Known vulnerabilities in Red Hat Enterprise Linux 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-13676	fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs	7.5 High	Jun 29, 2026
CVE-2026-54371	attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that…	8.4 High	Jun 29, 2026
CVE-2026-54369	acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions…	8.4 High	Jun 29, 2026
CVE-2026-13601	Yelp: yelp-xsl: overly permissive content security policy in yelp allows host file disclosure from flatpak applications	7.1 High	Jun 29, 2026
CVE-2026-13595	Util-linux: util-linux: heap use-after-free in libblkid nested partition probing	6.8 Medium	Jun 29, 2026
CVE-2026-57966	Spice-vdagent: path traversal in file transfer via unsanitized filename	4.4 Medium	Jun 29, 2026
CVE-2026-57965	Spice-vdagent: integer overflow in udscs_write() leading to heap buffer overflow	5.1 Medium	Jun 29, 2026
CVE-2026-53322	In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Clean up DMABUFs before disabling function…	8.8 High	Jun 26, 2026
CVE-2026-53281	In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or…	8.8 High	Jun 26, 2026
CVE-2026-48933	A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of…	7.5 High	Jun 26, 2026
CVE-2026-48618	A flaw in Node.js TLS hostname handling can cause Node.js unicode dot separator handling can lead to tls…	7.7 High	Jun 26, 2026
CVE-2026-53277	In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table…	8.8 High	Jun 25, 2026
CVE-2026-53203	In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Add buffer overflow check in MS…	7.1 High	Jun 25, 2026
CVE-2026-53202	In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix signed integer truncation in IPC…	7.8 High	Jun 25, 2026
CVE-2026-53196	USB: serial: io_ti: fix heap overflow in get_manuf_info()	6.8 Medium	Jun 25, 2026
CVE-2026-53194	In the Linux kernel, the following vulnerability has been resolved: USB: serial: kl5kusb105: fix bulk-out buffer…	7.8 High	Jun 25, 2026
CVE-2026-53185	In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in…	7.8 High	Jun 25, 2026
CVE-2026-53175	In the Linux kernel, the following vulnerability has been resolved: inet: frags: fix use-after-free caused by the…	9.8 Critical	Jun 25, 2026
CVE-2026-53176	In the Linux kernel, the following vulnerability has been resolved: IB/isert: Reject login PDUs shorter than…	9.8 Critical	Jun 25, 2026
CVE-2026-53153	In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on…	7.8 High	Jun 25, 2026
CVE-2026-53148	thunderbolt: Clamp XDomain response data copy to allocation size	7.0 High	Jun 25, 2026
CVE-2026-53145	In the Linux kernel, the following vulnerability has been resolved: drm/gem: Try to fix change_handle ioctl, attempt 4…	7.8 High	Jun 25, 2026
CVE-2026-53143	drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11	7.0 High	Jun 25, 2026
CVE-2026-2050	GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability	7.8 High	Jun 24, 2026
CVE-2026-11998	A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs…	7.6 High	Jun 24, 2026

Other Red Hat products