Linux known exploited vulnerabilities
Every Linux CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 32 in all, 9 added in the last 12 months.
- CVE-2026-46300net: skbuff: preserve shared-frag marker during coalescingLinux
- CVE-2026-53266netfilter: bridge: make ebt_snat ARP rewrite writableLinux
- CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsgLinux
- CVE-2025-39682tls: fix handling of zero-length records on the rx_listLinux · :linux_kernel:
- CVE-2026-53362ipv6: account for fraggap on the paged allocation pathLinux
- CVE-2022-0995An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.kernel
- CVE-2022-0492A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function.kernel
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeLinux
- CVE-2018-14634An integer overflow flaw was found in the Linux kernel's create_elf_tables() function.The Linux Foundation kernel
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACELinux Kernel
- CVE-2025-38352posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()Linux
- CVE-2023-0386A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the LinuxKernel
- CVE-2024-53197ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devicesLinux
- CVE-2024-53150ALSA: usb-audio: Fix out of bounds reads when finding clock sourcesLinux
- CVE-2024-50302HID: core: zero-initialize the report bufferLinux · :linux_kernel:
- CVE-2024-53104media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_formatLinux
- CVE-2017-1000253Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86
- CVE-2022-0185A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel
- CVE-2022-2586It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that The Linux Kernel Organization linux
- CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2014-0196The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO
- CVE-2010-3904The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before
- CVE-2023-0266Use after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelLinux Kernel
- CVE-2021-3493The overlayfs implementation in the linux kernel did not properly validate with respect to user namespaces the setting of file capabilities Ubuntu linux kernel
- CVE-2013-6282The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain add
- CVE-2013-2596Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of A
- CVE-2013-2094The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows lo
- CVE-2014-3153The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresse
- CVE-2019-13272In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to cre
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe kernel
- CVE-2021-22600Double Free in net/packet/af_packet.c leading to priviledge escalationLinux Kernel Kernel
- CVE-2016-5195Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect ha
FAQ
Linux KEV questions.
How many Linux vulnerabilities are in CISA KEV?
32 Linux vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 9 of them added in the last 12 months. The newest is CVE-2026-46300 (Linux Kernel Missing Initialization of a Variable Vulnerability), added 2026-10-28.
Which Linux products are in CISA KEV?
1 product, including Kernel. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Linux KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 2 of the 32 Linux entries.