CVE Tools
Track your stack

Linux

21,224 CVEs tracked since 1999. Since Oct 2021, 16 of them reached CISA KEV.

Linux CVEs per month

Oct 2021 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Linux CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2021-1070
2021-1160
2021-1281
2022-01141
2022-02261
2022-03432
2022-04150
2022-05180
2022-06100
2022-07210
2022-08450
2022-09360
2022-10460
2022-11170
2022-12270
2023-01211
2023-02180
2023-03no snapshot
2023-04430
2023-05190
2023-06341
2023-07390
2023-08160
2023-09320
2023-10200
2023-11140
2023-12140
2024-01422
2024-022990
2024-032350
2024-043580
2024-0510740
2024-062851
2024-074400
2024-083020
2024-092770
2024-104150
2024-112791
2024-123543
2025-012230
2025-029100
2025-032070
2025-042800
2025-055500
2025-063750
2025-074011
2025-081860
2025-097370
2025-106510
2025-111040
2025-1210550
2026-012460
2026-022200
2026-031780
2026-043791
2026-0510280
2026-065140
2026-078370
2026-0816450
2026-0921150
2026-1010510
2026-110

Products

The products that kept showing up in Linux's monthly top three, with their CVEs summed over those months.

  1. Linux18,20338 months
  2. Linux Kernel11,09658 months
  3. Kernel6913 months
  4. Layer 2 Tunneling Protocol11 month
  5. Linux Kernal11 month
  6. Linux_kernel11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Linux.

  1. CVE-2026-99284net: skbuff: propagate shared-frag marker in skb_zerocopy()—
  2. CVE-2026-99283netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets—
  3. CVE-2026-99281tun: Require CAP_NET_ADMIN to attach to an ownerless device—
  4. CVE-2026-99280ksmbd: drain session procfs readers before dropping table references—
  5. CVE-2026-99279ksmbd: reclaim ended sessions on logoff and expiration—
  6. CVE-2026-99282net/sched: sch_teql: fix use-after-free on lower qdisc drop—
  7. CVE-2026-99278ksmbd: limit sessions on each connection—
  8. CVE-2026-99277ksmbd: hold a connection reference for each session channel—
  9. CVE-2026-99276ksmbd: defer connection scavenging while session locks are busy—
  10. CVE-2026-99275smb: client: reject short SESSION_SETUP responses—
  11. CVE-2026-99273ksmbd: reserve space for the UTF-16 terminator in stream info—
  12. CVE-2026-99274smb: client: fix fiemap wild read on empty truncated response—
  13. CVE-2026-99272smb: client: validate the data area in SMB2_read()—
  14. CVE-2026-99271ALSA: line6: Clear prev_fbuf on capture buffer release—
  15. CVE-2026-100082xen-blkback: Avoid UAF when reading I/O statistics—

The record

Peak rank
#1 in Sep 2026
Busiest month shown
Sep 2026, 2,115 CVEs
Months with a KEV entry
12 since Oct 2021
Monthly snapshots
264 since 1999
Linux's full record, month by month