# Red Hat patches scores of Linux kernel flaws

Published: 2026-11-13 · Severity: severe
Canonical: https://vorant.io/reports/e5827e61-133e-5742-a9ba-f3be69c9de8d/red-hat-patches-scores-of-linux-kernel-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory covers over 150 Linux kernel vulnerabilities in Red Hat Enterprise Linux and OpenShift, including RCE and privilege escalation; patches available via Red Hat errata.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1536

## What to check

- Applies to: The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-111497 as exploited in the wild.

CERT-FR has issued an advisory consolidating more than 150 CVEs affecting the Linux kernel as shipped in Red Hat Enterprise Linux 9.4/9.6 (all architectures: x86_64, aarch64, s390x, ppc64le) and multiple versions of Red Hat OpenShift Container Platform (4.12 through 5.0) across all supported architectures. The vulnerabilities span a wide range of impact categories: remote code execution, local privilege escalation, remote denial of service, information disclosure, data integrity compromise, security policy bypass, SSRF and CSRF-style request forgery. No single root cause or component is described in the advisory; this is a bundled set of kernel-level fixes collected across twelve separate Red Hat Security Advisories (RHSA) issued between 6 and 11 November 2026.

No evidence of active in-the-wild exploitation is noted in the advisory itself; this is a standard vendor patch rollup referenced by the national CERT. Given the scale of affected systems — spanning RHEL server builds, SAP update channels, Extended Update/Life Cycle streams, and OpenShift clusters across multiple hardware architectures — the practical risk to any individual organization depends on which kernel packages and OpenShift versions are deployed and whether local/network attacker access is feasible.

Defenders running affected RHEL or OpenShift versions should apply the referenced RHSA updates as soon as operationally feasible, prioritizing those addressing remote code execution and privilege escalation. Given the number of advisories and interdependent erratum packages, coordinate kernel updates with maintenance windows, especially for OpenShift node reboots.

## Mentioned in this report

- Vulnerabilities: CVE-2025-22063, CVE-2025-31936, CVE-2025-38004, CVE-2025-38147, CVE-2025-47273, CVE-2026-103111, CVE-2026-111497 (KEV), CVE-2026-114406, CVE-2026-12080, CVE-2026-14456, CVE-2026-16313, CVE-2026-18798, CVE-2026-19630, CVE-2026-26007, CVE-2026-28390, CVE-2026-34182, CVE-2026-42011, CVE-2026-42013, CVE-2026-43114, CVE-2026-43206, CVE-2026-43332, CVE-2026-45445, CVE-2026-45447, CVE-2026-45878, CVE-2026-46259, CVE-2026-50252, CVE-2026-52912, CVE-2026-52929, CVE-2026-53136, CVE-2026-53143, CVE-2026-53176, CVE-2026-53254, CVE-2026-53264, CVE-2026-53329, CVE-2026-53356, CVE-2026-53365, CVE-2026-53374, CVE-2026-55653, CVE-2026-59995, CVE-2026-59999

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1536

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e5827e61-133e-5742-a9ba-f3be69c9de8d/red-hat-patches-scores-of-linux-kernel-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup