Vendor
Linux
18,382 known vulnerabilities.
Linux at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 61 | 0 |
| Oct 2026 | 1,051 | 13 |
| Sep 2026 | 2,107 | 110 |
| Aug 2026 | 1,643 | 212 |
| Jul 2026 | 836 | 88 |
| Jun 2026 | 513 | 40 |
| May 2026 | 1,027 | 43 |
| Apr 2026 | 377 | 29 |
| Mar 2026 | 178 | 1 |
| Feb 2026 | 220 | 1 |
| Jan 2026 | 246 | 12 |
| Dec 2025 | 1,054 | 37 |
| Nov 2025 | 104 | 2 |
| Oct 2025 | 651 | 11 |
| Sep 2025 | 737 | 24 |
| Aug 2025 | 185 | 11 |
| Jul 2025 | 401 | 19 |
| Jun 2025 | 375 | 2 |
| May 2025 | 549 | 10 |
| Apr 2025 | 280 | 7 |
| Mar 2025 | 207 | 4 |
| Feb 2025 | 909 | 18 |
| Jan 2025 | 223 | 14 |
| Dec 2024 | 354 | 14 |
Most common weaknesses
Latest advisories
-
High max 9.8NCSC-2026-0461 2 CVEs
Kwetsbaarheden verholpen in Linux kernel
Linux heeft kwetsbaarheden verholpen in de IPv4 TCP stack en het IPv4 networking subsystem van de Linux kernel.
-
High max 7.8
Kwetsbaarheid verholpen in Linux kernel cryptographic subsystem
De Linux kernel heeft een kwetsbaarheid verholpen in de algif_aead crypto module binnen het cryptographic subsystem.
18,382 results · Feed
-
Unscored —
net: skbuff: propagate shared-frag marker in skb_zerocopy()
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in skb_zerocopy() skb_zerocopy() moves frag descriptors from @from into @to and takes a reference on each frag, but it does not copy skb_shinfo(from)…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for no…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qd…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: tun: Require CAP_NET_ADMIN to attach to an ownerles…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: drain session procfs readers before dropping…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reclaim ended sessions on logoff and expirat…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: limit sessions on each connection The pendin…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: hold a connection reference for each session…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer connection scavenging while session lo…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short SESSION_SETUP responses s…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix fiemap wild read on empty truncate…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reserve space for the UTF-16 terminator in s…
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2_read() …
-
Unscored —
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Clear prev_fbuf on capture buffer rele…
-
Unscored —
xen-netback: defer xenvif_mcast_addr_list_free()
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen f…
-
Unscored —
xen-blkback: Avoid UAF when reading I/O statistics
In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading …
-
Unscored —
xen-netback: Fix UAF when reading statistics data
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to …
-
High 8.1
tcp: Fix potential UAF in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk imm…
-
High 7.8
sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleare…
-
Unscored —
drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.
-
Unscored —
ntfs: fix resident conversion in ntfs_new_attr_flags
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident conversion and terminated.
-
Unscored —
dm cache: fix issue with background work locking
In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_semaphore for background_work_lock. Write locks on rw_semaphores have strict owner semantics, but there was no guarantee th…
-
Unscored —
soc/tegra: pmc: Fix uninitialised clock rate
In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegra_pmc_enter_suspend_mode() function is being triggered because the early_pmc->rate variabl…
-
Unscored —
gpio: shared: gracefully handle no-device lookup of shared GPIOs
In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no de…
-
Unscored —
x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() hv_apicid_to_vp_index() currently uses the per-cpu hypercall input and output pages. This function is called when runnin…
-
Unscored —
io_uring/io-wq: don't hide a link from cancellations
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks everywhere a request can be,…
-
Unscored —
io_uring/cancel: rearm local work wake up before sleep
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: rearm local work wake up before sleep io_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next io_req_local_work_add() wakes the cancelling task. The add that t…
-
Unscored —
io_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats that until the list is emp…
-
Unscored —
printk: Postpone kthread startup
In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports related to SMP systems hanging on boot. The reports vary but seem to have some overlap with regard to missed IPI's during …
-
Unscored —
Drivers: hv: Avoid infinite retry loop in init_vp_index()
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a retry loop in init_vp_index() where the CPUs from a certain node are stripped out if they have already been in the allocat…
-
Unscored —
pid_namespace: make zap_pid_ns_processes() freezable
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the…
-
Unscored —
tracing: Do not initialize tracefs work if tracing is disabled
In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trace buffer allocation fails during early boot (e.g. in early_trace_init() -> allocate_trace_buffers()), tracing_disabled is…
-
Unscored —
i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The devres conversion replaced manual pm_runtime_enable()/disable() with devm_pm_runtime_set_active_enabled() and dropped the r…
-
High 8.1
tipc: protect node reset trace dump with node lock
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link …
-
Unscored —
KEYS: Fix key_reject_and_link() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with a concurrent keyring_re…
-
Unscored —
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processe…
-
Unscored —
ntfs: fix race between fallocate and mmap reads
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation mo…
-
Unscored —
ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()
In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or fallocat…
-
High 7.8
Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There is …
-
Unscored —
mm/damon/core: error damos_commit_quota_goal() for zero target_value
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos_commit_quota_goal() for zero target_value Patch series "mm/damon: move zero damos quota target_value handling to the core layer". Having zero DAMOS quota target val…