Linux has 7,142 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3448 in the last 90 days against 811 in the 90 before. The busiest recent month was September 2026 with 1985. The median CVSS is 7.8 (high), with 513 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 213 days (6 cases). The dominant weakness classes are CWE-416 (492) and CWE-476 (436). Most affected products: Linux (4791), linux_kernel (2349), kernel (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 213 d median(6)
- Last 90 days
- 3448 prev 811
Weakness classes
Products
- Linux 4791
- linux_kernel 2349
- kernel 1
- layer_2_tunneling_protocol 1
Worst active — by depth score
CVE-2025-39682Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…80CVE-2025-22037High· 7.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request80CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb79CVE-2023-3867Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request76CVE-2026-53266High· 8.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0)74
linux vulnerabilities
CVEs affecting linux, newest first. Open any entry for full detail, references, and exploit status.
7142 CVEsRSS
CVE-2026-98477Medium· 5.5perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmu_ctx passed to pmu->sched_task() perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, and cpc->task_epc is only non-NULL while a ta…
CVE-2026-98486Nonenet: ena: fix MMIO read buffer leak on probe failure
In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a…
CVE-2026-98488Nonenet: atl1e: fix soft lockup on out-of-range hw_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-rang…
CVE-2026-98484Low· 3.4netfilter: nf_tables: skip expired catchall elements on insert and delete
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete nft_setelem_catchall_insert() looks up duplicates with nft_set_elem_active() only, while nft_…
CVE-2026-98494Nonenet: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read
In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read Same issue as atl1c (see the first commit in this series, "net: atl1c: fix soft lockup on out-of-…
CVE-2026-98493Nonenet: ipconfig: bound DHCP option construction
In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction ic_dhcp_init_options() appends the hostname (option 12), vendor-class (option 60) and client-ID (option 61) options into …
CVE-2026-98496Nonenet: airoha: npu: cancel wdt_work after releasing the WDT IRQ
In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdt_work after releasing the WDT IRQ airoha_npu_remove() calls cancel_work_sync() on each core's wdt_work, but the watchdog IRQ that queues it…
CVE-2026-98489Nonenet: atl1c: fix soft lockup on out-of-range tpd_cons read
In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpd_cons read The hardware can report an out-of-range tpd_cons (seen as 0xffff) while the PCIe link/MAC is resetting. An ou…
CVE-2026-98505Nonemm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold() damon_hugetlb_mkold() reads the page table entry into a local variable, unsets the accessed bi…
CVE-2026-98500NoneHID: hid-oxp: use cancel_delayed_work_sync() in remove
In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use cancel_delayed_work_sync() in remove oxp_hid_remove() uses cancel_delayed_work() for all three delayed work items. cancel_delayed_work() only dequeu…
CVE-2026-98495Nonenet: arp: terminate device name before lookup
In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arp_dev field may contain IFNAMSIZ bytes with…
CVE-2026-98492Nonenet: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths
In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths Fix 3 leaks in macb_alloc() error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leak…
CVE-2026-98514Nonedrm/nouveau: Fix gem reference leak in validate_init()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix gem reference leak in validate_init() On the ttm_bo_reserve() failure and "vma not found" error paths, the loop breaks without adding the looked-up ob…
CVE-2026-98498Nonenet/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get() When the reverse entry is found but its counter is already being released, refcount_inc_not_z…
CVE-2026-98508Nonedrm/virtio: fix NULL pointer dereference on fence allocation failure
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virt…
CVE-2026-98502NoneHID: alps: unregister DualPoint Stick input device on remove
In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alps_input_configured() allocates a second input device ("DualPoint Stick") with input_allocate_device() a…
CVE-2026-98506Nonemm/hugetlb: do not dissolve gigantic pages without runtime support
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolve_free_hugetlb_folio() doesn't check hstate_is_gigantic_no_runtime(h) though remove_hugetlb_f…
CVE-2026-98504NonePCI: of_property: Omit bus properties without a subordinate bus
In the Linux kernel, the following vulnerability has been resolved: PCI: of_property: Omit bus properties without a subordinate bus A bridge (a device with a Type 1 header) may not have a secondary bus allocated (pdev->subordinate), e.…
CVE-2026-98503Nonepacket: use ubuf_info completion for TX_RING packets
In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called.…
CVE-2026-98509Nonedrm/virtio: fix memory leak of fence event on execbuffer failure
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtio_gpu_execbuffer_ioctl() reserves a DRM event with drm_event_reserve_init() when VIRTGPU_EXECBUF_…
CVE-2026-98513Nonedrm/nouveau: Fix runtime PM leak in nouveau_connector_detect()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveau_connector_detect() If nvif_outp_edid_get() fails, nouveau_connector_detect() returns early without dropping the runtime PM …
CVE-2026-98511Nonedrm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't bump pin count on failed re-pin in nouveau_bo_pin_locked() nouveau_bo_pin_locked() checks whether an already pinned BO is in a memory domain compati…
CVE-2026-98516Nonedrm/nouveau: Fix bridge reference leak in nv1a_ram_new()
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1a_ram_new() pci_get_domain_bus_and_slot() takes a reference to the PCI device, which is never released once the memory siz…
CVE-2026-98519Nonedrm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpu_debugfs_test_ib_show() amdgpu_debugfs_test_ib_show() resumes the device with pm_runtime_get_sync() before taking the reset do…
CVE-2026-98523Nonedrm/client: fix restore of partially initialized client
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm_atomic.c:2031 a…
CVE-2026-98522Nonedrm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()
In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl() Map failure from pvr_mmu_map_sgl() interface was not returned correctly to pvr_mmu_map() inter…
CVE-2026-98521Nonedrm/i915: fix incorrect RCU teardown order
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix incorrect RCU teardown order i915_gem_busy_ioctl uses dma_resv_for_each_fence_unlocked() to iterate over the fences in an GEM object without holding a re…
CVE-2026-98529Nonegpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()
In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out() Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent …
CVE-2026-98525Nonemctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()
In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates ove…
CVE-2026-98528Nonegpio: cdev: fix kernel stack leak to user-space in error path
In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpio_desc_to_lineinfo(), we return immediately before zeroin…