Linux has 8,801 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3618 in the last 90 days against 1301 in the 90 before. The busiest recent month was September 2026 with 2014. The median CVSS is 7.8 (high), with 520 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 158 days (7 cases). The dominant weakness classes are CWE-416 (496) and CWE-476 (444). Most affected products: Linux (6450), linux_kernel (2349), kernel (1).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 158 d median(7)
Last 90 days: 3618 prev 1301

Weakness classes

Products

Linux 6450
linux_kernel 2349
kernel 1
layer_2_tunneling_protocol 1

Follow Linux:RSS feed Save a search →Embed badge ↗

8801

Total CVEs

520

Critical

CISA KEV

Exploited

Worst active — by depth score

Linux vulnerabilities

CVEs affecting Linux, newest first. Open any entry for full detail, references, and exploit status.

8801 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Linux vulnerabilities

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emu…

btrfs: do not trim a device which is not writeable

KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode

In the Linux kernel, the following vulnerability has been resolved: crypto: amlogic - avoid double cleanup in meson_crypto_probe() When meson_allocate_chanlist() fails after a partial allocation, it already unwinds the allocated chanli…

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "*num_sgs" variable is a u32 so "ERR_PTR(*num_sgs)" doesn't work. We would have to do something similar to the …

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: drain bus_reset work on device removal brcmf_fw_crashed() and the debugfs "reset" entry both schedule drvr->bus_reset, whose callback recovers drvr thr…

mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n

wifi: p54: validate RX frame length in p54_rx_eeprom_readback()

ipv4: fib: free fib_alias with kfree_rcu() on insert error path

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the devic…

In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nh_res_bucket_migrate() nh_res_bucket_migrate() passes an uninitialized netlink_ext_ack to call_nexthop_res_bucket_notifiers()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrit…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211_vif_update_links() adds new links it allocates a link container for each and calls ieee8021…

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix fils_discovery double free on alloc failure ieee80211_set_fils_discovery() calls kfree_rcu() on the old template before allocating the replacement.…

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, __load_free_space_cache() takes num_entries and num_bitmaps straight fr…

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Hide shadow VMCS right after VMCLEAR free_nested() frees the shadow VMCS while vmcs01 still points to it

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root *after* making MMU pages available Check for a "stale" page fault, i.e

s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

s390/pkey: Check length in pkey_pckmo handler implementation

perf/core: Detach event groups during remove_on_exec

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sy…

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

net: psample: fix info leak in PSAMPLE_ATTR_DATA

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

tipc: fix use-after-free of the discoverer in tipc_disc_rcv()

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2_aead_req_alloc() The "num_sgs" variable is a u32 so "ERR_PTR(num_sgs)" doesn't work. We would have to do something similar to the …

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Check for invalid/obsolete root after making MMU pages available Check for a "stale" page fault, i.e