Linux has 6,957 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3460 in the last 90 days against 950 in the 90 before. The busiest recent month was September 2026 with 1985. The median CVSS is 7.8 (high), with 503 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 213 days (6 cases). The dominant weakness classes are CWE-416 (492) and CWE-476 (436). Most affected products: Linux (4606), linux_kernel (2349), kernel (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 213 d median(6)
- Last 90 days
- 3460 prev 950
Weakness classes
Products
- Linux 4606
- linux_kernel 2349
- kernel 1
- layer_2_tunneling_protocol 1
Worst active — by depth score
CVE-2025-39682Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…80CVE-2025-22037High· 7.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request80CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb79CVE-2023-3867Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request76CVE-2026-53266High· 8.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0)74
Linux vulnerabilities
CVEs affecting Linux, newest first. Open any entry for full detail, references, and exploit status.
6957 CVEsRSS
CVE-2026-99132Nonexfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf
In the Linux kernel, the following vulnerability has been resolved: xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf xfs_sync_sb_buf() holds sb/rtsb buffer locks across a synchronous xfs_trans_commit(), wh…
CVE-2026-99131Nonexfs: fix capability check in xfs
In the Linux kernel, the following vulnerability has been resolved: xfs: fix capability check in xfs An user reported a bug where he managed to evade group's quota by changing a file's gid to a different group id the same user belonged…
CVE-2026-99134Nonemac802154: fix data race and NULL deref on local->assoc_dev
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix data race and NULL deref on local->assoc_dev local->assoc_dev is shared between the association path and the association-response worker without common …
CVE-2026-99140Nonetracing: Fix hist trigger timestamps for buffered events
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix hist trigger timestamps for buffered events Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_e…
CVE-2026-99135Nonedm-integrity: fix infinite loop on discard with large tag size
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix infinite loop on discard with large tag size When integrity_metadata handles a discard, it fills a buffer with DISCARD_FILLER and writes it over the …
CVE-2026-99137Nonecifs: don't update i_size in cifs_do_truncate without a cached handle
In the Linux kernel, the following vulnerability has been resolved: cifs: don't update i_size in cifs_do_truncate without a cached handle If find_writable_file() returns null, cifs_file_flush will return 0 without issuing set_file_size…
CVE-2026-99136Nonedm-crypt: fix a tiny race condition in crypt_dec_pending
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: fix a tiny race condition in crypt_dec_pending crypt_dec_pending reads io->error before calling atomic_dec_and_test. Another context, for example crypt_endio…
CVE-2026-99138Nonetcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_l…
CVE-2026-99133Nonenet/iucv: fix the recvmsg window update
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without testing the transport, so on a classic z/VM socket iuc…
CVE-2026-99139Nonetcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fc…
CVE-2026-99142Nonetracing: Check operator stack capacity before pushing
In the Linux kernel, the following vulnerability has been resolved: tracing: Check operator stack capacity before pushing predicate_parse() uses the first operator stack entry before processing any opening parentheses. A push then incr…
CVE-2026-99141Nonetracing: Fix crash in print_graph_function_event()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix crash in print_graph_function_event() tracing_set_tracer() assigns the flags of the newly selected tracer with: tr->current_trace_flags = t->flags ? : t…
CVE-2026-99148Nonedrm/amdgpu: keep the eviction fence until the last handle is closed
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: keep the eviction fence until the last handle is closed amdgpu_gem_object_close() detaches the user queue eviction fence from the BO before it checks bo_va…
CVE-2026-99143Nonetracing: Keep the predicate limit separate from program capacity
In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the predicate limit separate from program capacity predicate_parse() adds two to nr_preds to reserve the terminal TRUE and FALSE entries. It also uses th…
CVE-2026-99145Nonedrm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Don't transfer shrinker pages for pinned bos on purgeable state change Pinned bos have their pages removed from the shrinker's shrinkable / purgeable counts on…
CVE-2026-99144Nonesched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix use-after-free of a destroyed user DSQ by a deferred reenqueue A deferred reenqueue can read a freed user DSQ. The request stays on its CPU's deferred l…
CVE-2026-99150Nonedrm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr amdgpu_debugfs_gpr_read() drops its runtime PM reference right after reading the wave registers. Wh…
CVE-2026-99151Nonedrm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions allocate_usb4_bandwidth_for_stream() and allocate_usb4_bandwidth() both use ASSERT(stream->sink)…
CVE-2026-99157Nonescsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies
In the Linux kernel, the following vulnerability has been resolved: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies bsg-lib allocates a 96-byte (SCSI_SENSE_BUFFERSIZE) reply buffer per job, but struct ufs_rpmb_r…
CVE-2026-99147Nonedrm/exec: don't immediately add prelocked obj to array of locked objs
In the Linux kernel, the following vulnerability has been resolved: drm/exec: don't immediately add prelocked obj to array of locked objs When a contention is detected the drm_exec object grabs a reference to the contended object, unlo…
CVE-2026-99146Nonedrm/i915/dmc: Add sanity check for DMC load address
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Add sanity check for DMC load address For DMC firmware header version 3, the firmware load address is stored in dmc_info->start_mmioaddr and later used b…
CVE-2026-99159Nonering-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx()
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() On a persistent ring buffer, rb_meta_subbuf_idx() can return an index one sub-buffer too high. rb_s…
CVE-2026-99149Nonedrm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix GEM object leak on ENOMEM in userptr ioctl When amdgpu_hmm_range_alloc() fails amdgpu_gem_userptr_ioctl() returns -ENOMEM right away and skips the clea…
CVE-2026-99152Nonescsi: libiscsi: Validate the task named by a management response
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the task named by a management response __iscsi_complete_pdu() fetches the task for five response types from one place and checks only that th…
CVE-2026-99154Nonescsi: libiscsi: Reject a negative task index from parse_pdu_itt
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Reject a negative task index from parse_pdu_itt A transport that implements parse_pdu_itt hands libiscsi an index taken from the PDU, and both lookups …
CVE-2026-99153Nonescsi: libiscsi: Validate the ITT reflected in a Reject PDU
In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Validate the ITT reflected in a Reject PDU A Reject PDU carries a copy of the header it rejects, and iscsi_handle_reject() takes the ITT out of that co…
CVE-2026-99160Nonering-buffer: Do not show buffer_meta for CPUs without a buffer
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not show buffer_meta for CPUs without a buffer The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only …
CVE-2026-99165Nonesctp: revalidate output stream after association connect wait
In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building …
CVE-2026-99155Nonescsi: xen/scsifront: Check for a NULL shadow entry on a backend response
In the Linux kernel, the following vulnerability has been resolved: scsi: xen/scsifront: Check for a NULL shadow entry on a backend response scsifront_do_response() validates the rqid in a backend response against VSCSIIF_MAX_REQS befo…
CVE-2026-99156Nonescsi: st: Fix use-after-free race between st_remove() and st_open()
In the Linux kernel, the following vulnerability has been resolved: scsi: st: Fix use-after-free race between st_remove() and st_open() st_remove() drops the probe reference on the scsi_tape with kref_put() and only afterwards removes …