Oracle Linux
38 CVEs tracked. 1 of them are in CISA KEV.
This hub aggregates every CVE we track for Oracle Linux, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Oracle Linux CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 1 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 2 |
| 2026-06 | 1 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 38 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical3
- High18
- Medium16
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Oracle Linux.
- CVE-2026-46243smb: client: reject userspace cifs.spnego descriptions7.1
- CVE-2026-35233An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to -- or instruments -- that process (v...4.4
- CVE-2026-21996An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in Pbuild_file_symtab()3.3
- CVE-2026-21991A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.5.5
- CVE-2022-21505In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is disabled or unavailable. IMA prevents se...6.7
- CVE-2024-27397netfilter: nf_tables: use timestamp to check for set element timeout7.8
- CVE-2024-26808netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain7.8
- CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid(). This allows the process to perform privileged operations despite presumably having dropped ...7.3
- CVE-2024-21891Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-defined implementations leading to filesystem permission m...8.8
- CVE-2023-5679Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution7.5
- CVE-2023-22024In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with CAP_NET_AD...5.5
- CVE-2023-39976log_blackbox.c in libqb before 2.0.8 allows a buffer overflow via long log messages because the header size is not considered.9.8
- CVE-2023-3446Excessive time spent checking DH keys and parameters5.3
- CVE-2022-28289Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 91.7. Some of these bugs sh...8.8
- CVE-2022-21385A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N...6.2
Product grouping is registry-driven, with AI assist and human review. How it works