End of life since 30 June 2024
CentOS 7 end of life
CentOS 7 reached end of life on 30 June 2024. The CentOS Project publishes no more updates. Its packages stay at the versions below: the kernel, OpenSSH, OpenSSL, glibc, sudo and the rest. We backport security fixes to them, so the server keeps running while you plan the move.
- 15exploited vulnerabilities in its components
- 188critical
- 28months past end of life
What CentOS 7 still runs
| Component | Version | Package | Known CVEs |
|---|---|---|---|
| Linux kernel | 3.10 | 3.10.0-1160.el7 | 4,401 |
| glibc | 2.17 | 2.17-326.el7_9.3 | |
| OpenSSL | 1.0.2k | 1.0.2k-26.el7_9 | 48 |
| OpenSSH | 7.4p1 | 7.4p1-23.el7_9 | 41 |
| sudo | 1.8.23 | 1.8.23-10.el7_9.3 | |
| bash | 4.2.46 | 4.2.46-35.el7_9 | |
| curl | 7.29.0 | 7.29.0-59.el7_9.2 | |
| polkit | 0.112 | 0.112-26.el7_9.1 | |
| systemd | 219 | 219-78.el7_9.9 | |
| PHP | 5.4.16 | 5.4.16-48.el7 | 224 |
| Python 2 | 2.7.5 | 2.7.5-94.el7_9 | |
| Python 3 | 3.6.8 | 3.6.8-21.el7_9 | |
| Apache httpd | 2.4.6 | 2.4.6-99.el7.centos.1 | |
| MariaDB | 5.5.68 | 5.5.68-1.el7 | |
| PostgreSQL | 9.2.24 | 9.2.24-9.el7_9 | |
| OpenJDK | 1.8.0.412.b08 | 1.8.0.412.b08-1.el7_9 |
Latest versions in the distribution's public repositories, 28 October 2026. RHEL 7 and Oracle Linux 7 ship the same package versions as CentOS 7. Known CVEs: for the upstream version, from the US National Vulnerability Database. Distribution packages include fixes backported before end of life, so not every one of them applies; your assessment shows which risks are real.
Exploited vulnerabilities in CentOS 7's components
Vulnerabilities in the upstream versions of CentOS 7's kernel, OpenSSH, OpenSSL and PHP that are listed in the CISA catalogue of known exploited vulnerabilities, highest score first. CentOS 7 packages may include fixes made before end of life.
| CVE | Component | Score | Severity | Published | Description |
|---|---|---|---|---|---|
| CVE-2021-22555 Exploited | Linux kernel | 8.3 | High | 2021-07-07 | A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space |
| CVE-2026-109619 Exploited | PHP | 8.1 | High | 2026-10-21 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2014-3153 Exploited | Linux kernel | 7.8 | High | 2014-06-07 | The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. |
| CVE-2017-1000253 Exploited | Linux kernel | 7.8 | High | 2017-10-05 | Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on April 14, 2015). This kernel vulnerability was fixed in April 2015 by commit a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (backported to Linux 3.10.77 in May 2015), but it was not recognized as a security threat. With CONFIG_ARCH_BINFMT_ELF_RANDOMIZE_PIE enabled, and a normal top-down address allocation strategy, load_elf_binary() will attempt to map a PIE binary into an address range immediately below mm->mmap_base. Unfortunately, load_elf_ binary() does not take account of the need to allocate sufficient space for the entire binary which means that, while the first PT_LOAD segment is mapped below mm->mmap_base, the subsequent PT_LOAD segment(s) end up being mapped above mm->mmap_base into the are that is supposed to be the "gap" between the stack and the binary. |
| CVE-2018-14634 Exploited | Linux kernel | 7.8 | High | 2018-09-25 | An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable. |
| CVE-2022-0492 Exploited | Linux kernel | 7.8 | High | 2022-03-03 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly. |
| CVE-2024-53104 Exploited | Linux kernel | 7.8 | High | 2024-12-02 | In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format This can lead to out of bounds writes since frames of this type were not taken into account when calculating the size of the frames buffer in uvc_parse_streaming. |
| CVE-2024-53197 Exploited | Linux kernel | 7.8 | High | 2024-12-27 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configuration for allocating dev->config. This can lead to out-of-bounds accesses later, e.g. in usb_destroy_configuration. |
| CVE-2025-38352 Exploited | Linux kernel | 7.8 | High | 2025-07-22 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. |
| CVE-2025-39964 Exploited | Linux kernel | 7.8 | High | 2025-10-13 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. |
| CVE-2026-46300 Exploited | Linux kernel | 7.8 | High | 2026-05-23 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. |
| CVE-2024-53150 Exploited | Linux kernel | 7.1 | High | 2024-12-24 | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. |
| CVE-2016-5195 Exploited | Linux kernel | 7.0 | High | 2016-11-10 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW." |
| CVE-2021-0920 Exploited | Linux kernel | 6.4 | Medium | 2021-12-15 | In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel |
| CVE-2014-0196 Exploited | Linux kernel | 5.5 | Medium | 2014-05-07 | The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings. |
What you can do
Keep CentOS 7, patched
We backport the security fixes to the CentOS 7 packages you run: the kernel, OpenSSH, OpenSSL, glibc and the rest, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to AlmaLinux, Rocky Linux or RHEL 9, once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.