Red Hat patches multiple Linux kernel flaws
ANSSI advisory details numerous Red Hat Enterprise Linux kernel vulnerabilities enabling code execution, privilege escalation, and denial of service.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 30 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-53266 as exploited in the wild.
ANSSI (CERT-FR) issued advisory CERTFR-2026-AVI-0899 covering a large batch of vulnerabilities discovered in the Linux kernel as shipped by Red Hat across multiple product lines, including Red Hat Enterprise Linux (versions 8, 9, and 10) and CodeReady Linux Builder across ARM64, IBM z Systems, Power (ppc64le), and x86_64 architectures. The advisory aggregates over a dozen Red Hat Security Advisories (RHSAs) published between July 10 and July 17, 2026, and references approximately 30 CVEs affecting kernel components.
The vulnerabilities collectively enable a range of impacts including arbitrary code execution, privilege escalation, remote denial of service, data integrity and confidentiality breaches, and security policy bypass. No specific exploitation in the wild is mentioned in the advisory; it is a routine vendor patch notification. Red Hat has released fixes across all affected product editions, and administrators are directed to apply the corresponding RHSA patches referenced in the documentation.
Given the broad scope of affected Red Hat Enterprise Linux editions (spanning multiple architectures and long-term support variants including Extended Update Support and Extended Life Cycle), organizations running RHEL should prioritize patching per their asset criticality and exposure, particularly for systems exposed to untrusted local users or network-facing kernel-dependent services.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0899
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs