Linux has 8,801 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3603 in the last 90 days against 1316 in the 90 before. The busiest recent month was September 2026 with 2014. The median CVSS is 7.8 (high), with 520 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 158 days (7 cases). The dominant weakness classes are CWE-416 (496) and CWE-476 (444). Most affected products: Linux (6450), linux_kernel (2349), kernel (1).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 158 d median(7)
Last 90 days: 3603 prev 1316

Weakness classes

Products

Linux 6450
linux_kernel 2349
kernel 1
layer_2_tunneling_protocol 1

Follow Linux:RSS feed Save a search →Embed badge ↗

8801

Total CVEs

520

Critical

CISA KEV

Exploited

Worst active — by depth score

Linux vulnerabilities

CVEs affecting Linux, newest first. Open any entry for full detail, references, and exploit status.

8801 CVEsRSS

CVEs per month

Weakness classes

Products

Worst active — by depth score

Linux vulnerabilities

In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate() Triggers which have trigger specific sysfs attributes typically store related data in trigger-da…

In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct

In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/pr…

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation…

In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle p…

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e

In the Linux kernel, the following vulnerability has been resolved: kobject_uevent: Fix OOB access within zap_modalias_env() zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if v…

In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbag…

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as des…

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should hav…

In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net poin…

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up wi…

In the Linux kernel, the following vulnerability has been resolved: net: mediatek: Fix potential NULL pointer dereference in dummy net_device handling Move the freeing of the dummy net_device from mtk_free_dev() to mtk_remove(). Previ…

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual s…

mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray

bpf: Fail bpf_timer_cancel when callback is being cancelled

mm/shmem: disable PMD-sized page cache if needed

s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings

s390/pkey: Wipe copies of clear-key structures on failure

leds: an30259a: Use devm_mutex_init() for mutex initialization

media: mediatek: vcodec: Only free buffer VA that is not NULL

drm/amdgpu: fix double free err_addr pointer warnings

s390/pkey: Wipe copies of protected- and secure-keys

ice: Don't process extts if PTP is disabled

gve: Account for stopped queues when reading NIC stats

ice: Fix improper extts handling

In the Linux kernel, the following vulnerability has been resolved: tcp_metrics: validate source addr length I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry …

In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that…

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sc…

In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]