Linux Kernel
21,934 CVEs tracked. 36 of them are in CISA KEV.
This hub aggregates every CVE we track for Linux Kernel, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Linux Kernel CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 356 |
| 2025-01 | 229 |
| 2025-02 | 910 |
| 2025-03 | 207 |
| 2025-04 | 280 |
| 2025-05 | 551 |
| 2025-06 | 376 |
| 2025-07 | 404 |
| 2025-08 | 188 |
| 2025-09 | 738 |
| 2025-10 | 651 |
| 2025-11 | 104 |
| 2025-12 | 1055 |
| 2026-01 | 246 |
| 2026-02 | 222 |
| 2026-03 | 178 |
| 2026-04 | 377 |
| 2026-05 | 1029 |
| 2026-06 | 513 |
| 2026-07 | 836 |
| 2026-08 | 1643 |
| 2026-09 | 2107 |
| 2026-10 | 1051 |
| 2026-11 | 65 |
Severity
How the 21,934 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical958
- High8,268
- Medium8,762
- Low435
Latest CVEs
The 15 most recently published vulnerabilities affecting Linux Kernel.
- CVE-2026-99288inet: reject unhashed sockets during established lookups—
- CVE-2026-99287xen-netback: Zero out sring pointers on unmap—
- CVE-2026-99286xen-netback: Fix XenBus connection failure cleanup—
- CVE-2026-99285netfilter: nft_byteorder: remove multi-register support—
- CVE-2026-99284net: skbuff: propagate shared-frag marker in skb_zerocopy()—
- CVE-2026-99283netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets—
- CVE-2026-99281tun: Require CAP_NET_ADMIN to attach to an ownerless device7.8
- CVE-2026-99280ksmbd: drain session procfs readers before dropping table references—
- CVE-2026-99282net/sched: sch_teql: fix use-after-free on lower qdisc drop—
- CVE-2026-99279ksmbd: reclaim ended sessions on logoff and expiration—
- CVE-2026-99277ksmbd: hold a connection reference for each session channel7.5
- CVE-2026-99275smb: client: reject short SESSION_SETUP responses—
- CVE-2026-99276ksmbd: defer connection scavenging while session locks are busy—
- CVE-2026-99278ksmbd: limit sessions on each connection—
- CVE-2026-99274smb: client: fix fiemap wild read on empty truncated response—
Product grouping is registry-driven, with AI assist and human review. How it works