Red Hat Linux Security Advisories & CVEs
13625 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-68113] replace BUG_ON with WARN_ON
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf) This vulnerability allowed a local attacker to trigger a kernel crash due to an improper use of the `BUG_ON()` macro, which is designed to halt the system on critical errors. By replacing `BUG_ON()` with `WARN_ON()`, the kernel no longer crashes, mitigating a potential Denial of Service (DoS) condition. BUG_ON() on error paths forces kernel panic. Systems without AMD GPUs are not affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux for NVIDIA 26. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-68112] replace BUG_ON with WARN_ON
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9.4.3: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c) This vulnerability is due to the use of `BUG_ON()` macros in error handling, which, when triggered by specific error conditions, could cause the kernel to crash. This could result in a Denial of Service (DoS) for the system. This issue affects AMDGPU GFX9.4.3 hardware. Certain error paths used BUG_ON(), causing kernel panic. Systems without AMD GPUs are not affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-68111] replace BUG_ON with WARN_ON
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054) A flaw was found in the Linux kernel's amdgpu graphics driver. This vulnerability could lead to a system crash due to an unhandled error condition. By replacing a critical error mechanism with a warning, the kernel is now more resilient, preventing potential Denial of Service (DoS) situations. BUG_ON() on error paths forces kernel panic. Systems without AMD GPUs are not affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-68110] replace BUG_ON with WARN_ON
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4.4.2: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc) A flaw was found in the Linux kernel's `amdgpu` graphics driver, specifically within the `sdma4.4.2` component. This vulnerability could allow a local attacker to trigger a system crash by exploiting certain unhandled error conditions. The issue stems from the use of a `BUG_ON()` macro, which forces a kernel panic and results in a Denial of Service (DoS). The resolution replaces this with a `WARN_ON()` macro, preventing the system from crashing while still logging the error. This issue affects systems using the AMDGPU driver with SDMA 4.4.2. Certain error paths in the SDMA engine used BUG_ON(), which forces an immediate kernel panic. A local user able to exercise those GPU paths could trigger a denial of service. Systems without AMD GPUs are not affected. Red Hat severity: Low — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6.
Medium [CVE-2026-68106] fix division by zero with invalid uvd dimensions
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, width_in_mb or height_in_mb becomes 0, leading to fs_in_mb being 0. This causes a division by zero when calculating num_dpb_buffer in H264 and H264 Perf decode paths. Add validation to reject frames with width < 16 or height < 16 before performing any calculations that depend on these values. V2: Format change - move up all vaiable definitions. V3: Use warn_once to avoid spam. (cherry picked from commit 3e41d26c70b0a459d041cc19482a226c4b7423cb) This vulnerability occurs when processing video frames with invalid dimensions, specifically if the width or height is less than 16. Such malformed input can lead to a division by zero error during video decoding operations. A local attacker could exploit this to cause a system crash, resulting in a Denial of Service (DoS). This issue affects AMDGPU UVD video decode. Invalid frame dimensions below 16 cause division by zero in macroblock calculations. Systems without AMD GPUs are not affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-369. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more.
Medium [CVE-2026-68105] Fix kernel panic during driver load failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix kernel panic during driver load failure Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more.
Medium [CVE-2026-68104] invoke pm_genpd_remove before freeing genpd
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pm_genpd_remove() before freeing genpd Call pm_genpd_remove() to unregister from global list prior to releasing acp_genpd memory, and clear the pointer after free. (cherry picked from commit cd8650d7a91ee8b768e202354672553faa5cc1f2) This vulnerability arises from improper memory handling where the `pm_genpd_remove()` function is not invoked before freeing `acp_genpd` memory. A local attacker could exploit this flaw, potentially leading to memory corruption, which may result in a denial of service or privilege escalation. This issue affects AMDGPU systems with ACP power domains. acp_genpd memory is freed without calling pm_genpd_remove(), leaving stale genpd entries. Systems without AMD GPUs are not affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-68102] fix aperture mapping leak
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpu_pci_remove() calls drm_dev_unplug() before invoking the driver fini routines. This causes drm_dev_enter() in amdgpu_ttm_fini() to always return false, so iounmap(aper_base_kaddr) never runs on normal driver unload, leaving an orphaned entry in the x86 PAT interval tree. On connected_to_cpu hardware, the aperture is mapped write-back (WB) via ioremap_cache(). On reload, IP discovery calls memremap(..., MEMREMAP_WC) over the same range. The WC vs WB conflict causes: ioremap error for 0x..., requested 0x1, got 0x0 amdgpu: discovery failed: -2 Fix by switching to devres-managed mappings so cleanup is guaranteed regardless of drm_dev_enter() state: - connected_to_cpu path: devm_memremap(MEMREMAP_WB). For IORESOURCE_SYSTEM_RAM ranges this takes the try_ram_remap() shortcut, returning __va(offset) from the existing kernel direct map. No new ioremap VA or PAT entry is created, so there is nothing to orphan. - dGPU path: devm_ioremap_wc() registers iounmap() as a devres action, guaranteeing cleanup at device_del() time. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: kernel-rt.
Medium [CVE-2026-68098] bound DACL dedup walk to copied ACEs
In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs set_ntacl_dacl() can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, num_aces reflects only the ACEs that were actually copied into the output DACL, but set_posix_acl_entries_dacl() still receives nt_num_aces and uses it to walk the existing ACE array during dedup. That makes the dedup walk scan past the copied ACE array and inspect buffer tail that does not contain valid ACEs. Split the two meanings currently carried by the NT ACE count. Pass the number of copied NT ACEs to bound the dedup walk, and preserve the original "input DACL had NT ACEs" state separately for the Everyone/default ACL fallback. This keeps the dedup walk aligned with the ACEs that are actually present in the rebuilt DACL. The `set_ntacl_dacl()` function, which processes Discretionary Access Control Lists (DACLs), can stop copying Access Control Entries (ACEs) prematurely due to a size accounting overflow. This can cause a subsequent deduplication process to read beyond the intended memory buffer, potentially leading to an out-of-bounds read. This issue could result in a denial of service or information disclosure. This issue affects ksmbd (in-kernel SMB server).
Medium [CVE-2026-59088] denial of service via signed integer overflow in fli file processing
A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service. This Moderate impact flaw in GIMP's FLI file processing plugin can lead to a denial of service. The vulnerability requires user interaction, as an attacker must convince a local user to open a specially crafted FLI image file, which would cause the GIMP application to crash due to an integer overflow during memory allocation. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-72585] Authorization bypass allows Editor to delete protected contact points
An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. An authorization bypass in Grafana allows Editor-role users to delete protected contact points because a previous security patch for updating them missed the deletion process. This could disrupt alert notifications in Red Hat deployments where Grafana is configured with alert managers and Editor-role users have access to manage alert configurations. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-284. Affected Red Hat products: Multicluster Global Hub; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Ceph Storage 5; Red Hat Ceph Storage 6; Red Hat Ceph Storage 7; Red Hat Ceph Storage 9. Red Hat lists Red Hat Ceph Storage 8; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-66486] GNU cpio: Terminal control sequence injection via crafted archive member names
GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio -it, member names are printed directly to output without quoting or escaping. An attacker can craft a cpio archive containing member names with embedded newline characters or ANSI escape sequences, causing forged listing entries or terminal control sequence injection when the listing is displayed. This issue has been fixed in commit 2ff9600c9ef32e88759843cdbde74c8db5ae9b30 All Red Hat cpio packages (RHEL 6 through 10, RHIVOS) ship versions well below the fix and are affected. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N). Weakness: CWE-94. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cpio.
Medium [CVE-2026-66485] GNU cpio: Denial of Service via uncontrolled memory allocation from crafted archives
GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function uses alloca to allocate stack memory based on the length of argpath, which is derived from an archive-controlled pathname during extraction. A malicious cpio archive containing a sufficiently long nested pathname causes an unbounded stack allocation, resulting in a stack overflow and crash of the cpio process. An attacker who can supply a crafted cpio archive to a victim who extracts it can cause a denial of service. This issue has been fixed in commit 3cd514031371d8aeeaf2048aa10103e02831aaa9 This vulnerability involves uncontrolled memory allocation when processing specially crafted cpio archives. This results in a denial of service (DoS) for the affected system. All Red Hat cpio packages (RHEL 6 through 10, RHIVOS) ship versions well below the fix and are affected. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cpio.
Medium [CVE-2026-71394] use of uninitialized memory via a malicious font file
GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf To exploit this flaw, a user needs to load a malicious font file or a document with custom faces, limiting its exposure. For these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). Weakness: CWE-1284. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Medium [CVE-2026-55814] Information disclosure via missing authentication in download APIs
Information disclosure via missing authentication in download APIs. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-306.
Medium [CVE-2026-19404] missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance
missing authorization allows anonymous clients to start or abort CleanAllRUV replication maintenance. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-862.
Medium [CVE-2026-12570] Denial of Service via HDF5 Shape Bomb when loading malicious model files
Denial of Service via HDF5 Shape Bomb when loading malicious model files. Red Hat rates this moderate (CVSS 5). Weakness: CWE-770.
Medium [CVE-2026-72522] Denial of Service due to incorrect Unicode surrogate handling
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions. An attacker can exploit the resulting out-of-bounds read to trigger an infinite loop, causing a denial of service (DoS). A denial of service (DoS) flaw was found in libexpat's handling of Unicode surrogate pairs. An attacker providing specially crafted XML input to an application parsing untrusted data can trigger an out-of-bounds read and an infinite loop, leading to high CPU usage and system resource exhaustion. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:54869. Affected products named by the advisory: Red Hat package: firefox; Red Hat package: thunderbird; Red Hat package: mingw-expat.
Medium [CVE-2026-68083] fix path resolution in ksmbd_vfs_kern_path_create
fix path resolution in ksmbd_vfs_kern_path_create. Red Hat rates this moderate. Weakness: CWE-22.
Medium [CVE-2026-68109] replace BUG_ON with WARN_ON
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5) This vulnerability occurs when a `BUG_ON()` macro is triggered, which can lead to an immediate kernel crash. An attacker could potentially exploit this to cause a Denial of Service (DoS) on the affected system. Red Hat severity: Low — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.