Linux vulnerabilities in CISA KEV
Linux has 32 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 10th highest of any vendor. 9 were added in the last 12 months; 2 are linked to known ransomware use (6.3% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 182), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Kernel, with 32 entries.
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor linux --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
32
in CISA KEV
┌─ first added
2021-12-10
earliest entry
┌─ latest added
2026-10-28
most recent entry
┌─ last 12 months
9
entries added
┌─ ransomware use
2 of 32
6.3% linked to ransomware
┌─ distinct products
1
affected products
$ awk -F, {print $1} /var/log/kev/linux.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 1 | 0 |
| 2022 | 8 | 0 |
| 2023 | 3 | 0 |
| 2024 | 4 | 2 |
| 2025 | 7 | 0 |
| 2026 | 9 | 0 |
$ sort /var/log/kev/linux.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Kernel 32 entries
$ kev-due-dates --vendor linux
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Linux
21 days (range 3 to 182)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/linux.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (31 of 32 have at least one CWE).
$ grep -ril 'Linux' /var/log/news | head -5
Our reporting that names Linux or one of its KEV CVE ids, newest first.
- [HIGH] OpenSSH Patches Authentication Bypass on Alpine Linux news/openssh-patches-alpine-linux-bypass.md
Patch Week pages with these entries
$ wc -l ./linux.kev · 32 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-46300
Kernel
Linux Kernel Missing Initialization of a Variable Vulnerability
due 2026-10-31 · CWE-456
$ cat CVE-2026-46300.txt
Description. Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-39682
Kernel
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
due 2026-09-21 · CWE-754
$ cat CVE-2025-39682.txt
Description. Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2025-39964
Kernel
Linux Kernel Race Condition Vulnerability
due 2026-09-21 · CWE-362
$ cat CVE-2025-39964.txt
Description. Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-53266
Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
due 2026-09-21 · CWE-787
$ cat CVE-2026-53266.txt
Description. Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-53362
Kernel
Linux Kernel Unspecified Vulnerability
due 2026-08-30
$ cat CVE-2026-53362.txt
Description. Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2022-0995
Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
due 2026-08-29 · CWE-787
$ cat CVE-2022-0995.txt
Description. Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2022-0492
Kernel
Linux Kernel Improper Authentication Vulnerability
due 2026-06-05 · CWE-287 CWE-862
$ cat CVE-2022-0492.txt
Description. Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2026-31431
Kernel
Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
due 2026-05-15 · CWE-669
$ cat CVE-2026-31431.txt
Description. Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Required action. "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2018-14634
Kernel
Linux Kernel Integer Overflow Vulnerability
due 2026-02-16 · CWE-190
$ cat CVE-2018-14634.txt
Description. Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2021-22555
Kernel
Linux Kernel Heap Out-of-Bounds Write Vulnerability
due 2025-10-27 · CWE-787
$ cat CVE-2021-22555.txt
Description. Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-38352
Kernel
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
due 2025-09-25 · CWE-367
$ cat CVE-2025-38352.txt
Description. Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2023-0386
Kernel
Linux Kernel Improper Ownership Management Vulnerability
due 2025-07-08 · CWE-282
$ cat CVE-2023-0386.txt
Description. Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-53150
Kernel
Linux Kernel Out-of-Bounds Read Vulnerability
due 2025-04-30 · CWE-125
$ cat CVE-2024-53150.txt
Description. Linux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-53197
Kernel
Linux Kernel Out-of-Bounds Access Vulnerability
due 2025-04-30 · CWE-787
$ cat CVE-2024-53197.txt
Description. Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-50302
Kernel
Linux Kernel Use of Uninitialized Resource Vulnerability
due 2025-03-25 · CWE-908
$ cat CVE-2024-50302.txt
Description. The Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-53104
Kernel
Linux Kernel Out-of-Bounds Write Vulnerability
due 2025-02-26 · CWE-787
$ cat CVE-2024-53104.txt
Description. Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2017-1000253
Kernel [RANSOMWARE]
Linux Kernel PIE Stack Buffer Corruption Vulnerability
due 2024-09-30 · CWE-119
$ cat CVE-2017-1000253.txt
Description. Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-0185
Kernel
Linux Kernel Heap-Based Buffer Overflow Vulnerability
due 2024-09-11 · CWE-190
$ cat CVE-2022-0185.txt
Description. Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2022-2586
Kernel
Linux Kernel Use-After-Free Vulnerability
due 2024-07-17 · CWE-416
$ cat CVE-2022-2586.txt
Description. Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.
Required action. Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
- CVE-2024-1086
Kernel [RANSOMWARE]
Linux Kernel Use-After-Free Vulnerability
due 2024-06-20 · CWE-416
$ cat CVE-2024-1086.txt
Description. Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2010-3904
Kernel
Linux Kernel Improper Input Validation Vulnerability
due 2023-06-02 · CWE-20
$ cat CVE-2010-3904.txt
Description. Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2014-0196
Kernel
Linux Kernel Race Condition Vulnerability
due 2023-06-02 · CWE-362
$ cat CVE-2014-0196.txt
Description. Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
Required action. The impacted product is end-of-life and should be disconnected if still in use.
- CVE-2023-0266
Kernel
Linux Kernel Use-After-Free Vulnerability
due 2023-04-20 · CWE-416
$ cat CVE-2023-0266.txt
Description. Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
Required action. Apply updates per vendor instructions.
- CVE-2021-3493
Kernel
Linux Kernel Privilege Escalation Vulnerability
due 2022-11-10 · CWE-862
$ cat CVE-2021-3493.txt
Description. The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2013-2094
Kernel
Linux Kernel Privilege Escalation Vulnerability
due 2022-10-06 · CWE-189
$ cat CVE-2013-2094.txt
Description. Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2013-2596
Kernel
Linux Kernel Integer Overflow Vulnerability
due 2022-10-06 · CWE-189
$ cat CVE-2013-2596.txt
Description. Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2013-6282
Kernel
Linux Kernel Improper Input Validation Vulnerability
due 2022-10-06 · CWE-20
$ cat CVE-2013-6282.txt
Description. The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2014-3153
Kernel
Linux Kernel Privilege Escalation Vulnerability
due 2022-06-15 · CWE-269
$ cat CVE-2014-3153.txt
Description. The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
Required action. Apply updates per vendor instructions.
- CVE-2022-0847
Kernel
Linux Kernel Privilege Escalation Vulnerability
due 2022-05-16 · CWE-665
$ cat CVE-2022-0847.txt
Description. Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."
Required action. Apply updates per vendor instructions.
- CVE-2021-22600
Kernel
Linux Kernel Privilege Escalation Vulnerability
due 2022-05-02 · CWE-415
$ cat CVE-2021-22600.txt
Description. Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2016-5195
Kernel
Linux Kernel Race Condition Vulnerability
due 2022-03-24 · CWE-362
$ cat CVE-2016-5195.txt
Description. Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Required action. Apply updates per vendor instructions.
- CVE-2019-13272
Kernel
Linux Kernel Improper Privilege Management Vulnerability
due 2022-06-10 · CWE-269
$ cat CVE-2019-13272.txt
Description. Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Required action. Apply updates per vendor instructions.