Red Hat Linux Security Advisories & CVEs
5477 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Linux release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux advisories
Medium [CVE-2026-64513] Unconditionally recompute CR8 intercept on PPR update
Unconditionally recompute CR8 intercept on PPR update. Red Hat rates this low (CVSS 5.5).
Medium [CVE-2026-64335] fix broken rx after throttle
fix broken rx after throttle. Red Hat rates this low (CVSS 5.5).
Medium [CVE-2026-64417] fix NULL pointer dereference in debugfs
fix NULL pointer dereference in debugfs. Red Hat rates this low (CVSS 5.5).
Medium [CVE-2026-64450] fix out-of-bounds read in broadcast Gap ACK blocks
In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATE_MSG can carry a Gap ACK blocks record in its data area. tipc_get_gap_ack_blks() only verifies that the record's len field is self-consistent with its ugack_cnt/bgack_cnt counts (sz == struct_size(p, gacks, ugack_cnt + bgack_cnt)); it does not check that the record actually fits in the message data area, msg_data_sz(). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-64457] fix vq info pointer lookup via wrong index
In the Linux kernel, the following vulnerability has been resolved: virtio_pci: fix vq info pointer lookup via wrong index Unbinding a virtio balloon device: echo virtio0 > /sys/bus/virtio/drivers/virtio_balloon/unbind triggers a NULL pointer dereference. The dmesg says: BUG: kernel NULL pointer dereference, address: 0000000000000008 [...] RIP: 0010:__list_del_entry_valid_or_report+0x5/0xf0 Call Trace: vp_del_vqs+0x121/0x230 remove_common+0x135/0x150 virtballoon_remove+0xee/0x100 virtio_dev_remove+0x3b/0x80 device_release_driver_internal+0x187/0x2c0 unbind_store+0xb9/0xe0 kernfs_fop_write_iter.llvm.11660790530567441834+0xf6/0x180 vfs_write+0x2a9/0x3b0 ksys_write+0x5c/0xd0 do_syscall_64+0x54/0x230 entry_SYSCALL_64_after_hwframe+0x29/0x31 [...] The virtio_balloon device registers 5 queues (inflate, deflate, stats, free_page, reporting) but only the first two are unconditional. The stats, free_page and reporting queues are each conditional on their respective feature bits. When any of these features are absent, the corresponding vqs_info entry has name == NULL, creating holes in the array. The root cause is an indexing mismatch introduced when vq info storage was changed to be passed as an argument. vp_find_vqs_msix() and vp_find_vqs_intx() store the info pointer at vp_dev->vqs[i], where 'i' is the caller's sparse array index.
Medium [CVE-2026-64446] fix heap buffer overflow in rtw_cfg80211_set_wpa_ie
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie() supplicant_ie is a 256-byte array in struct security_priv. The WPA and WPA2 IE copy paths use: memcpy(padapter->securitypriv.supplicant_ie, &pwpa[0], wpa_ielen + 2); where wpa_ielen is the raw IE length field (u8, 0-255). When a local user supplies a connect request via nl80211 with a crafted WPA IE of length 255, wpa_ielen + 2 equals 257, overflowing the 256-byte buffer by one byte into the adjacent last_mic_err_time field. rtw_parse_wpa_ie() does not prevent this: its length consistency check compares *(wpa_ie+1) against (u8)(wpa_ie_len-2), which is (u8)(255) == 255 when wpa_ie_len = 257, so the check passes silently. Add explicit bounds checks for both the WPA and WPA2 paths before the memcpy, rejecting any IE whose total size (wpa_ielen + 2) exceeds the supplicant_ie buffer. A local user can exploit this vulnerability by supplying a crafted Wi-Fi Protected Access (WPA) Information Element (IE) during a connection request. This can lead to a one-byte heap buffer overflow, potentially causing memory corruption and affecting system stability or leading to information disclosure. Red Hat severity: Moderate. Weakness: CWE-120.
Medium [CVE-2026-64500] Initialize completion before requesting IRQ
In the Linux kernel, the following vulnerability has been resolved: iio: adc: lpc32xx: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "lpc32xx_adc_probe() in drivers/iio/adc/lpc32xx_adc.c registers its interrupt handler with devm_request_irq() before it initializes st->completion with init_completion(). If an interrupt arrives after devm_request_irq() and before init_completion(), the handler calls complete() on an uninitialized completion, causing a kernel panic. The zeroed task_list makes list_empty() return false, so swake_up_locked() dereferences a NULL list entry, triggering a KASAN wild-memory-access." Fix the chance of a spurious IRQ causing an uninitialized pointer dereference by moving init_completion() above devm_request_irq(). A local attacker could trigger a race condition during the driver's initialization by causing a spurious interrupt. This improper handling of interrupts before completion initialization can lead to a kernel panic, resulting in a Denial of Service (DoS) for the system. Red Hat severity: Moderate. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Medium [CVE-2026-64353] Keep dynamic inner array lookups nullable
In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replace the template. After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template max_entries even though the runtime helper uses the concrete inner map max_entries. Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP, because the template max_entries does not prove that the key is in bounds for the concrete runtime map. A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. When an inner map template is replaced by a concrete inner array with a different maximum entry size, the verifier may perform incorrect bounds checking. A local attacker could exploit this flaw by creating a specially crafted BPF program, potentially leading to out-of-bounds memory access. This could result in a denial of service or, in some cases, privilege escalation. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10.
Medium [CVE-2026-64339] bound bulk IN response length to the received transfer
In the Linux kernel, the following vulnerability has been resolved: usb: misc: usbio: bound bulk IN response length to the received transfer usbio_bulk_msg() copies bpkt_len = le16_to_cpu(bpkt->len) bytes out of the bulk IN buffer (usbio->rxbuf, allocated with size usbio->rxbuf_len) into the caller's buffer. bpkt_len is fully controlled by the device and is only checked against ibuf_len; ibuf_len in turn is checked against usbio->txbuf_len, not against rxbuf_len: if ((obuf_len > (usbio->txbuf_len - sizeof(*bpkt))) || (ibuf_len > (usbio->txbuf_len - sizeof(*bpkt)))) return -EMSGSIZE; txbuf_len and rxbuf_len are taken independently from the bulk OUT and bulk IN endpoint wMaxPacketSize in usbio_probe(). A malicious or malfunctioning device that advertises a large bulk OUT endpoint and a small bulk IN endpoint (e.g. by claiming one of the quirk-free IDs such as the Lattice NX33U, 0x2ac1:0x20cb) therefore makes ibuf_len, and hence the device-supplied bpkt_len, exceed rxbuf_len. memcpy() then reads up to txbuf_len - rxbuf_len bytes past the end of the rxbuf slab object. The over-read bytes are handed back to the i2c layer and on to user space through i2c-dev, disclosing adjacent slab memory; with KASAN this is reported as a slab-out-of-bounds read. The number of bytes actually received is already known: act equals the URB actual_length and is bounded by rxbuf_len.
Low [CVE-2026-66011] ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options
ImageMagick before 7.1.2-27 Memory Leak via Invalid CLI Options. Red Hat rates this low (CVSS 3.3).
Unknown [CVE-2026-64269] Bound RDMA-Write length to chunk size in rdma_write_sg
Bound RDMA-Write length to chunk size in rdma_write_sg. Red Hat rates this a security issue. Weakness: CWE-125.
Unknown [CVE-2026-64285] Pin source page for write when adding CPUID data for SNP guest
Pin source page for write when adding CPUID data for SNP guest. Red Hat rates this a security issue. Weakness: CWE-787.
Unknown [CVE-2026-64314] chacha20poly1305 - validate poly1305 template argument
chacha20poly1305 - validate poly1305 template argument. Red Hat rates this a security issue. Weakness: CWE-476.
Unknown [CVE-2026-64431] avoid calling post_write_mst_fixup for invalid index_block
avoid calling post_write_mst_fixup() for invalid index_block. Red Hat rates this a security issue. Weakness: CWE-787.
Unknown [CVE-2026-64349] fix dwc3_readl and dwc3_writel calls in dwc3_ulpi_setup
fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup(). Red Hat rates this a security issue. Weakness: CWE-843.
Unknown [CVE-2026-64437] fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL
fix use-after-free of a deferred file_lock on SMB2_CLOSE then SMB2_CANCEL. Red Hat rates this a security issue. Weakness: CWE-825.
Unknown [CVE-2026-64509] fix GenDisk cleanup paths
fix GenDisk cleanup paths. Red Hat rates this a security issue. Weakness: CWE-772.
Unknown [CVE-2026-64442] fix OOB reads in IE loops in issue_assocreq and join_cmd_hdl
fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl(). Red Hat rates this a security issue. Weakness: CWE-125.
Unknown [CVE-2026-64393] run set info with opener credentials
run set info with opener credentials. Red Hat rates this a security issue. Weakness: CWE-270.
Unknown [CVE-2026-64350] fix stream context array leak in cdnsp_alloc_stream_info
fix stream context array leak in cdnsp_alloc_stream_info(). Red Hat rates this a security issue. Weakness: CWE-772.