026-73216] Authenticated client can exhaust relay capacity via quota bypass
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0. A flaw was found in coturn. This allows the client to bypass user and total quotas, leading to the exhaustion of relay ports and a Denial of Service (DoS) condition. Red Hat has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-911.
Medium [CVE-2026-73215] Denial of Service due to incorrect port allocation
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0. A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port pool. Consequently, new connection allocations will fail, resulting in a Denial of Service (DoS) for legitimate users. This Moderate impact flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. By sending a crafted port allocation request, an attacker can permanently exhaust the server's relay port pool, preventing new connections. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772.
Medium [CVE-2026-72712] Denial of Service via zero-length TCP option packet
Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash. A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol (TCP) option. This malformed packet forces the application to enter an infinite loop during packet processing, consuming excessive memory and ultimately causing the Nmap application to crash. The impact is limited to the availability of the Nmap process itself, typically affecting active network scanning operations rather than persistent services. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-62902] .NET: Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in.NET allows an unauthorized attacker to disclose information over a network. A flaw was found in.NET. The issue arises from the inclusion of functionality from an untrusted control sphere, which can be exploited to reveal data. Red Hat has determined that shipped versions of.NET in Red Hat products already include the fix for this vulnerability. The.NET 8.0 (8.0.30), 9.0 (9.0.19), and 10.0 (10.0.11) runtime fix versions are included in current Red Hat packages. Furthermore, the upstream advisory identifies only Microsoft. WindowsDesktop. App.Runtime (Windows Desktop) packages as vulnerable — a component not present in Red Hat's Linux.NET builds. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-829. Affected Red Hat products: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:44914, RHSA-2026:55405.
Medium [CVE-2026-32791] Escalation of Privilege via Untrusted Search Path
Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged, authenticated local attacker could exploit an untrusted search path vulnerability. This could lead to an escalation of privilege, allowing the attacker to gain higher access rights. Due to improper path resolution, an authenticated local attacker with low privileges can place a malicious shared library or executable binary in a directory searched by PCM applications. When a privileged user or service executes PCM, it loads the attacker's binary, leading to local privilege escalation and full compromise of system confidentiality, integrity, and availability. Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Medium [CVE-2025-31936] Privilege escalation via improper memory range handling in SMM
Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This Important privilege escalation flaw affects Intel Xeon 6 Processors when Intel TDX is enabled, allowing a privileged local attacker to escalate privileges within the System Management Mode (SMM). Exploitation requires a high complexity attack and specific internal knowledge, impacting the confidentiality and integrity of the system. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-823.
Medium [CVE-2026-21399] Intel Open Volume Kernel Library: Intel Open Volume Kernel Library: Denial of Service via heap-based buffer overflow
Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This attack has low complexity and requires no user interaction, primarily impacting the availability of the system. Due to improper bounds checking during volume processing, an authenticated local attacker with low privileges can pass malformed volumetric data to an application using the Open VKL API. This triggers a heap memory write beyond allocated boundaries, leading to application instability, localized data integrity degradation, or a localized denial of service via process crashes. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-120.
Medium [CVE-2026-20908] Intel NPU Driver for Windows: Denial of Service via time-of-check time-of-use race condition
Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This time-of-check time-of-use (TOCTOU) race condition vulnerability allows an unprivileged, authenticated local attacker to cause a denial of service. The attack has high complexity and requires no user interaction. This CVE affects the Intel NPU Driver for Windows, which is a separate proprietary codebase from the Linux NPU driver (linux-npu-driver). Red Hat ships the Linux NPU driver in Fedora and EPEL, which uses the Linux DRM kernel subsystem and does not contain the Windows Ring 1 driver code where this TOCTOU race condition exists. Therefore, no Red Hat products or community builds are affected. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H).
Medium [CVE-2026-20786] Denial of service via out-of-bounds read
Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This vulnerability, an out-of-bounds read, could allow a local attacker with low privileges to cause a denial of service (DoS). A denial of service means the system or application becomes unavailable to legitimate users. The flaw can be exploited by an unprivileged, authenticated user through local access without requiring user interaction or special knowledge. Successful exploitation primarily impacts the availability of the system, making it unresponsive or unusable. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-125.
Medium [CVE-2026-20783] Denial of Service via improper conditions check
Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged attacker with authenticated user access can exploit this vulnerability locally with low complexity and no user interaction. This can lead to a denial of service, severely impacting the availability of the system. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-606.
Medium [CVE-2026-20769] Denial of Service via improper conditions check
Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged software adversary with an authenticated user can exploit an improper conditions check. This vulnerability, requiring local access and no user interaction, may lead to a denial of service on the affected system. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-606.