Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.
\nRed Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release.
\nRHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release.
\nRed Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change.
\nUse this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change.
\nDSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix.
\nEach quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages.
\nRed Hat Customer Portal — Red Hat Enterprise Linux Life Cycle. Reviewed October 18, 2026.
", "content_text": "Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.\nSource facts\nRed Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release.\nRHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release.\nRed Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change.\nApplicability\nUse this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change.\nDSE recommendation\nDSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix.\nVerification\nEach quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages.\nOfficial reference\nRed Hat Customer Portal — Red Hat Enterprise Linux Life Cycle. Reviewed October 18, 2026.", "content_markdown": "Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.\n\n## Source facts\n\nRed Hat’s [RHEL life cycle page](https://access.redhat.com/support/policy/updates/errata) defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release.\n\nRHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release.\n\nRed Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change.\n\n## Applicability\n\nUse this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change.\n\n## DSE recommendation\n\nDSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix.\n\n## Verification\n\nEach quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages.\n\n## Official reference\n\n[Red Hat Customer Portal — Red Hat Enterprise Linux Life Cycle](https://access.redhat.com/support/policy/updates/errata). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/", "url": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only", "item": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/#article", "identifier": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/", "url": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/", "headline": "RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only", "description": "Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective…", "abstract": "Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.", "articleBody": "Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.\nSource facts\nRed Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release.\nRHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release.\nRed Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change.\nApplicability\nUse this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change.\nDSE recommendation\nDSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix.\nVerification\nEach quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages.\nOfficial reference\nRed Hat Customer Portal — Red Hat Enterprise Linux Life Cycle. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:23+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/rhel-errata-policy-moderate-cvss-7-active-minor-releases-elcp/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 387, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Red Hat Customer Portal — Red Hat Enterprise Linux Life Cycle", "url": "https://access.redhat.com/support/policy/updates/errata" } } ] } }