Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 3,629 published records · 12 KEV · 3,629 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

3,629 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3078.5%
High1,02528%
Med1,54142%
Low1123.1%
None10.03%
Legacy00.00%
Unscored64318%

Matching records by UTC month

Aug 253,629

Signal coverage

KEV-listed: 12
With a forecast: 3,629
Unknown date: 0
Unscored severity: 643

Share of cohort: KEV 0.33% · forecast 100% · unscored 18%.

Showing 1501–1520 of 3,629By severity band: Critical · 9.0–10.0 307, High · 7.0–8.9 1,025, Medium · 4.0–6.9 1,541, Low · 0.1–3.9 112, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 643

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38612

staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:54.797Z. Updated 2026-05-11T21:31:34.829Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:31 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38610

powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw()

In the Linux kernel, the following vulnerability has been resolved: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1501 to 1520 of 3629.First page Next page

Published 2025-08-19T17:03:53.255Z. Updated 2026-05-11T21:31:33.696Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:31 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38609

PM / devfreq: Check governor before using governor->name

In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and direc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:52.542Z. Updated 2026-05-11T21:31:32.425Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:31 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38608

bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls

In the Linux kernel, the following vulnerability has been resolved: bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to reca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:51.688Z. Updated 2026-10-15T22:02:26.621Z.

CVSS8.6v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38607

bpf: handle jset (if a & b ...) as a jump in CFG computation

In the Linux kernel, the following vulnerability has been resolved: bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the following example: …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:50.947Z. Updated 2026-08-05T12:03:27.014Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38606

wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:50.189Z. Updated 2026-05-11T21:31:28.971Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:31 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38605

wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kern…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:49.295Z. Updated 2026-10-21T12:37:10.261Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38604

wifi: rtl818x: Kill URBs before clearing tx status queue

In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before fr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:43.358Z. Updated 2026-08-05T12:03:25.920Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38602

iwlwifi: Add missing check for alloc_ordered_workqueue

In the Linux kernel, the following vulnerability has been resolved: iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:41.604Z. Updated 2026-05-11T21:31:25.477Z.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 04:31 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38601

wifi: ath11k: clear initialized flag for deinit-ed srng lists

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:35.798Z. Updated 2026-10-15T22:02:26.485Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38600

wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:34.830Z. Updated 2026-08-05T12:03:21.611Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38599

wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx() Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:34.029Z. Updated 2026-08-05T12:03:20.543Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38598

drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [ +0.000020] BUG: KASAN: slab-use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000817] Read of size 8 at addr ffff88812eec8c58 by task amd_pci_unplug/1733 [ +0.000…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:33.308Z. Updated 2026-08-05T12:03:19.380Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38597

drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port

In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available windows trying to find one designated as p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:32.380Z. Updated 2026-10-21T12:37:09.171Z.

CVSS—KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38596

drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed before calling drm_gem_handle_create(), except the debugfs …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:26.445Z. Updated 2026-08-05T12:03:18.312Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38595

xen: fix UAF in dmabuf_exp_from_pages()

In the Linux kernel, the following vulnerability has been resolved: xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:25.527Z. Updated 2026-10-21T12:37:08.055Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated21 Oct 2026, 19:37 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38594

iommu/vt-d: Fix UAF on sva unbind with pending IOPFs

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") disables IOPF on device by removing the device from its IOMMU's IOPF queue when the last IOPF-capable domain is detache…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:19.689Z. Updated 2026-08-05T12:03:16.095Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38593

Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_cmd_sync_work()' 'update_passive_scan_s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:18.960Z. Updated 2026-10-15T22:02:26.347Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated16 Oct 2026, 05:02 WIB

Official record

HighPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38592

Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv Currently both dev_coredumpv and skb_put_data in hci_devcd_dump use hdev->dump.head. However, dev_coredumpv can free the buffer. From dev_coredumpm_timeout documentation, which is used by…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:18.229Z. Updated 2026-08-05T12:03:13.863Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated05 Aug 2026, 19:03 WIB

Official record

UnscoredPublished 20 Aug 2025, 00:03 WIB

CVE-2025-38591

bpf: Reject narrower access to pointer ctx fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-08-19T17:03:12.508Z. Updated 2026-10-15T01:07:31.830Z.

CVSS—KEVNot listedEPSSPresentUpdated15 Oct 2026, 08:07 WIB

Official record