RHEL’s standard security errata cover Critical, Important and CVSS 7+ Moderate CVEs on active minor releases only

Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, and applies the policy only to active minor releases. RHEL 8, 9 and 10 have ten-year life cycles, and ELCP is now Red Hat’s unified extended support model.

Source facts

Red Hat’s RHEL life cycle page defines standard security errata as Critical, Important and Moderate CVEs with a CVSS score of 7 or higher, effective April 1, 2025, as defined by Red Hat, and says all errata are provided at Red Hat’s discretion. The security and bug fix maintenance policies apply only to current active minor releases, and Application Stream packages may have a shorter life cycle than a minor release.

RHEL 8, 9 and 10 deliver a ten-year life cycle across Full Support and Maintenance Support Phases, followed by an Extended Life Phase in which no bug fixes or security fixes are available. RHEL Standard provides a 6-month life cycle for each minor release, RHEL Premium a 2-year life cycle for eligible minor releases, and Extended Life Cycle Premium extends eligible minor releases to 6 years from general availability, with 9 years for the final minor release.

Red Hat says it has unified extended support under ELCP beginning with RHEL 9, replacing the separate EUS, Enhanced EUS and E4S offerings, and that ELCP replaces Extended Life Cycle Support beginning with RHEL 8.10 on 6/1/2029. Red Hat says future end dates are close approximations and subject to change.

Applicability

Use this for RHEL subscribers. Red Hat’s dates table and severity definitions are on its Customer Portal; check the current dates for each major and minor release, which Red Hat says may change.

DSE recommendation

DSE recommends keeping RHEL systems on an active minor release and reconciling scanner findings against Red Hat’s errata criteria rather than assuming every reported CVE will receive a fix. Track the minor release and subscription tier for each system, plan upgrades before a minor release leaves support, and document compensating controls for findings Red Hat does not plan to fix.

Verification

Each quarter, compare the fleet’s RHEL minor releases with Red Hat’s published dates, confirm errata are applying, and review open scanner findings against Red Hat’s CVE pages.

Official reference

Red Hat Customer Portal — Red Hat Enterprise Linux Life Cycle. Reviewed October 18, 2026.