Red Hat Linux Security Advisories & CVEs
6321 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2025-14104] Util-linux: util-linux: heap buffer overread in setpwnam when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the `setpwnam()` function, affecting SUID (Set User ID) login-utils utilities writing to the password database. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Ceph Storage 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat Hardened Images; Red Hat Insights proxy 1.5; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:1696, RHSA-2026:1852, RHSA-2026:1913, RHSA-2026:2800, RHSA-2026:2737, RHSA-2026:3406, RHSA-2026:7180, RHSA-2026:2485, RHSA-2026:2563, RHSA-2026:4943. Affected products named by the advisory: Red Hat package: util-linux-ng.
Medium [CVE-2025-54770] Grub2: use-after-free in net_set_vlan
A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability This vulnerability has been rated as have the impact of Moderate by the Red Hat Product Security team. This decision was made based in the fact an attacker needs local or physical access to the machine, to execute the the net_set_vlan command after it was unloaded. Additionally the most likely outcome from an successful attack is a Denial of Service by leading the grub2 to crash. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-61664] Grub2: missing unregister call for normal_exit command may lead to use-after-free
A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity. This vulnerability has been rated as have the impact of Moderate by the Red Hat Product Security team. This decision was made based in the fact an attacker needs local or physical access to the machine, to execute the normal_exit command after it was unloaded. Additionally the most likely outcome from an successful attack is a Denial of Crash by leading the grub2 to crash. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-61663] Grub2: missing unregister call for normal commands may lead to use-after-free
A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded. This vulnerability has been rated as have the impact of Moderate by the Red Hat Product Security team. This decision was made based in the fact an attacker needs local or physical access to the machine, to execute the normal command after it was unloaded. Additionally the most likely outcome from an successful attack is a Denial of Crash by leading the grub2 to crash. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-61661] Grub2: grub2: out-of-bounds write via malicious usb device
A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited. This vulnerability was rated as having the impact of Moderate by the Red Hat Product Security Engineering team. To exploit this flaw the attacker needs to have physical access to the machine and connect a maliciously crafted USB device which will leverage the lack of string size validation to cause a out-of-bounds write when reading strings from it. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-131. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-54771] Grub2: use-after-free in grub_file_close
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded. This vulnerability has been rated as having a Moderate severity by the Red Hat Product Security Team. This classification is due to the needs of an attacker to have local access to the machine. Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-12464] Qemu-kvm: stack buffer overflow in e1000 device via short frames in loopback mode
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service. This CVE is rated as Moderate because the vulnerability is confined to the loopback interface. Furthermore, even though e1000 is common for legacy Operating Systems, the device is generally discouraged in modern virtualization deployments (where virtio-net is recommended). Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-121. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8 as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: qemu-kvm.
Medium [CVE-2025-12103] trusty ai grants all authenticated users to list pods in any namespace
A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. Red Hat considers this as Moderate as the information available the limitation is limited to PVC and Pods. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-266. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.0; Red Hat OpenShift AI (RHOAI). Red Hat fixing advisory: RHSA-2026:10184, RHSA-2025:21117.
Medium [CVE-2025-12390] Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user. Red Hat severity: Moderate — CVSS 6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-384. Affected Red Hat products: Red Hat build of Keycloak 26.2; Red Hat build of Keycloak 26.2.11; Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.4. Red Hat fixing advisory: RHSA-2025:22088, RHSA-2025:22089, RHSA-2025:21371, RHSA-2025:21370.
Medium [CVE-2025-57848] privilege escalation via excessive /etc/passwd permissions
A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Affected products named by the advisory: RHEL-8-CNV-4.12; RHEL-9-CNV-4.14; RHEL-9-CNV-4.17; RHEL-9-CNV-4.18; and 2 more. Affected products named by the advisory: RHEL-9-CNV-4.19; Red Hat OpenShift Virtualization 4.
Medium [CVE-2025-11568] Luksmeta: data corruption when handling luks1 partitions with luksmeta
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue. This vulnerability has been rated as having the impact of 'Moderate' by the Red Hat Product Security team. This happens because for an successful attack to take place, the attacker needs to have root privileges to me able to run luksmeta. It worth to notice this vulnerability only affects luksmeta when it's being used over a encrypted partition with LUKS1 versio, further LUKS versions are not vulnerable to this. While LUKS1 is not the default LUKS version in Red Hat Enterprise Linux since Red Hat Enterprise Linux 8, LUKS1 is still supported. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-1284. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4.
Medium [CVE-2025-9640] Samba: vfs_streams_xattr uninitialized memory write possible
A flaw was found in Samba, in the vfs_streams_xattr module, where uninitialized heap memory could be written into alternate data streams. This allows an authenticated user to read residual memory content that may include sensitive data, resulting in an information disclosure vulnerability. This vulnerability is rated Low because its exploitation scope and potential impact are tightly constrained. Technically, the flaw only allows disclosure of uninitialized heap memory fragments, not direct control or corruption of memory. The attacker must already be an authenticated user with write access to files using the vfs_streams_xattr module, significantly reducing the attack surface. The exposed data is non-deterministic and contextually limited—it consists of residual memory content that may or may not contain meaningful information, with no guarantee of retrieving sensitive secrets. Additionally, Samba already clears known secret buffers before freeing memory, further lowering the risk of credential or key exposure. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-908. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2025-10911] use-after-free with key data stored cross-rvt
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Discovery 2; Red Hat Hardened Images; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Affected products named by the advisory: Red Hat package: libxslt.
Medium [CVE-2025-4877] Libssh: write beyond bounds in binary to base64 conversion functions
There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption. This issue affects only 32-bits builds of libssh. Red Hat Product Security classified this vulnerability as having a Moderate severity. This happens because of the complexity of the attack, the possible misusage of the libssh API and the fact the attacker may not have full control over the positions and contents written into the heap. No supported Red Hat products are affected by this issue since only 32-bit builds are vulnerable. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:18683. Affected products named by the advisory: Red Hat package: libssh.
Medium [CVE-2025-4437] Cri-o: large /etc/passwd file may lead to denial of service
There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a high memory consumption leading applications to be killed due to out-of-memory. As a result a denial-of-service can be achieved, possibly disrupting other pods and services running in the same host. This vulnerability was rated as Moderate by the Red Hat's Product Security team as it requires the attacker to own an account with minimal privileges to create pods using the CRI-O utility. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2025-7195] privilege escalation due to incorrect permissions of /etc/passwd
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Red Hat Product Security has rated this vulnerability as moderate severity for affected products which run on OpenShift. The vulnerability allows for potential privilege escalation within a container, but OpenShift's default, multi-layered security posture effectively mitigates this risk. Affected products named by the advisory: RHEL-9-CNV-4.17; RHEL-9-CNV-4.18; RHEL-9-CNV-4.20; multicluster engine for Kubernetes 2.6; and 18 more.
Medium [CVE-2025-8419] keycloak smtp inject vulnerability
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. Affected products named by the advisory: Red Hat build of Keycloak 26.0; Red Hat build of Keycloak 26.2.
Medium [CVE-2025-8114] Libssh: null pointer dereference in libssh kex session id calculation
A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, due to its local attack vector and high complexity of exploitation. Although it requires specific allocation failure scenarios, successful exploitation can result in a crash of SSH clients or servers using libssh. Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7 as not affected. Red Hat fixing advisory: RHSA-2026:18683. Affected products named by the advisory: Red Hat package: libssh.
Medium [CVE-2025-7519] Polkit: xml policy file with a large number of nested elements may lead to out-of-bounds write
A flaw was found in polkit. When processing an XML policy with 32 or more nested elements in depth, an out-of-bounds write can be triggered. This issue can lead to a crash or other unexpected behavior, and arbitrary code execution is not discarded. To exploit this flaw, a high-privilege account is needed as it's required to place the malicious policy file properly. This vulnerability was rated with a Moderate severity by the Red Hat Product Security team. This happens because the directories that hold Polkit's policy files are owned by the root user, drastically reducing the attack surface for this vulnerability. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: polkit.
Medium [CVE-2025-6395] null pointer dereference in _gnutls_figure_common_ciphersuite
A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite(). Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Ceph Storage 7; Red Hat Discovery 2; Red Hat Insights proxy 1.5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2025:16115, RHSA-2025:17415, RHSA-2025:16116, RHSA-2025:17361, RHSA-2025:17348, RHSA-2025:22529, RHSA-2025:19088, RHSA-2025:17181. Affected products named by the advisory: Red Hat package: gnutls.