linux has 6,957 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3451 in the last 90 days against 867 in the 90 before. The busiest recent month was September 2026 with 1985. The median CVSS is 7.8 (high), with 503 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 213 days (6 cases). The dominant weakness classes are CWE-416 (492) and CWE-476 (436). Most affected products: Linux (4606), linux_kernel (2349), kernel (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 213 d median(6)
- Last 90 days
- 3451 prev 867
Weakness classes
Products
- Linux 4606
- linux_kernel 2349
- kernel 1
- layer_2_tunneling_protocol 1
Worst active — by depth score
CVE-2025-39682Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…80CVE-2025-22037High· 7.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request80CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb79CVE-2023-3867Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request76CVE-2026-53266High· 8.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0)74
linux vulnerabilities
CVEs affecting linux, newest first. Open any entry for full detail, references, and exploit status.
6957 CVEsRSS
CVE-2026-99019Nonescsi: ch: Do not keep references to data transfer element devices
In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices ch_readconfig() looks up the scsi_device of every data transfer element whose SCSI id the changer rep…
CVE-2026-99013High· 7.8Bluetooth: ISO: Reject concurrent BIS listener setup
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup iso_sock_listen() drops the socket lock before calling iso_listen_bis() to preserve the hdev->lock ordering. Two c…
CVE-2026-99024Noneoptee: register TEE devices only once fully initialized
In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized optee_probe() called tee_device_register() on both the client and the supplicant device before the rest of stru…
CVE-2026-99022Noneregulator: ltc3676: don't read the write-only HRST and CLIRQ registers
In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST (0x1e) and CLIRQ (0x1f) are write-only command strobes. Writing HRST triggers a hard reset …
CVE-2026-99020Noneregulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as n_linear_ranges, but tps65224_bucks_2_…
CVE-2026-99026Nonenet: team: free skb when broadcast has no txable port
In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false witho…
CVE-2026-99025Noneopenvswitch: fix soft lockup in the netlink flow dump
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow d…
CVE-2026-99023Nonepower: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()
In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all() of_regulator_bulk_get_all() allocates the consumers array and hands it to the caller, wh…
CVE-2026-99031Nonenet: bridge: avoid recursive multicast port cleanup
In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_p…
CVE-2026-99028Nonenet: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop
In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs …
CVE-2026-99029Nonenet: sparx5: free the matchall entry on destroy
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for every offloaded matchall filter and adds it to sp…
CVE-2026-99027Nonenet: team: stop reusing skb after queue override
In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the qu…
CVE-2026-99035Nonemmc: mtk-sd: Cancel request timeout work on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues req_timeout while a request is active. msdc_request_done() uses cancel_delayed_work(), which does …
CVE-2026-99034Nonemmc: sdhci-sprd: disable runtime PM on remove
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhci_sprd_probe() enables runtime PM, while sdhci_sprd_remove() does not perform the corresponding runtime PM cleanup. …
CVE-2026-99033Nonenet/packet: guard the ll header push in packet_rcv_spkt()
In the Linux kernel, the following vulnerability has been resolved: net/packet: guard the ll header push in packet_rcv_spkt() packet_rcv_spkt() restores the link layer header with skb_push(skb, skb->data - skb_mac_header(skb)); That…
CVE-2026-99032High· 7.8net/smc: protect clcsock lifetime in smc_getname
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the C…
CVE-2026-99030High· 7.5net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits() When skb_copy_and_csum_bits() reaches unreadable frags it returns 0 after copying only the linear part…
CVE-2026-99040NoneKEYS: Fix add_key() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix add_key() race with keyring restriction __key_create_or_update() snapshots keyring->restrict_link before taking the destination keyring's semaphore. keyring…
CVE-2026-99038Nonememstick: rtsx_usb_ms: complete requests after eject instead of dropping them
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: complete requests after eject instead of dropping them memstick_check() can pass its host->removing check just before rtsx_usb_ms_drv_remove() s…
CVE-2026-99036Nonedm: fix reading free memory in do_resume
In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in do_resume When do_resume calls dm_table_get_mode(new_map), the call is done without holding any locks (it only holds a reference to the …
CVE-2026-99042High· 8.4io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
In the Linux kernel, the following vulnerability has been resolved: io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 io_connect_bpf_populate() fills connect.port and connect.v6_addr for AF_INET6 only when addr_len …
CVE-2026-99039Nonememstick: core: wait for request completion before freeing card
In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstick_alloc_card() and memstick_set_rw_addr(), wait_for_completion_timeout() is used to wait for …
CVE-2026-99037Nonedm-crypt: reject the lmk IV mode with AEAD ciphers
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcm(aes)-lmk" with the integr…
CVE-2026-99045Noneibmveth: h_free logical LAN on open-fail after register
In the Linux kernel, the following vulnerability has been resolved: ibmveth: h_free logical LAN on open-fail after register ibmveth_open() registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to out_free_…
CVE-2026-99043Noneice: fix metadata_dst refcount handling on representor teardown
In the Linux kernel, the following vulnerability has been resolved: ice: fix metadata_dst refcount handling on representor teardown ice_eswitch_release_repr() uses metadata_dst_free() to release the representor's metadata_dst. metadat…
CVE-2026-99048Nonegve: fix napi_disable deadlock when attempting to disable XSK pools
In the Linux kernel, the following vulnerability has been resolved: gve: fix napi_disable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napi_disable and napi_enable. However,…
CVE-2026-99044Noneice: fix use-after-free in dynamic port cleanup
In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup ice_dealloc_dynamic_port() uses dyn_port->vsi->idx to erase the dynamic port from pf->dyn_ports. However, it frees the …
CVE-2026-99041Noneip6_gre: remove obsolete ERSPAN PMTU update
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: remove obsolete ERSPAN PMTU update A tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan devi…
CVE-2026-99050High· 7.8gpio: mpsse: fix race when arming the IRQ poll worker
In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpio_mpsse_irq_enable() arms the poll worker before publishing it: schedule_work() runs before the worker is adde…
CVE-2026-99047Nonegve: fix XSK buffer leak when rings are stopped
In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which…