linux has 8,801 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3618 in the last 90 days against 1308 in the 90 before. The busiest recent month was September 2026 with 2014. The median CVSS is 7.8 (high), with 520 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 158 days (7 cases). The dominant weakness classes are CWE-416 (496) and CWE-476 (444). Most affected products: Linux (6450), linux_kernel (2349), kernel (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 158 d median(7)
- Last 90 days
- 3618 prev 1308
Weakness classes
Products
- Linux 6450
- linux_kernel 2349
- kernel 1
- layer_2_tunneling_protocol 1
Worst active — by depth score
CVE-2025-39682Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…80CVE-2025-22037High· 7.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request80CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb79CVE-2023-3867Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request76CVE-2026-53266High· 8.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0)74
linux vulnerabilities
CVEs affecting linux, newest first. Open any entry for full detail, references, and exploit status.
8801 CVEsRSS
CVE-2026-68451High· 7.8s390/zcrypt: Validate length for CCA ECC private key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in …
CVE-2026-68454High· 8.8KVM: s390: pci: Fix handling of AIF enable without AISB
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix handling of AIF enable without AISB When a guest seeks to register IRQs without a summary bit specified, ensure that the associated GAITE then stor…
CVE-2026-68452High· 7.8s390/zcrypt: Validate length for CCA AES cipher key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field i…
CVE-2026-68430Nonedrm/amdgpu/gfx8: drop unecessary BUG_ON()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx8: drop unecessary BUG_ON() There's no need to crash the kernel for this case. (cherry picked from commit 4d7c25208ca612b754f3bf39e9f16e725b828891)
CVE-2026-68429Nonedrm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe()
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Handle torn-down topology gracefully in drm_dp_mst_topology_queue_probe() A hotplug or link-loss event can tear down the MST topology (setting mgr->mst_sta…
CVE-2026-68450Nonebtrfs: free mapping node on duplicate reloc root insert
In the Linux kernel, the following vulnerability has been resolved: btrfs: free mapping node on duplicate reloc root insert __add_reloc_root() allocates a mapping_node before inserting it into rc->reloc_root_tree. If rb_simple_insert(…
CVE-2026-68444Nonefirmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get()
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix NULL dereference in ffa_partition_info_get() ffa_partition_info_get() passes uuid_str directly to uuid_parse() without a NULL check. When a call…
CVE-2026-68445High· 7.8drm/vc4: Prevent shader BO mappings from becoming writable
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Prevent shader BO mappings from becoming writable vc4_gem_object_mmap() rejects a writable mapping of a validated shader BO, but leaves VM_MAYWRITE set. User…
CVE-2026-68449Noneata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning
In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: fix infinite loop in NCQ tag completion bit-scanning The hand-rolled bit-scanning loop in the NCQ completion path has an infinite loop bug. When …
CVE-2026-68435NoneLoongArch: Fix address space mismatch in kexec command line lookup
In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix address space mismatch in kexec command line lookup When searching the loaded segments for the "kexec" command line marker, the kexec_load(2) path (file…
CVE-2026-68448High· 7.0ovl: check access to copy_file_range source with src mounter creds
In the Linux kernel, the following vulnerability has been resolved: ovl: check access to copy_file_range source with src mounter creds Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that …
CVE-2026-68446High· 7.8drm/vmwgfx: Validate vmw_surface_metadata::array_size
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate vmw_surface_metadata::array_size This field comes from userspace and should be validated against specific limits depending on which Shader Model (…
CVE-2026-68442High· 7.8btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't propagate EXTENT_FLAG_LOGGING to split extent maps When btrfs_drop_extent_map_range() splits an extent map, the new split maps inherit the original map's …
CVE-2026-68447High· 7.1drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without boun…
CVE-2026-68433High· 8.6libceph: bound get_version reply decode to front len
In the Linux kernel, the following vulnerability has been resolved: libceph: bound get_version reply decode to front len handle_get_version_reply() uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. That is th…
CVE-2026-68436NoneIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the …
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: use kvzalloc to allocate struct dc struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the …
CVE-2026-68441NoneIn the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling b…
In the Linux kernel, the following vulnerability has been resolved: net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling b…
CVE-2026-68434NoneIn the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replace…
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_mid: Fix NULL function pointer dereference on DNV/ICX-D/SNR platforms Commit b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms") replace…
CVE-2026-68217Nonemedia: pwc: Drain fill_buf on start_streaming() failure
In the Linux kernel, the following vulnerability has been resolved: media: pwc: Drain fill_buf on start_streaming() failure pwc_isoc_init() submits its isochronous URBs with usb_submit_urb(.., GFP_KERNEL) in a loop. After the first URB…
CVE-2026-68214Nonemedia: rtl2832: fix use-after-free in rtl2832_remove()
In the Linux kernel, the following vulnerability has been resolved: media: rtl2832: fix use-after-free in rtl2832_remove() cancel_delayed_work_sync() is called before i2c_mux_del_adapters() in rtl2832_remove(). While the cancel waits f…
CVE-2026-68248Nonedrm/i915: Return NULL on error in active_instance
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Return NULL on error in active_instance Avoid returning &node->base when node is NULL due to OOM during GFP_ATOMIC allocation. Discovered using AI-assisted …
CVE-2026-68226Nonemedia: cx23885: add ioremap return check and cleanup
In the Linux kernel, the following vulnerability has been resolved: media: cx23885: add ioremap return check and cleanup Add a check for the return value of pci_ioremap_bar() in cx23885_dev_setup(). If ioremap for BAR0 fails, release t…
CVE-2026-68218Nonemedia: pci: dm1105: Free allocated workqueue
In the Linux kernel, the following vulnerability has been resolved: media: pci: dm1105: Free allocated workqueue Destroy allocated workqueue in remove() callback to free its resources, thus fixing memory leak.
CVE-2026-68243Nonedrm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU Setting context engine slot N into I915_ENGINE_CLASS_INVALID / I915_ENGINE_CLASS_INVALID_NONE and attempting to…
CVE-2026-68227Nonemedia: cx231xx: fix devres lifetime
In the Linux kernel, the following vulnerability has been resolved: media: cx231xx: fix devres lifetime USB drivers bind to USB interfaces and any device managed resources should have their lifetime tied to the interface rather than pa…
CVE-2026-68244Nonedrm/i915/gem: Do not leak siblings[] on proto context error
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Do not leak siblings[] on proto context error After a successful BALANCE/PARALLEL_SUBMIT extension on context creation, error during processing of next u…
CVE-2026-68234Nonedrm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix bo->pin leaking in amdgpu_bo_create_reserved amdgpu_bo_create_reserved() only allocates a new BO when *bo_ptr (struct amdgpu_bo **bo_ptr as input param…
CVE-2026-68250Nonedrm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793d…
CVE-2026-68249Nonedrm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd…
CVE-2026-68301Nonenet: hsr: fix memory leak on slave unregistration by removing synced VLANs
In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which prop…