Red Hat patches dozens of Linux kernel flaws
CERT-FR advisory details numerous Linux kernel vulnerabilities in Red Hat Enterprise Linux allowing RCE, privilege escalation, and DoS; patches available.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-39964 and CVE-2026-53266 as exploited in the wild.
CERT-FR has published an advisory (CERTFR-2026-AVI-1230) consolidating over two dozen Red Hat security bulletins (RHSA-2026) issued between September 21-25, 2026, covering multiple vulnerabilities in the Linux kernel shipped across the full range of Red Hat Enterprise Linux (RHEL) product lines and architectures, including versions 6 through 10, Extended Update Support (EUS), Extended Life Cycle (ELS), Update Services for SAP Solutions, Real Time kernels, and CodeReady Linux Builder variants across x86_64, aarch64, s390x (IBM z Systems), and ppc64le (IBM Power) platforms.
The vulnerabilities span a broad range of impact categories: remote code execution, local privilege escalation, remote denial of service, data integrity and confidentiality breaches, and security policy bypass. No single CVE is singled out as actively exploited in the wild in this advisory, and the vendor does not specify exploitation status for several entries. The advisory references approximately 80 CVEs spanning identifiers from 2023 through 2026, reflecting the routine cumulative kernel patching cycle typical of RHEL point releases.
Defenders running RHEL or RHEL-derived distributions (including Real Time and SAP Solutions variants) across any supported architecture should prioritize applying the referenced RHSA errata according to their patch management cadence. Given the breadth of affected product lines, organizations should inventory which specific RHEL versions and kernel packages are deployed and cross-reference against the RHSA bulletins to determine applicability, then schedule kernel updates and reboots as per standard change management.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1230
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs