Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 6,236 published records · 10 KEV · 6,236 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

6,236 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4517.2%
High2,14734%
Med2,43639%
Low2253.6%
None90.14%
Legacy00.00%
Unscored96816%

Matching records by UTC month

Mar 266,236

Signal coverage

KEV-listed: 10
With a forecast: 6,236
Unknown date: 0
Unscored severity: 968

Share of cohort: KEV 0.16% · forecast 100% · unscored 16%.

Showing 1481–1500 of 6,236By severity band: Critical · 9.0–10.0 451, High · 7.0–8.9 2,147, Medium · 4.0–6.9 2,436, Low · 0.1–3.9 225, None · scored 0.0 9, Legacy · v2 only 0, Unscored · no CNA metric 968

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23349

HID: pidff: Fix condition effect bit clearing

In the Linux kernel, the following vulnerability has been resolved: HID: pidff: Fix condition effect bit clearing As reported by MPDarkGuy on discord, NULL pointer dereferences were happening because not all the conditional effects bits were cleared. Properly clear all conditional effect bits from ffbit

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:35.443Z. Updated 2026-05-11T22:05:08.782Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23348

cxl: Fix race of nvdimm_bus object when creating nvdimm objects

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimm_bus object when creating nvdimm objects Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue reproduce fairly consistently. The cxl_translate module has depe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1481 to 1500 of 6236.First page Next page

Published 2026-03-25T10:27:34.462Z. Updated 2026-05-11T22:05:07.592Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23347

can: usb: f81604: correctly anchor the urb in the read bulk callback

In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: correctly anchor the urb in the read bulk callback When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:33.753Z. Updated 2026-05-11T22:05:06.123Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23346

arm64: io: Extract user memory type in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Extract user memory type in ioremap_prot() The only caller of ioremap_prot() outside of the generic ioremap() implementation is generic_access_phys(), which passes a 'pgprot_t' value determined from the user mapping of the target 'pfn' bei…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:33.133Z. Updated 2026-06-19T11:57:35.219Z.

CVSS—KEVNot listedEPSSPresentUpdated19 Jun 2026, 18:57 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23345

arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled

In the Linux kernel, the following vulnerability has been resolved: arm64: gcs: Do not set PTE_SHARED on GCS mappings if FEAT_LPA2 is enabled When FEAT_LPA2 is enabled, bits 8-9 of the PTE replace the shareability attribute with bits 50-51 of the output address. The _PAGE_GCS{,_RO} definitions include the PTE_SHARED …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:32.432Z. Updated 2026-05-11T22:05:02.929Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23344

crypto: ccp - Fix use-after-free on error path

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix use-after-free on error path In the error path of sev_tsm_init_locked(), the code dereferences 't' after it has been freed with kfree(). The pr_err() statement attempts to access t->tio_en and t->tio_init_done after the memory has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:31.795Z. Updated 2026-05-11T22:05:01.536Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:05 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23343

xdp: produce a warning when calculated tailroom is negative

In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesiz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:31.130Z. Updated 2026-10-15T01:14:14.064Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23342

bpf: Fix race in cpumap on PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix race in cpumap on PREEMPT_RT On PREEMPT_RT kernels, the per-CPU xdp_bulk_queue (bq) can be accessed concurrently by multiple preemptible tasks on the same CPU. The original code assumes bq_enqueue() and __cpu_map_flush() run atomically with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:30.285Z. Updated 2026-05-11T22:04:59.186Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23341

accel/amdxdna: Fix crash when destroying a suspended hardware context

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix crash when destroying a suspended hardware context If userspace issues an ioctl to destroy a hardware context that has already been automatically suspended, the driver may crash because the mailbox channel pointer is NULL for the s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:29.438Z. Updated 2026-10-15T10:06:58.305Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 17:06 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23340

net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs

In the Linux kernel, the following vulnerability has been resolved: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:28.728Z. Updated 2026-10-19T18:35:41.889Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23339

nfc: nci: free skb on nci_transceive early error paths

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free skb on nci_transceive early error paths nci_transceive() takes ownership of the skb passed by the caller, but the -EPROTO, -EINVAL, and -EBUSY error paths return without freeing it. Due to issues clearing NCI_DATA_EXCHANGE fixed by su…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:28.073Z. Updated 2026-10-15T01:14:10.367Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23338

drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: Do not allow userspace to trivially triger kernel warnings Userspace can either deliberately pass in the too small num_fences, or the required number can legitimately grow between the two calls to the userq wait ioctl. In both cases…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:27.377Z. Updated 2026-05-11T22:04:54.623Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23337

pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config()

In the Linux kernel, the following vulnerability has been resolved: pinctrl: pinconf-generic: Fix memory leak in pinconf_generic_parse_dt_config() In pinconf_generic_parse_dt_config(), if parse_dt_cfg() fails, it returns directly. This bypasses the cleanup logic and results in a memory leak of the cfg buffer. Fix th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:26.720Z. Updated 2026-05-11T22:04:53.467Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

HighPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23336

wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() There is a use-after-free error in cfg80211_shutdown_all_interfaces found by syzkaller: BUG: KASAN: use-after-free in cfg80211_shutdown_all_interfaces+0x213/0x220 Read of size 8 at addr …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:26.061Z. Updated 2026-10-19T18:35:41.752Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 01:35 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23335

RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - N…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:25.418Z. Updated 2026-10-15T01:14:06.028Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:14 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23334

can: usb: f81604: handle short interrupt urb messages properly

In the Linux kernel, the following vulnerability has been resolved: can: usb: f81604: handle short interrupt urb messages properly If an interrupt urb is received that is not the correct length, properly detect it and don't attempt to treat the data as valid.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:24.664Z. Updated 2026-05-11T22:04:49.994Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23332

cpufreq: intel_pstate: Fix crash during turbo disable

In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix crash during turbo disable When the system is booted with kernel command line argument "nosmt" or "maxcpus" to limit the number of CPUs, disabling turbo via: echo 1 > /sys/devices/system/cpu/intel_pstate/no_turbo results…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:23.193Z. Updated 2026-05-11T22:04:48.876Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23331

udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected.

In the Linux kernel, the following vulnerability has been resolved: udp: Unhash auto-bound connected sk from 4-tuple hash table when disconnected. Let's say we bind() an UDP socket to the wildcard address with a non-zero port, connect() it to an address, and disconnect it from the address. bind() sets SOCK_BINDPORT_…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:22.526Z. Updated 2026-05-11T22:04:47.743Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23330

nfc: nci: complete pending data exchange on device close

In the Linux kernel, the following vulnerability has been resolved: nfc: nci: complete pending data exchange on device close In nci_close_device(), complete any pending data exchange before closing. The data exchange callback (e.g. rawsock_data_exchange_complete) holds a socket reference. NIPA occasionally hits this…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:21.871Z. Updated 2026-05-11T22:04:46.617Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record

UnscoredPublished 25 Mar 2026, 17:27 WIB

CVE-2026-23329

libie: don't unroll if fwlog isn't supported

In the Linux kernel, the following vulnerability has been resolved: libie: don't unroll if fwlog isn't supported The libie_fwlog_deinit() function can be called during driver unload even when firmware logging was never properly initialized. This led to call trace: [ 148.576156] Oops: Oops: 0000 [#1] SMP NOPTI [ 14…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-03-25T10:27:21.212Z. Updated 2026-05-11T22:04:45.405Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 05:04 WIB

Official record