Red Hat Linux Security Advisories & CVEs
3067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-53260] Add preempt_{disable,enable}_nested in reqsk_queue_hash_req
In the Linux kernel, the following vulnerability has been resolved: tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req(). syzbot reported a weird reqsk->rsk_refcnt underflow in __inet_csk_reqsk_queue_drop(). The captured reqsk_put() in __inet_csk_reqsk_queue_drop() is called only when it successfully removes reqsk from ehash. Moreover, reqsk_timer_handler() calls another reqsk_put() after that. This indicates that the reqsk was missing both refcnts for ehash and the timer itself. Since all the syzbot reports had PREEMPT_RT enabled, the only possible scenario is that reqsk_queue_hash_req() is preempted after mod_timer() and before refcount_set(), and then the timer triggered after 1s aborts the reqsk due to its listener's close(). Let's wrap mod_timer() and refcount_set() with preempt_disable_nested() and preempt_enable_nested(). Note that inet_ehash_insert() holds the normal spin_lock() (mutex in PREEMPT_RT), so it must be called outside of preempt_disable_nested(), but this is fine. The lookup path just ignores 0 sk_refcnt entries in ehash and tries to create another reqsk, but this will fail at inet_ehash_insert(). [0]: refcount_t: underflow; use-after-free. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6.
High [CVE-2026-53259] insert aca into global hash under idev->lock
In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node. In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). This window opened once RTNL stopped serializing the join path against device teardown. Move ipv6_add_acaddr_hash() inside the idev->lock section so the ac_list and hash insertions are atomic with respect to teardown: a racing remover now either misses the aca entirely or finds it in both lists. acaddr_hash_lock is now nested under idev->lock, which is acquired in softirq context, so switch all acaddr_hash_lock sites to spin_lock_bh() to avoid the irq lock inversion reported in [2]. [1] [2] A flaw was found in the Linux kernel, specifically within its management of IPv6 anycast addresses. Affected product named by the advisory: Red Hat Enterprise Linux 10.
High [CVE-2026-53264] use RCU with deferred freeing for action lifecycle
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: use RCU with deferred freeing for action lifecycle When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() 0, mutex held 1: idr_remove(idr, index) tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 1 more.
High [CVE-2026-53270] clear the svc scheduler ptr early on edit
In the Linux kernel, the following vulnerability has been resolved: ipvs: clear the svc scheduler ptr early on edit ip_vs_edit_service() while unbinding the old scheduler clears the svc->scheduler ptr after the scheduler module initiates RCU callbacks. This can cause packets to use the old scheduler at the time when svc->sched_data is already freed after RCU grace period. Fix it by clearing the ptr early in ip_vs_unbind_scheduler(), before the done_service method schedules any RCU callbacks. Also, if the new scheduler fails to initialize when replacing the old scheduler, try to restore the old scheduler while still returning the error code. A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. During the `ip_vs_edit_service()` operation, the `svc->scheduler` pointer is cleared too late when unbinding an old scheduler. This improper handling allows packets to access previously freed scheduler data, leading to a use-after-free vulnerability. This can result in system instability or a denial of service. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6.
High [CVE-2026-53276] Fix a use-after-free of the hci_conn pointer
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix a use-after-free of the hci_conn pointer In iso_sock_rebind_bc(), the bis pointer is cached, then the socket lock is dropped: bis = iso_pi(sk)->conn->hcon; /* Release the socket before lookups since that requires hci_dev_lock * which shall not be acquired while holding sock_lock for proper * ordering. */ release_sock(sk); hci_dev_lock(bis->hdev); During the unlocked window, could a concurrent close() destroy the connection and free the bis structure, causing hci_dev_lock(bis->hdev) to access memory after it is freed, fix this by using the hdev reference which was safely acquired via iso_conn_get_hdev(). Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected Red Hat products: Red Hat Enterprise Linux 10. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-2050] Arbitrary code execution via heap-based buffer overflow in HDR file parsing
Arbitrary code execution via heap-based buffer overflow in HDR file parsing. Red Hat rates this important (CVSS 7.8). Weakness: CWE-131. Red Hat lists fixing advisory RHSA-2026:38485 with package gegl04-0:0.4.62-1.el9_8.1, gegl-0:0.2.0-40.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-11998] Arbitrary JavaScript execution due to Strict Contextual Escaping (SCE) bypass
Arbitrary JavaScript execution due to Strict Contextual Escaping (SCE) bypass. Red Hat rates this important (CVSS 7.6). Weakness: CWE-79.
High [CVE-2026-23879] Arbitrary file write via crafted symbolic links during archive extraction
Arbitrary file write via crafted symbolic links during archive extraction. Red Hat rates this important (CVSS 8). Weakness: CWE-22.
High [CVE-2026-13029] Use after free in Web Authentication
Use after free in Web Authentication. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825.
High [CVE-2026-13025] Insufficient validation of untrusted input in DevTools
Insufficient validation of untrusted input in DevTools. Red Hat rates this important (CVSS 8.3). Weakness: CWE-368.
High [CVE-2026-13026] Use after free in Digital Credentials
Use after free in Digital Credentials. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-13027] Use after free in FileSystem
Use after free in FileSystem. Red Hat rates this important (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-13038] Use after free in Autofill
Use after free in Autofill. Red Hat rates this critical (CVSS 8.8). Weakness: CWE-825.
High [CVE-2026-13033] Out of bounds read in Blink>InterestGroups
Out of bounds read in Blink>InterestGroups. Red Hat rates this critical (CVSS 8.8). Weakness: CWE-125.
High [CVE-2026-44017] Remote code execution via Zip Slip vulnerability in model download
Remote code execution via Zip Slip vulnerability in model download. Red Hat rates this important (CVSS 8.3). Weakness: CWE-22.
High [CVE-2026-44016] Remote code execution via malicious HTML in Playwright-based rendering
Remote code execution via malicious HTML in Playwright-based rendering. Red Hat rates this important (CVSS 8.2). Weakness: CWE-918.
High [CVE-2026-49851] Denial of Service via crafted Markdown input
Denial of Service via crafted Markdown input. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333.
High [CVE-2026-54297] Denial of Service via crafted nested query strings
Denial of Service via crafted nested query strings. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770.
High [CVE-2026-56121] Remote Code Execution via Unsafe Deserialization in gRPC Registry Server
Remote Code Execution via Unsafe Deserialization in gRPC Registry Server. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502.
High [CVE-2026-57281] Arbitrary code execution outside sandbox
Arbitrary code execution outside sandbox. Red Hat rates this important (CVSS 8.5). Weakness: CWE-917.