linux has 8,801 CVEs on record between 2019 and 2026. Disclosure cadence is accelerating: 3618 in the last 90 days against 1308 in the 90 before. The busiest recent month was September 2026 with 2014. The median CVSS is 7.8 (high), with 520 rated critical. 0% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 158 days (7 cases). The dominant weakness classes are CWE-416 (496) and CWE-476 (444). Most affected products: Linux (6450), linux_kernel (2349), kernel (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 158 d median(7)
- Last 90 days
- 3618 prev 1308
Weakness classes
Products
- Linux 6450
- linux_kernel 2349
- kernel 1
- layer_2_tunneling_protocol 1
Worst active — by depth score
CVE-2025-39682Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA re…80CVE-2025-22037High· 7.5In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in alloc_preauth_hash() The Client send malformed smb2 negotiate request80CVE-2026-43284High· 8.8In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb79CVE-2023-3867Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request76CVE-2026-53266High· 8.8In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0)74
linux vulnerabilities
CVEs affecting linux, newest first. Open any entry for full detail, references, and exploit status.
8801 CVEsRSS
CVE-2026-89672Critical· 9.1⚖ disputednfsd: gate nfs2 setacl by argp->mask
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs2 setacl by argp->mask The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_a…
CVE-2026-89671Critical· 9.1⚖ disputednfsd: gate nfs3 setacl by argp->mask
In the Linux kernel, the following vulnerability has been resolved: nfsd: gate nfs3 setacl by argp->mask nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access …
CVE-2026-89669Critical· 9.8⚖ disputednfsd: initialize copy-notify stateid before publishing it
In the Linux kernel, the following vulnerability has been resolved: nfsd: initialize copy-notify stateid before publishing it nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already lin…
CVE-2026-89665High· 8.2nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE
In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range useconds in NFSv2 SETATTR/CREATE The NFSv2 sattr decoder converts the wire useconds to nanoseconds in svcxdr_decode_sattr(): iap->ia_atime.…
CVE-2026-89663High· 8.8nfsd: revoke copy-notify stateids before dropping their reference
In the Linux kernel, the following vulnerability has been resolved: nfsd: revoke copy-notify stateids before dropping their reference Copy-notify stateids live in the s2s_cp_stateids IDR and on their parent stid's sc_cp_list, pinned by…
CVE-2026-89662Critical· 9.8⚖ disputedNFSD: Prevent lock owner use-after-free during client teardown
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent lock owner use-after-free during client teardown __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked l…
CVE-2026-89657High· 7.5libceph: validate OSD extent maps before cursor advance
In the Linux kernel, the following vulnerability has been resolved: libceph: validate OSD extent maps before cursor advance net/ceph/osd_client.c:osd_sparse_read() validates that the sparse-read data length matches the summed extent le…
CVE-2026-89656Critical· 9.8libceph: reject buckets with mismatched CRUSH ids
In the Linux kernel, the following vulnerability has been resolved: libceph: reject buckets with mismatched CRUSH ids crush_decode() stores bucket data by array slot, and the mapper later derives the per-bucket workspace index from the…
CVE-2026-89655Critical· 9.8⚖ disputedceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
In the Linux kernel, the following vulnerability has been resolved: ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages.…
CVE-2026-89653Critical· 9.8ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit numbe…
CVE-2026-89652Critical· 9.8⚖ disputedceph: bound copied dentry name length in NFS export get_name
In the Linux kernel, the following vulnerability has been resolved: ceph: bound copied dentry name length in NFS export get_name ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rin…
CVE-2026-89650Critical· 9.1⚖ disputedceph: bound num_export_targets array for mds info v2/v3
In the Linux kernel, the following vulnerability has been resolved: ceph: bound num_export_targets array for mds info v2/v3 ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances th…
CVE-2026-89649Critical· 9.1⚖ disputedceph: bound xattr value length in __build_xattrs()
In the Linux kernel, the following vulnerability has been resolved: ceph: bound xattr value length in __build_xattrs() __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit n…
CVE-2026-89643Critical· 9.8audit: avoid dropping live tree ref on fsnotify rule autoremove
In the Linux kernel, the following vulnerability has been resolved: audit: avoid dropping live tree ref on fsnotify rule autoremove audit_del_rule() is used for both netlink deletion templates and internal fsnotify autoremove. The for…
CVE-2026-89640High· 7.1cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
In the Linux kernel, the following vulnerability has been resolved: cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0 With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - o…
CVE-2026-89636Critical· 9.8⚖ disputedsmb: client: clear ce->tgthint in free_tgts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: clear ce->tgthint in free_tgts() When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt struct…
CVE-2026-89634Critical· 9.1⚖ disputedsmb: client: fix ALIGN() overflow in symlink_data() error context loop
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN() overflow in symlink_data() error context loop The check added by commit 7d9a7f1f96cd ("smb/client: fix possible infinite loop and oob read in …
CVE-2026-89628Medium· 5.5HID: picolcd: clamp eeprom debugfs read to bytes actually received
In the Linux kernel, the following vulnerability has been resolved: HID: picolcd: clamp eeprom debugfs read to bytes actually received picolcd_debug_eeprom_read() trusts resp->raw_data[2] -- a length byte supplied by the device in its …
CVE-2026-89627Medium· 5.5HID: roccat: free buffered reports when destroying device
In the Linux kernel, the following vulnerability has been resolved: HID: roccat: free buffered reports when destroying device roccat_report_event() duplicates each report with kmemdup() and stores the allocation in a circular-buffer sl…
CVE-2026-89626High· 8.8HID: sensor: custom: Fix field sysfs group cleanup on failure
In the Linux kernel, the following vulnerability has been resolved: HID: sensor: custom: Fix field sysfs group cleanup on failure hid_sensor_custom_add_attributes() creates one sysfs group for each custom sensor field. If sysfs_create_…
CVE-2026-89623Medium· 5.5HID: mcp2221: stop device IO before hid_hw_stop
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the devm cleanup callback mcp2221_hid_unregister() so that incoming HID reports canno…
CVE-2026-89621Medium· 5.5HID: mcp2221: validate report size in mcp2221_raw_event()
In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: validate report size in mcp2221_raw_event() mcp2221_raw_event() never validates the size of incoming HID reports. In the MCP2221_I2C_GET_DATA path it tru…
CVE-2026-89618Medium· 5.5eventfs: Initialize ei->children and ei->list in init_ei()
In the Linux kernel, the following vulnerability has been resolved: eventfs: Initialize ei->children and ei->list in init_ei() eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initia…
CVE-2026-89617High· 7.8⚖ disputedfs/ntfs3: validate dirty page table on log replay
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR_PAGE_ENTRY ends in a page_lcns[] array whose length is the on-disk lcns_follow field. check_rstbl() validate…
CVE-2026-89616High· 7.5⚖ disputedfs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame() ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target pages and then trusts de…
CVE-2026-89615High· 8.4⚖ disputedfs/ntfs3: bound page_lcns[] index by the log record
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page_lcns[] index by the log record The copy_lcns loop and the redo shorten loop index page_lcns[] at j + i, where i runs up to the log record's lcns_f…
CVE-2026-89609High· 7.8ecryptfs: hold msg ctx list lock when cleaning daemon queue
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: hold msg ctx list lock when cleaning daemon queue ecryptfs_exorcise_daemon() drops queued messages from a dying daemon without holding ecryptfs_msg_ctx_lists…
CVE-2026-89608High· 7.1ecryptfs: pass packet set buffer size to parser
In the Linux kernel, the following vulnerability has been resolved: ecryptfs: pass packet set buffer size to parser ecryptfs_parse_packet_set() receives a pointer into the file header, but it calculates the remaining packet buffer size…
CVE-2026-89746High· 7.8tracing: Fix use-after-free with same-name named triggers
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free with same-name named triggers When two hist triggers on different events are registered with the same name=, the second one reuses the firs…
CVE-2026-89744High· 8.4⚖ disputeddevice property: fix infinite loop in fwnode_for_each_child_node()
In the Linux kernel, the following vulnerability has been resolved: device property: fix infinite loop in fwnode_for_each_child_node() When iterate over children of a fwnode that has a secondary fwnode, fwnode_get_next_child_node() can…